# Vulnerabilities published in 2017 - [CVE-2017-1002024](https://insights.sbomify.com/CVE-2017-1002024/): Missing authorization in Kind Editor (medium 4.3) - [CVE-2017-1002023](https://insights.sbomify.com/CVE-2017-1002023/): SQL injection in Easy Team Manager (critical 9.8) - [CVE-2017-1002022](https://insights.sbomify.com/CVE-2017-1002022/): SQL injection in surveys (critical 9.8) - [CVE-2017-1002021](https://insights.sbomify.com/CVE-2017-1002021/): SQL injection in surveys (critical 9.8) - [CVE-2017-1002020](https://insights.sbomify.com/CVE-2017-1002020/): SQL injection in surveys (critical 9.8) - [CVE-2017-1002019](https://insights.sbomify.com/CVE-2017-1002019/): SQL injection in eventr (critical 9.8) - [CVE-2017-1002018](https://insights.sbomify.com/CVE-2017-1002018/): SQL injection in eventr (critical 9.8) - [CVE-2017-1002017](https://insights.sbomify.com/CVE-2017-1002017/): Cross-site scripting in gift-certificate-creator (medium 6.1) - [CVE-2017-1002016](https://insights.sbomify.com/CVE-2017-1002016/): File upload in flickr-picture-backup (critical 9.8) - [CVE-2017-1002015](https://insights.sbomify.com/CVE-2017-1002015/): SQL injection in image-gallery-with-slideshow (critical 9.8) - [CVE-2017-1002014](https://insights.sbomify.com/CVE-2017-1002014/): SQL injection in image-gallery-with-slideshow (critical 9.8) - [CVE-2017-1002013](https://insights.sbomify.com/CVE-2017-1002013/): SQL injection in image-gallery-with-slideshow (critical 9.8) - [CVE-2017-1002012](https://insights.sbomify.com/CVE-2017-1002012/): SQL injection in image-gallery-with-slideshow (critical 9.8) - [CVE-2017-1002011](https://insights.sbomify.com/CVE-2017-1002011/): Cross-site scripting in image-gallery-with-slideshow (medium 5.4) - [CVE-2017-1002010](https://insights.sbomify.com/CVE-2017-1002010/): SQL injection in Membership Simplified (critical 9.8) - [CVE-2017-1002009](https://insights.sbomify.com/CVE-2017-1002009/): SQL injection in ontraport:membership simplified (critical 9.8) - [CVE-2017-1002008](https://insights.sbomify.com/CVE-2017-1002008/): Missing authorization in membership-simplified-for-oap-members-only (critical 9.8) - [CVE-2017-1002007](https://insights.sbomify.com/CVE-2017-1002007/): Missing authorization in DTracker (high 7.5) - [CVE-2017-1002006](https://insights.sbomify.com/CVE-2017-1002006/): Missing authorization in DTracker (high 7.5) - [CVE-2017-1002005](https://insights.sbomify.com/CVE-2017-1002005/): SQL injection in DTracker (high 7.5) - [CVE-2017-1002004](https://insights.sbomify.com/CVE-2017-1002004/): SQL injection in DTracker (high 7.5) - [CVE-2017-1002003](https://insights.sbomify.com/CVE-2017-1002003/): Supply chain in wp2android-turn-wp-site-into-android-app (critical 9.8) - [CVE-2017-1002002](https://insights.sbomify.com/CVE-2017-1002002/): Supply chain in webapp-builder (critical 9.8) - [CVE-2017-1002001](https://insights.sbomify.com/CVE-2017-1002001/): Supply chain in mobile-app-builder-by-wappress (critical 9.8) - [CVE-2017-1002000](https://insights.sbomify.com/CVE-2017-1002000/): File upload in mobile-friendly-app-builder-by-easytouch (critical 9.8) - [CVE-2017-10020](https://insights.sbomify.com/CVE-2017-10020/): Other in PeopleSoft Enterprise PT PeopleTools (medium 4.7) - [CVE-2017-10019](https://insights.sbomify.com/CVE-2017-10019/): Other in PeopleSoft Enterprise PT PeopleTools (high 7.4) - [CVE-2017-10018](https://insights.sbomify.com/CVE-2017-10018/): Other in PeopleSoft Enterprise SCM Strategic Sourcing (medium 4.3) - [CVE-2017-10017](https://insights.sbomify.com/CVE-2017-10017/): Cross-site scripting in PeopleSoft Enterprise PT PeopleTools (medium 6.1) - [CVE-2017-10016](https://insights.sbomify.com/CVE-2017-10016/): Other in Sun ZFS Storage Appliance Kit (AK) Software (high 7.5) - [CVE-2017-10015](https://insights.sbomify.com/CVE-2017-10015/): Other in PeopleSoft Enterprise PT PeopleTools (medium 4.7) - [CVE-2017-10014](https://insights.sbomify.com/CVE-2017-10014/): Other in Hospitality Hotel Mobile (low 3.5) - [CVE-2017-10013](https://insights.sbomify.com/CVE-2017-10013/): Other in Sun ZFS Storage Appliance Kit (AK) Software (high 8.3) - [CVE-2017-10012](https://insights.sbomify.com/CVE-2017-10012/): Other in FLEXCUBE Private Banking (medium 5.4) - [CVE-2017-10011](https://insights.sbomify.com/CVE-2017-10011/): Information disclosure in FLEXCUBE Private Banking (medium 5.5) - [CVE-2017-1001004](https://insights.sbomify.com/CVE-2017-1001004/): Arbitrary JavaScript Execution in typed-function (high 8.8) - [CVE-2017-1001003](https://insights.sbomify.com/CVE-2017-1001003/): Arbitrary Code Execution in mathjs (critical 9.8) - [CVE-2017-1001002](https://insights.sbomify.com/CVE-2017-1001002/): Arbitrary Code Execution in mathjs (critical 9.8) - [CVE-2017-1001001](https://insights.sbomify.com/CVE-2017-1001001/): Cross-site scripting in PluXml (medium 5.4) - [CVE-2017-1001000](https://insights.sbomify.com/CVE-2017-1001000/): Missing authorization in wordpress:wordpress (high 7.5) - [CVE-2017-10010](https://insights.sbomify.com/CVE-2017-10010/): Other in FLEXCUBE Private Banking (medium 4.6) - [CVE-2017-10009](https://insights.sbomify.com/CVE-2017-10009/): Other in FLEXCUBE Private Banking (medium 4.3) - [CVE-2017-10008](https://insights.sbomify.com/CVE-2017-10008/): Information disclosure in FLEXCUBE Private Banking (medium 4.3) - [CVE-2017-10007](https://insights.sbomify.com/CVE-2017-10007/): Information disclosure in FLEXCUBE Private Banking (medium 4.3) - [CVE-2017-1000600](https://insights.sbomify.com/CVE-2017-1000600/): Code injection in wordpress:wordpress (high 8.8) - [CVE-2017-10006](https://insights.sbomify.com/CVE-2017-10006/): Other in FLEXCUBE Private Banking (medium 6.5) - [CVE-2017-1000510](https://insights.sbomify.com/CVE-2017-1000510/): Cross site scripting in Croogo (medium 5.4) - [CVE-2017-1000509](https://insights.sbomify.com/CVE-2017-1000509/): Dolibarr ERP and CRM contain XSS Vulnerability (medium 5.4) - [CVE-2017-1000508](https://insights.sbomify.com/CVE-2017-1000508/): Cross-site scripting in invoiceplane:invoiceplane (medium 6.1) - [CVE-2017-1000507](https://insights.sbomify.com/CVE-2017-1000507/): Canvs Canvas XSS Vulnerability (medium 5.4) - [CVE-2017-1000506](https://insights.sbomify.com/CVE-2017-1000506/): Mautic Cross Site Scripting (XSS) vulnerability (medium 6.1) - [CVE-2017-1000505](https://insights.sbomify.com/CVE-2017-1000505/): Exposure of Sensitive Information to an Unauthorized Actor Jenkins Script Security Plugin (medium 6.5) - [CVE-2017-1000504](https://insights.sbomify.com/CVE-2017-1000504/): Cross-Site Request Forgery in Jenkins (high 8.1) - [CVE-2017-1000503](https://insights.sbomify.com/CVE-2017-1000503/): Race Condition in Jenkins (high 8.1) - [CVE-2017-1000502](https://insights.sbomify.com/CVE-2017-1000502/): Arbitrary shell command execution in Jenkins EC2 Plugin (high 8.8) - [CVE-2017-1000501](https://insights.sbomify.com/CVE-2017-1000501/): Path traversal in awstats:awstats (critical 9.8) - [CVE-2017-10005](https://insights.sbomify.com/CVE-2017-10005/): Cross-site scripting in FLEXCUBE Private Banking (medium 6.1) - [CVE-2017-1000499](https://insights.sbomify.com/CVE-2017-1000499/): phpMyAdmin CSRF Vulnerability (high 8.8) - [CVE-2017-1000498](https://insights.sbomify.com/CVE-2017-1000498/): Android SVG vulnerable to XML External Entity (XXE) (high 7.8) - [CVE-2017-1000497](https://insights.sbomify.com/CVE-2017-1000497/): XML external entity in pepperminty-wiki project:pepperminty-wiki (critical 9.8) - [CVE-2017-1000496](https://insights.sbomify.com/CVE-2017-1000496/): XML external entity in commsy:commsy (high 8.8) - [CVE-2017-1000495](https://insights.sbomify.com/CVE-2017-1000495/): QuickApps CMS Cross-site Scripting (medium 5.4) - [CVE-2017-1000494](https://insights.sbomify.com/CVE-2017-1000494/): Memory corruption in miniupnp project:miniupnpd (high 7.8) - [CVE-2017-1000493](https://insights.sbomify.com/CVE-2017-1000493/): SQL injection in rocket.chat:rocket.chat (critical 9.8) - [CVE-2017-1000492](https://insights.sbomify.com/CVE-2017-1000492/): Cross-site scripting in leanote:desktop (medium 6.1) - [CVE-2017-1000491](https://insights.sbomify.com/CVE-2017-1000491/): Shiba vulnerable to XSS leading to code execution (medium 6.1) - [CVE-2017-1000490](https://insights.sbomify.com/CVE-2017-1000490/): Mautic users able to download any files from server using filemanager (medium 6.5) - [CVE-2017-1000489](https://insights.sbomify.com/CVE-2017-1000489/): Disabled users able to log in with third party SSO plugin (high 8.1) - [CVE-2017-1000488](https://insights.sbomify.com/CVE-2017-1000488/): Inline JS XSS vulnerability in Mautic (medium 6.1) - [CVE-2017-1000487](https://insights.sbomify.com/CVE-2017-1000487/): OS Command Injection in Plexus-utils (critical 9.8) - [CVE-2017-1000486](https://insights.sbomify.com/CVE-2017-1000486/): Primetek Primefaces Remote Code Execution (critical 9.8, exploited in the wild) - [CVE-2017-1000485](https://insights.sbomify.com/CVE-2017-1000485/): Misconfiguration in nylas mail lives project:nylas mail (high 7.8) - [CVE-2017-1000484](https://insights.sbomify.com/CVE-2017-1000484/): Plone Open Redirect (medium 6.1) - [CVE-2017-1000483](https://insights.sbomify.com/CVE-2017-1000483/): Plone Unauthorized Access Vulnerability (medium 6.5) - [CVE-2017-1000482](https://insights.sbomify.com/CVE-2017-1000482/): Products.CMFPlone XSS in profile home_page property (medium 5.4) - [CVE-2017-1000481](https://insights.sbomify.com/CVE-2017-1000481/): Products.CMFPlone Open Redirect Vulnerability (medium 6.1) - [CVE-2017-1000480](https://insights.sbomify.com/CVE-2017-1000480/): Smarty PHP code injection (critical 9.8) - [CVE-2017-1000479](https://insights.sbomify.com/CVE-2017-1000479/): Cross-site request forgery in netgate:pfsense (high 8.8) - [CVE-2017-1000478](https://insights.sbomify.com/CVE-2017-1000478/): Cross-site scripting in elabftw:elabftw (medium 5.4) - [CVE-2017-1000477](https://insights.sbomify.com/CVE-2017-1000477/): XXE Vulnerability in XMLBundle 0.1.7 (high 7.5) - [CVE-2017-1000476](https://insights.sbomify.com/CVE-2017-1000476/): Denial of service in canonical:ubuntu linux (medium 6.5) - [CVE-2017-1000475](https://insights.sbomify.com/CVE-2017-1000475/): Privilege escalation in freesshd:freesshd (high 7.8) - [CVE-2017-1000474](https://insights.sbomify.com/CVE-2017-1000474/): SQL injection in vehicle sales management system project:vehicle sales management system (critical 9.8) - [CVE-2017-1000473](https://insights.sbomify.com/CVE-2017-1000473/): Command injection in linux-dash project:linux-dash (high 7.8) - [CVE-2017-1000472](https://insights.sbomify.com/CVE-2017-1000472/): Path traversal in debian:debian linux (medium 6.5) - [CVE-2017-1000471](https://insights.sbomify.com/CVE-2017-1000471/): Null dereference in embedthis:goahead (critical 9.8) - [CVE-2017-1000470](https://insights.sbomify.com/CVE-2017-1000470/): Integer overflow in embedthis:goahead web server (high 7.5) - [CVE-2017-1000469](https://insights.sbomify.com/CVE-2017-1000469/): Cobbler vulnerable to arbitrary code execution (critical 9.8) - [CVE-2017-1000467](https://insights.sbomify.com/CVE-2017-1000467/): Stored XSS in LavaLite 5.2.4 (medium 5.4) - [CVE-2017-1000466](https://insights.sbomify.com/CVE-2017-1000466/): Cross-site scripting in invoiceninja:invoice ninja (medium 5.4) - [CVE-2017-1000465](https://insights.sbomify.com/CVE-2017-1000465/): Cross-site scripting in sulu:sulu-standard (medium 5.4) - [CVE-2017-1000463](https://insights.sbomify.com/CVE-2017-1000463/): Cross-site scripting in leafpub:leafpub (medium 5.4) - [CVE-2017-1000462](https://insights.sbomify.com/CVE-2017-1000462/): Cross-site scripting in bookstackapp:bookstack (medium 5.4) - [CVE-2017-1000461](https://insights.sbomify.com/CVE-2017-1000461/): Security feature bypass in brave:browser (medium 4.7) - [CVE-2017-1000460](https://insights.sbomify.com/CVE-2017-1000460/): Null dereference in ffmpeg:ffmpeg (medium 6.5) - [CVE-2017-1000459](https://insights.sbomify.com/CVE-2017-1000459/): Cross-site scripting in leanote:leanote (medium 6.1) - [CVE-2017-1000458](https://insights.sbomify.com/CVE-2017-1000458/): Memory corruption in bro:bro (critical 9.8) - [CVE-2017-1000457](https://insights.sbomify.com/CVE-2017-1000457/): Cross-site scripting in mojoportal:mojoportal (medium 4.8) - [CVE-2017-1000456](https://insights.sbomify.com/CVE-2017-1000456/): Memory corruption in debian:debian linux (high 8.8) - [CVE-2017-1000455](https://insights.sbomify.com/CVE-2017-1000455/): Privilege escalation in gnu:guixsd (medium 5.5) --- From sbomify Insights: https://insights.sbomify.com/years/2017/page/136/