# Vulnerabilities published in 2017


- [CVE-2017-11503](https://insights.sbomify.com/CVE-2017-11503/): Cross-site scripting in PHPMailer (medium 6.1)
- [CVE-2017-11502](https://insights.sbomify.com/CVE-2017-11502/): Path traversal in cisco:dpc3928ad docsis wireless router firmware (critical 9.8)
- [CVE-2017-11501](https://insights.sbomify.com/CVE-2017-11501/): Security feature bypass in nixos project:nixos (medium 5.9)
- [CVE-2017-11500](https://insights.sbomify.com/CVE-2017-11500/): Path traversal in metinfo:metinfo (high 7.5)
- [CVE-2017-1150](https://insights.sbomify.com/CVE-2017-1150/): Privilege escalation in DB2 for Linux, UNIX and Windows (low 3.1)
- [CVE-2017-11499](https://insights.sbomify.com/CVE-2017-11499/): Denial of service in nodejs:node.js (high 7.5)
- [CVE-2017-11498](https://insights.sbomify.com/CVE-2017-11498/): Memory corruption in gemalto:sentinel ldk rte (high 7.5)
- [CVE-2017-11497](https://insights.sbomify.com/CVE-2017-11497/): Memory corruption in gemalto:sentinel ldk rte (critical 9.8)
- [CVE-2017-11496](https://insights.sbomify.com/CVE-2017-11496/): Memory corruption in gemalto:sentinel ldk rte (critical 9.8)
- [CVE-2017-11495](https://insights.sbomify.com/CVE-2017-11495/): Missing authorization in phicomm:k2\(psg1218\)-firmware (critical 9.8)
- [CVE-2017-11494](https://insights.sbomify.com/CVE-2017-11494/): SQL injection in sol-connect:sol.connect iset-mpp meter firmware (critical 9.8)
- [CVE-2017-1149](https://insights.sbomify.com/CVE-2017-1149/): XML external entity in UrbanCode Deploy (high 8.1)
- [CVE-2017-11482](https://insights.sbomify.com/CVE-2017-11482/): Open redirect in Kibana (medium 6.1)
- [CVE-2017-11481](https://insights.sbomify.com/CVE-2017-11481/): Cross-site scripting in Kibana (medium 6.1)
- [CVE-2017-11480](https://insights.sbomify.com/CVE-2017-11480/): Denial of Service in Packetbeat (high 7.5)
- [CVE-2017-1148](https://insights.sbomify.com/CVE-2017-1148/): Information disclosure in OpenPages GRC Platform (medium 5.3)
- [CVE-2017-11479](https://insights.sbomify.com/CVE-2017-11479/): Cross-site scripting in elastic:kibana (medium 6.1)
- [CVE-2017-11478](https://insights.sbomify.com/CVE-2017-11478/): Denial of service in imagemagick:imagemagick (medium 6.5)
- [CVE-2017-11475](https://insights.sbomify.com/CVE-2017-11475/): SQL injection in glpi-project:glpi (high 8.8)
- [CVE-2017-11474](https://insights.sbomify.com/CVE-2017-11474/): SQL injection in glpi-project:glpi (critical 9.8)
- [CVE-2017-11473](https://insights.sbomify.com/CVE-2017-11473/): Memory corruption in canonical:ubuntu linux (high 7.8)
- [CVE-2017-11472](https://insights.sbomify.com/CVE-2017-11472/): Information disclosure in linux:linux kernel (high 7.1)
- [CVE-2017-11471](https://insights.sbomify.com/CVE-2017-11471/): SQL injection in idera:uptime infrastructure monitor (critical 9.8)
- [CVE-2017-11470](https://insights.sbomify.com/CVE-2017-11470/): SQL injection in idera:uptime infrastructure monitor (critical 9.8)
- [CVE-2017-1147](https://insights.sbomify.com/CVE-2017-1147/): Cross-site scripting in OpenPages GRC Platform (medium 5.4)
- [CVE-2017-11469](https://insights.sbomify.com/CVE-2017-11469/): Path traversal in idera:uptime infrastructure monitor (high 7.5)
- [CVE-2017-11468](https://insights.sbomify.com/CVE-2017-11468/): Docker Registry has Allocation of Resources Without Limits or Throttling (high 7.5)
- [CVE-2017-11467](https://insights.sbomify.com/CVE-2017-11467/): OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injection (critical 9.8)
- [CVE-2017-11466](https://insights.sbomify.com/CVE-2017-11466/): File upload in dotcms:dotcms (high 7.2)
- [CVE-2017-11465](https://insights.sbomify.com/CVE-2017-11465/): Memory corruption in ruby-lang:ruby (critical 9.8)
- [CVE-2017-11464](https://insights.sbomify.com/CVE-2017-11464/): Denial of service in gnome:librsvg (high 7.8)
- [CVE-2017-11463](https://insights.sbomify.com/CVE-2017-11463/): Missing authorization in ivanti:endpoint manager (high 8.8)
- [CVE-2017-11462](https://insights.sbomify.com/CVE-2017-11462/): Memory corruption in fedoraproject:fedora (critical 9.8)
- [CVE-2017-11461](https://insights.sbomify.com/CVE-2017-11461/): Other in OnCommand Unified Manager (medium 4.3)
- [CVE-2017-11460](https://insights.sbomify.com/CVE-2017-11460/): Cross-site scripting in sap:netweaver portal (medium 6.1)
- [CVE-2017-1146](https://insights.sbomify.com/CVE-2017-1146/): Cross-site scripting in Content Navigator (medium 5.4)
- [CVE-2017-11459](https://insights.sbomify.com/CVE-2017-11459/): Code injection in sap:trex (critical 9.8)
- [CVE-2017-11458](https://insights.sbomify.com/CVE-2017-11458/): Cross-site scripting in sap:netweaver application server java (medium 6.1)
- [CVE-2017-11457](https://insights.sbomify.com/CVE-2017-11457/): XML external entity in sap:netweaver application server java (medium 6.5)
- [CVE-2017-11456](https://insights.sbomify.com/CVE-2017-11456/): Path traversal in geneko:gwr202 gprs router firmware (high 7.5)
- [CVE-2017-11455](https://insights.sbomify.com/CVE-2017-11455/): Cross-site request forgery in ivanti:connect secure (high 8.8)
- [CVE-2017-11450](https://insights.sbomify.com/CVE-2017-11450/): Memory corruption in debian:debian linux (high 8.8)
- [CVE-2017-1145](https://insights.sbomify.com/CVE-2017-1145/): Denial of service in WebSphere MQ (high 8.6)
- [CVE-2017-11449](https://insights.sbomify.com/CVE-2017-11449/): Memory corruption in imagemagick:imagemagick (high 8.8)
- [CVE-2017-11448](https://insights.sbomify.com/CVE-2017-11448/): Information disclosure in imagemagick:imagemagick (medium 6.5)
- [CVE-2017-11447](https://insights.sbomify.com/CVE-2017-11447/): Denial of service in imagemagick:imagemagick (medium 6.5)
- [CVE-2017-11446](https://insights.sbomify.com/CVE-2017-11446/): Denial of service in imagemagick:imagemagick (medium 6.5)
- [CVE-2017-11445](https://insights.sbomify.com/CVE-2017-11445/): SQL injection in intelliants:subrion cms (critical 9.8)
- [CVE-2017-11444](https://insights.sbomify.com/CVE-2017-11444/): SQL injection in intelliants:subrion cms (critical 9.8)
- [CVE-2017-11441](https://insights.sbomify.com/CVE-2017-11441/): Cross-site scripting in cpanel:whm (medium 5.4)
- [CVE-2017-11440](https://insights.sbomify.com/CVE-2017-11440/): Path traversal in sitecore:cms (medium 4.9)
- [CVE-2017-1144](https://insights.sbomify.com/CVE-2017-1144/): Denial of service in Integration Bus (low 2.5)
- [CVE-2017-11439](https://insights.sbomify.com/CVE-2017-11439/): Cross-site scripting in sitecore:cms (medium 5.4)
- [CVE-2017-11438](https://insights.sbomify.com/CVE-2017-11438/): Privilege escalation in gitlab:gitlab (medium 6.3)
- [CVE-2017-11437](https://insights.sbomify.com/CVE-2017-11437/): Missing authorization in gitlab:gitlab (medium 6.5)
- [CVE-2017-11436](https://insights.sbomify.com/CVE-2017-11436/): Hardcoded credentials in dlink:dir-615 (critical 9.8)
- [CVE-2017-11435](https://insights.sbomify.com/CVE-2017-11435/): Auth bypass in humaxdigital:hg100r firmware (critical 9.8)
- [CVE-2017-11434](https://insights.sbomify.com/CVE-2017-11434/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2017-11430](https://insights.sbomify.com/CVE-2017-11430/): Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal (high 7.7)
- [CVE-2017-1143](https://insights.sbomify.com/CVE-2017-1143/): Misconfiguration in Kenexa LCMS Premier on Cloud (medium 5.3)
- [CVE-2017-11429](https://insights.sbomify.com/CVE-2017-11429/): Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal (high 7.7)
- [CVE-2017-11428](https://insights.sbomify.com/CVE-2017-11428/): Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal (high 7.7)
- [CVE-2017-11427](https://insights.sbomify.com/CVE-2017-11427/): Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal (high 7.7)
- [CVE-2017-11424](https://insights.sbomify.com/CVE-2017-11424/): PyJWT vulnerable to key confusion attacks (high 7.5)
- [CVE-2017-11423](https://insights.sbomify.com/CVE-2017-11423/): Memory corruption in libmspack project:libmspack (medium 5.5)
- [CVE-2017-11422](https://insights.sbomify.com/CVE-2017-11422/): Statamic framework Incorrect Permission Assignment (high 8.8)
- [CVE-2017-11421](https://insights.sbomify.com/CVE-2017-11421/): Code injection in gnome-exe-thumbnailer project:gnome-exe-thumbnailer (high 7.8)
- [CVE-2017-11420](https://insights.sbomify.com/CVE-2017-11420/): Memory corruption in asuswrt-merlin project:rt-ac1200 firmware (critical 9.8)
- [CVE-2017-1142](https://insights.sbomify.com/CVE-2017-1142/): Information disclosure in Kenexa LCMS Premier on Cloud (medium 6.5)
- [CVE-2017-11419](https://insights.sbomify.com/CVE-2017-11419/): SQL injection in fiyo:fiyo cms (critical 9.8)
- [CVE-2017-11418](https://insights.sbomify.com/CVE-2017-11418/): SQL injection in fiyo:fiyo cms (critical 9.8)
- [CVE-2017-11417](https://insights.sbomify.com/CVE-2017-11417/): SQL injection in fiyo:fiyo cms (critical 9.8)
- [CVE-2017-11416](https://insights.sbomify.com/CVE-2017-11416/): SQL injection in fiyo:fiyo cms (critical 9.8)
- [CVE-2017-11415](https://insights.sbomify.com/CVE-2017-11415/): SQL injection in fiyo:fiyo cms (critical 9.8)
- [CVE-2017-11414](https://insights.sbomify.com/CVE-2017-11414/): SQL injection in fiyo:fiyo cms (critical 9.8)
- [CVE-2017-11413](https://insights.sbomify.com/CVE-2017-11413/): SQL injection in fiyo:fiyo cms (critical 9.8)
- [CVE-2017-11412](https://insights.sbomify.com/CVE-2017-11412/): SQL injection in fiyo:fiyo cms (critical 9.8)
- [CVE-2017-11411](https://insights.sbomify.com/CVE-2017-11411/): Denial of service in wireshark:wireshark (high 7.5)
- [CVE-2017-11410](https://insights.sbomify.com/CVE-2017-11410/): Denial of service in wireshark:wireshark (high 7.5)
- [CVE-2017-1141](https://insights.sbomify.com/CVE-2017-1141/): Information disclosure in IBM Insights Foundation for Energy (medium 4.3)
- [CVE-2017-11409](https://insights.sbomify.com/CVE-2017-11409/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2017-11408](https://insights.sbomify.com/CVE-2017-11408/): Denial of service in wireshark:wireshark (high 7.5)
- [CVE-2017-11407](https://insights.sbomify.com/CVE-2017-11407/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2017-11406](https://insights.sbomify.com/CVE-2017-11406/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2017-11405](https://insights.sbomify.com/CVE-2017-11405/): File upload in cmsmadesimple:cms made simple (medium 4.9)
- [CVE-2017-11404](https://insights.sbomify.com/CVE-2017-11404/): File upload in cmsmadesimple:cms made simple (medium 4.9)
- [CVE-2017-11403](https://insights.sbomify.com/CVE-2017-11403/): Use after free in graphicsmagick:graphicsmagick (high 8.8)
- [CVE-2017-11402](https://insights.sbomify.com/CVE-2017-11402/): Security feature bypass in belden:tofino xenon security appliance firmware (critical 9.8)
- [CVE-2017-11401](https://insights.sbomify.com/CVE-2017-11401/): Security feature bypass in belden:tofino xenon security appliance firmware (critical 9.8)
- [CVE-2017-11400](https://insights.sbomify.com/CVE-2017-11400/): Security feature bypass in belden:tofino xenon security appliance firmware (medium 6.8)
- [CVE-2017-1140](https://insights.sbomify.com/CVE-2017-1140/): Cross-site scripting in Business Process Manager Advanced (medium 5.4)
- [CVE-2017-11399](https://insights.sbomify.com/CVE-2017-11399/): Integer overflow in ffmpeg:ffmpeg (high 7.8)
- [CVE-2017-11398](https://insights.sbomify.com/CVE-2017-11398/): Information disclosure in Trend Micro Smart Protection Server (Standalone) (high 8.8)
- [CVE-2017-11397](https://insights.sbomify.com/CVE-2017-11397/): Code injection in Trend Micro Encryption for Email (high 7.8)
- [CVE-2017-11396](https://insights.sbomify.com/CVE-2017-11396/): Code injection in InterScan Web Security Virtual Appliance (high 7.2)
- [CVE-2017-11395](https://insights.sbomify.com/CVE-2017-11395/): Command injection in Smart Protection Server (Standalone) (high 8.8)
- [CVE-2017-11394](https://insights.sbomify.com/CVE-2017-11394/): Command injection in Trend Micro OfficeScan (critical 9.8)
- [CVE-2017-11393](https://insights.sbomify.com/CVE-2017-11393/): Command injection in Trend Micro OfficeScan (critical 9.8)
- [CVE-2017-11392](https://insights.sbomify.com/CVE-2017-11392/): Command injection in Trend Micro InterScan Messaging Security Virtual Appliance (high 8.8)
- [CVE-2017-11391](https://insights.sbomify.com/CVE-2017-11391/): Command injection in Trend Micro InterScan Messaging Security Virtual Appliance (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2017/page/124/