# Vulnerabilities published in 2017


- [CVE-2017-1000454](https://insights.sbomify.com/CVE-2017-1000454/): Code injection in cmsmadesimple:cms made simple (high 7.8)
- [CVE-2017-1000453](https://insights.sbomify.com/CVE-2017-1000453/): Code injection in cmsmadesimple:cms made simple (critical 9.8)
- [CVE-2017-1000452](https://insights.sbomify.com/CVE-2017-1000452/): Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames (high 7.5)
- [CVE-2017-1000451](https://insights.sbomify.com/CVE-2017-1000451/): fs-git command injection vulnerability (high 7.8)
- [CVE-2017-1000450](https://insights.sbomify.com/CVE-2017-1000450/): Integer Overflow or Wraparound in OpenCV. (high 8.8)
- [CVE-2017-1000448](https://insights.sbomify.com/CVE-2017-1000448/): Path traversal in structured-data:structured data linter (high 7.5)
- [CVE-2017-1000445](https://insights.sbomify.com/CVE-2017-1000445/): Null dereference in canonical:ubuntu linux (medium 6.5)
- [CVE-2017-1000444](https://insights.sbomify.com/CVE-2017-1000444/): SQL injection in openhacker project:openhacker (critical 9.8)
- [CVE-2017-1000443](https://insights.sbomify.com/CVE-2017-1000443/): Cross-site scripting in openhacker project:openhacker (medium 6.1)
- [CVE-2017-1000442](https://insights.sbomify.com/CVE-2017-1000442/): Passbolt API is vulnerable to XSS in the url field on the password workspace grid and sidebar (medium 5.4)
- [CVE-2017-1000438](https://insights.sbomify.com/CVE-2017-1000438/): Missing authorization in openmicroscopy:omero (high 8.3)
- [CVE-2017-1000437](https://insights.sbomify.com/CVE-2017-1000437/): Memory corruption in creolabs:gravity (critical 9.8)
- [CVE-2017-1000434](https://insights.sbomify.com/CVE-2017-1000434/): Open redirect in furikake project:furikake (medium 6.1)
- [CVE-2017-1000433](https://insights.sbomify.com/CVE-2017-1000433/): pysaml2 Improper Authentication vulnerability (high 8.1)
- [CVE-2017-1000432](https://insights.sbomify.com/CVE-2017-1000432/): Cross-site request forgery in vanillaforums:vanilla forums (high 8.0)
- [CVE-2017-1000431](https://insights.sbomify.com/CVE-2017-1000431/): eZ Publish Cross-site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2017-1000430](https://insights.sbomify.com/CVE-2017-1000430/): Integer overflow in base64 (critical 9.8)
- [CVE-2017-1000429](https://insights.sbomify.com/CVE-2017-1000429/): Cross-site scripting in finecms project:finecms (medium 6.1)
- [CVE-2017-1000428](https://insights.sbomify.com/CVE-2017-1000428/): Cross-site scripting in flatcore:flatcore-cms (medium 6.1)
- [CVE-2017-1000427](https://insights.sbomify.com/CVE-2017-1000427/): Marked vulnerable to XSS from data URIs (medium 6.1)
- [CVE-2017-1000426](https://insights.sbomify.com/CVE-2017-1000426/): MapProxy vulnerable to cross-site scripting in demo service (medium 6.1)
- [CVE-2017-1000425](https://insights.sbomify.com/CVE-2017-1000425/): Liferay Portal XSS vulnerability via movie parameter in the /html/portal/flash.jsp page (medium 6.1)
- [CVE-2017-1000424](https://insights.sbomify.com/CVE-2017-1000424/): Electron vulnerable to URL spoofing via PDFium (medium 4.3)
- [CVE-2017-1000423](https://insights.sbomify.com/CVE-2017-1000423/): Code injection in b2evolution:b2evolution (critical 9.8)
- [CVE-2017-1000422](https://insights.sbomify.com/CVE-2017-1000422/): Integer overflow in canonical:ubuntu linux (high 8.8)
- [CVE-2017-1000421](https://insights.sbomify.com/CVE-2017-1000421/): Use after free in debian:debian linux (critical 9.8)
- [CVE-2017-1000420](https://insights.sbomify.com/CVE-2017-1000420/): Syncthing vulnerable to symlink traversal and arbitrary file overwrite (high 7.5)
- [CVE-2017-1000419](https://insights.sbomify.com/CVE-2017-1000419/): phpBB Server-Side Request Forgery (SSRF) (high 7.5)
- [CVE-2017-1000418](https://insights.sbomify.com/CVE-2017-1000418/): Memory corruption in mindwerks:wildmidi (high 7.8)
- [CVE-2017-1000417](https://insights.sbomify.com/CVE-2017-1000417/): Weak cryptography in matrixssl:matrixssl (medium 5.3)
- [CVE-2017-1000416](https://insights.sbomify.com/CVE-2017-1000416/): Other in axtls project:axtls (medium 5.3)
- [CVE-2017-1000415](https://insights.sbomify.com/CVE-2017-1000415/): Security feature bypass in matrixssl:matrixssl (medium 5.9)
- [CVE-2017-1000414](https://insights.sbomify.com/CVE-2017-1000414/): Denial of service in impulseadventure:jpegsnoop (high 7.5)
- [CVE-2017-1000413](https://insights.sbomify.com/CVE-2017-1000413/): Weak cryptography in linaro:op-tee (medium 5.9)
- [CVE-2017-1000412](https://insights.sbomify.com/CVE-2017-1000412/): Weak cryptography in linaro:op-tee (high 7.5)
- [CVE-2017-1000411](https://insights.sbomify.com/CVE-2017-1000411/): Denial of service in opendaylight:opendaylight (high 7.5)
- [CVE-2017-1000410](https://insights.sbomify.com/CVE-2017-1000410/): Information disclosure in debian:debian linux (high 7.5)
- [CVE-2017-1000409](https://insights.sbomify.com/CVE-2017-1000409/): Memory corruption in gnu:glibc (high 7.0)
- [CVE-2017-1000408](https://insights.sbomify.com/CVE-2017-1000408/): Denial of service in gnu:glibc (high 7.8)
- [CVE-2017-1000407](https://insights.sbomify.com/CVE-2017-1000407/): Denial of service in canonical:ubuntu linux (high 7.4)
- [CVE-2017-1000406](https://insights.sbomify.com/CVE-2017-1000406/): Password change doesn't result in Karaf clearing cache (high 7.5)
- [CVE-2017-1000405](https://insights.sbomify.com/CVE-2017-1000405/): Race condition in linux:linux kernel (high 7.0)
- [CVE-2017-1000404](https://insights.sbomify.com/CVE-2017-1000404/): Jenkins Delivery Pipeline Plugin Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2017-1000403](https://insights.sbomify.com/CVE-2017-1000403/): Arbitrary code execution vulnerability in Jenkins Speaks! Plugin (high 8.8)
- [CVE-2017-1000402](https://insights.sbomify.com/CVE-2017-1000402/): Jenkins Swarm Plugin Client vulnerable to man-in-the-middle attacks (medium 5.9)
- [CVE-2017-1000401](https://insights.sbomify.com/CVE-2017-1000401/): Improper Input Validation in Jenkins (low 2.2)
- [CVE-2017-1000400](https://insights.sbomify.com/CVE-2017-1000400/): Missing Authorization in Jenkins (medium 4.3)
- [CVE-2017-10004](https://insights.sbomify.com/CVE-2017-10004/): Other in Solaris Operating System (medium 6.7)
- [CVE-2017-1000399](https://insights.sbomify.com/CVE-2017-1000399/): Exposure of Sensitive Information to an Unauthorized Actor in Jenkins (medium 4.3)
- [CVE-2017-1000398](https://insights.sbomify.com/CVE-2017-1000398/): Exposure of Sensitive Information to an Unauthorized Actor in Jenkins (medium 4.3)
- [CVE-2017-1000397](https://insights.sbomify.com/CVE-2017-1000397/): MitM on Jenkins Maven Plugin (medium 5.9)
- [CVE-2017-1000396](https://insights.sbomify.com/CVE-2017-1000396/): Improper Certificate Validation in Jenkins (medium 5.9)
- [CVE-2017-1000395](https://insights.sbomify.com/CVE-2017-1000395/): Exposure of Sensitive Information to an Unauthorized Actor in Jenkins (medium 4.3)
- [CVE-2017-1000394](https://insights.sbomify.com/CVE-2017-1000394/): Improper Input Validation in Jenkins (high 7.5)
- [CVE-2017-1000393](https://insights.sbomify.com/CVE-2017-1000393/): OS Command Injection in Jenkins (high 8.8)
- [CVE-2017-1000392](https://insights.sbomify.com/CVE-2017-1000392/): Improper Neutralization of Input During Web Page Generation in Jenkins (medium 4.8)
- [CVE-2017-1000391](https://insights.sbomify.com/CVE-2017-1000391/): Improper Input Validation in Jenkins (high 7.3)
- [CVE-2017-1000390](https://insights.sbomify.com/CVE-2017-1000390/): Jenkins Multijob plugin did not check permissions in the Resume Build action (medium 4.3)
- [CVE-2017-1000389](https://insights.sbomify.com/CVE-2017-1000389/): Cross-Site Request Forgery (CSRF) vulnerability in Jenkins global-build-stats plugin (medium 6.1)
- [CVE-2017-1000388](https://insights.sbomify.com/CVE-2017-1000388/): Jenkins Dependency Graph Viewer plugin vulnerable to missing permission checks (medium 4.3)
- [CVE-2017-1000387](https://insights.sbomify.com/CVE-2017-1000387/): Jenkins Build-Publisher plugin has Insufficiently Protected Credentials (high 7.8)
- [CVE-2017-1000386](https://insights.sbomify.com/CVE-2017-1000386/): Cross-site Scripting in Jenkins Active Choices plugin (medium 5.4)
- [CVE-2017-1000385](https://insights.sbomify.com/CVE-2017-1000385/): Weak cryptography in debian:debian linux (medium 5.9)
- [CVE-2017-1000383](https://insights.sbomify.com/CVE-2017-1000383/): Information disclosure in gnu:emacs (medium 5.5)
- [CVE-2017-1000382](https://insights.sbomify.com/CVE-2017-1000382/): Information disclosure in vim:vim (medium 5.5)
- [CVE-2017-1000381](https://insights.sbomify.com/CVE-2017-1000381/): Memory corruption in c-ares:c-ares (high 7.5)
- [CVE-2017-1000380](https://insights.sbomify.com/CVE-2017-1000380/): Race condition in linux:linux kernel (medium 5.5)
- [CVE-2017-1000379](https://insights.sbomify.com/CVE-2017-1000379/): Memory corruption in linux:linux kernel (high 7.8)
- [CVE-2017-1000378](https://insights.sbomify.com/CVE-2017-1000378/): Denial of service in netbsd:netbsd (critical 9.8)
- [CVE-2017-1000377](https://insights.sbomify.com/CVE-2017-1000377/): Memory corruption in linux:linux kernel (medium 5.9)
- [CVE-2017-1000376](https://insights.sbomify.com/CVE-2017-1000376/): Memory corruption in debian:debian linux (high 7.0)
- [CVE-2017-1000375](https://insights.sbomify.com/CVE-2017-1000375/): Memory corruption in netbsd:netbsd (critical 9.8)
- [CVE-2017-1000374](https://insights.sbomify.com/CVE-2017-1000374/): Security feature bypass in netbsd:netbsd (critical 9.8)
- [CVE-2017-1000373](https://insights.sbomify.com/CVE-2017-1000373/): Denial of service in openbsd:openbsd (medium 6.5)
- [CVE-2017-1000372](https://insights.sbomify.com/CVE-2017-1000372/): Security feature bypass in openbsd:openbsd (critical 9.8)
- [CVE-2017-1000371](https://insights.sbomify.com/CVE-2017-1000371/): Memory corruption in linux:linux kernel (high 7.8)
- [CVE-2017-1000370](https://insights.sbomify.com/CVE-2017-1000370/): Security feature bypass in linux:linux kernel (high 7.8)
- [CVE-2017-1000369](https://insights.sbomify.com/CVE-2017-1000369/): Denial of service in debian:debian linux (medium 4.0)
- [CVE-2017-1000368](https://insights.sbomify.com/CVE-2017-1000368/): Command injection in sudo project:sudo (high 8.2)
- [CVE-2017-1000367](https://insights.sbomify.com/CVE-2017-1000367/): Race condition in sudo project:sudo (medium 6.4)
- [CVE-2017-1000366](https://insights.sbomify.com/CVE-2017-1000366/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2017-1000365](https://insights.sbomify.com/CVE-2017-1000365/): Security feature bypass in linux:linux kernel (high 7.8)
- [CVE-2017-1000364](https://insights.sbomify.com/CVE-2017-1000364/): Memory corruption in linux:linux kernel (high 7.4)
- [CVE-2017-1000363](https://insights.sbomify.com/CVE-2017-1000363/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2017-1000362](https://insights.sbomify.com/CVE-2017-1000362/): Exposure of Sensitive Information to an Unauthorized Actor in Jenkins (critical 9.8)
- [CVE-2017-1000361](https://insights.sbomify.com/CVE-2017-1000361/): OpenDaylight Controller DoS (high 7.5)
- [CVE-2017-1000360](https://insights.sbomify.com/CVE-2017-1000360/): OpenDaylight NULL Pointer Dereference (medium 5.3)
- [CVE-2017-1000359](https://insights.sbomify.com/CVE-2017-1000359/): Denial of service in opendaylight:opendaylight (medium 5.3)
- [CVE-2017-1000358](https://insights.sbomify.com/CVE-2017-1000358/): Null dereference in opendaylight:opendaylight (medium 6.5)
- [CVE-2017-1000357](https://insights.sbomify.com/CVE-2017-1000357/): Denial of service in opendaylight:opendaylight (high 7.5)
- [CVE-2017-1000356](https://insights.sbomify.com/CVE-2017-1000356/): Cross-Site Request Forgery in Jenkins (high 8.8)
- [CVE-2017-1000355](https://insights.sbomify.com/CVE-2017-1000355/): Deserialization of Untrusted Data in Jenkins (medium 6.5)
- [CVE-2017-1000354](https://insights.sbomify.com/CVE-2017-1000354/): Improper Authentication in Jenkins (high 8.8)
- [CVE-2017-1000353](https://insights.sbomify.com/CVE-2017-1000353/): Jenkins Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2017-10003](https://insights.sbomify.com/CVE-2017-10003/): Other in Solaris Operating System (medium 4.5)
- [CVE-2017-1000257](https://insights.sbomify.com/CVE-2017-1000257/): Memory corruption in debian:debian linux (critical 9.1)
- [CVE-2017-1000256](https://insights.sbomify.com/CVE-2017-1000256/): Misconfiguration in debian:debian linux (high 8.1)
- [CVE-2017-1000255](https://insights.sbomify.com/CVE-2017-1000255/): Memory corruption in linux:linux kernel (medium 5.5)
- [CVE-2017-1000254](https://insights.sbomify.com/CVE-2017-1000254/): Memory corruption in haxx:libcurl (high 7.5)
- [CVE-2017-1000253](https://insights.sbomify.com/CVE-2017-1000253/): Linux Kernel PIE Stack Buffer Corruption Vulnerability (high 7.8, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/years/2017/page/137/