# Vulnerabilities published in 2017


- [CVE-2017-1000252](https://insights.sbomify.com/CVE-2017-1000252/): Denial of service in linux:linux kernel (medium 5.5)
- [CVE-2017-1000251](https://insights.sbomify.com/CVE-2017-1000251/): Memory corruption in debian:debian linux (high 8.0)
- [CVE-2017-1000250](https://insights.sbomify.com/CVE-2017-1000250/): Information disclosure in bluez:bluez (medium 6.5)
- [CVE-2017-1000249](https://insights.sbomify.com/CVE-2017-1000249/): Memory corruption in file project:file (medium 5.5)
- [CVE-2017-1000248](https://insights.sbomify.com/CVE-2017-1000248/): redis-store deserializes untrusted data (critical 9.8)
- [CVE-2017-1000247](https://insights.sbomify.com/CVE-2017-1000247/): CodeIgniter HTTP Header Injection (high 7.5)
- [CVE-2017-1000246](https://insights.sbomify.com/CVE-2017-1000246/): Pysaml2 improperly initializes encryption vector (medium 5.3)
- [CVE-2017-1000245](https://insights.sbomify.com/CVE-2017-1000245/): Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext (critical 9.8)
- [CVE-2017-1000244](https://insights.sbomify.com/CVE-2017-1000244/): Jenkins Favorite Plugin vulnerable to Cross-Site Request Forgery (high 8.8)
- [CVE-2017-1000243](https://insights.sbomify.com/CVE-2017-1000243/): Missing permission check in Jenkins Favorite Plugin (medium 4.3)
- [CVE-2017-1000242](https://insights.sbomify.com/CVE-2017-1000242/): Insecure temporary file usage in Jenkins Git Client Plugin (low 3.3)
- [CVE-2017-1000241](https://insights.sbomify.com/CVE-2017-1000241/): Privilege escalation in open-emr:openemr (high 8.1)
- [CVE-2017-1000240](https://insights.sbomify.com/CVE-2017-1000240/): Cross-site scripting in open-emr:openemr (medium 5.4)
- [CVE-2017-1000239](https://insights.sbomify.com/CVE-2017-1000239/): Cross-site scripting in invoiceplane:invoiceplane (medium 5.4)
- [CVE-2017-1000238](https://insights.sbomify.com/CVE-2017-1000238/): File upload in invoiceplane:invoiceplane (high 8.8)
- [CVE-2017-1000237](https://insights.sbomify.com/CVE-2017-1000237/): Server-side request forgery in scilico:i\, librarian (critical 9.8)
- [CVE-2017-1000236](https://insights.sbomify.com/CVE-2017-1000236/): Cross-site scripting in scilico:i\, librarian (medium 6.1)
- [CVE-2017-1000235](https://insights.sbomify.com/CVE-2017-1000235/): Command injection in scilico:i\, librarian (critical 9.8)
- [CVE-2017-1000234](https://insights.sbomify.com/CVE-2017-1000234/): Information disclosure in scilico:i\, librarian (medium 5.3)
- [CVE-2017-1000232](https://insights.sbomify.com/CVE-2017-1000232/): Memory corruption in nlnetlabs:ldns (critical 9.8)
- [CVE-2017-1000231](https://insights.sbomify.com/CVE-2017-1000231/): Memory corruption in nlnetlabs:ldns (critical 9.8)
- [CVE-2017-1000230](https://insights.sbomify.com/CVE-2017-1000230/): Denial of service in snap7 project:snap7 server (high 7.5)
- [CVE-2017-1000229](https://insights.sbomify.com/CVE-2017-1000229/): Integer overflow in debian:debian linux (high 7.8)
- [CVE-2017-1000228](https://insights.sbomify.com/CVE-2017-1000228/): ejs is vulnerable to remote code execution due to weak input validation (critical 9.8)
- [CVE-2017-1000227](https://insights.sbomify.com/CVE-2017-1000227/): Cross-site scripting in parallelus:salutation (medium 5.4)
- [CVE-2017-1000226](https://insights.sbomify.com/CVE-2017-1000226/): Information disclosure in fullworksplugins:stop user enumeration (medium 5.3)
- [CVE-2017-1000225](https://insights.sbomify.com/CVE-2017-1000225/): Cross-site scripting in relevanssi:relevanssi (medium 6.1)
- [CVE-2017-1000224](https://insights.sbomify.com/CVE-2017-1000224/): Cross-site request forgery in embedplus:youtube (medium 6.5)
- [CVE-2017-1000223](https://insights.sbomify.com/CVE-2017-1000223/): Cross-site scripting in modx:modx revolution (medium 5.4)
- [CVE-2017-1000221](https://insights.sbomify.com/CVE-2017-1000221/): Opencast has Incorrect Permission Assignment (medium 6.5)
- [CVE-2017-1000220](https://insights.sbomify.com/CVE-2017-1000220/): PIDUsage Enables OS Command Injection (critical 9.8)
- [CVE-2017-1000219](https://insights.sbomify.com/CVE-2017-1000219/): Command Execution in windows-cpu (critical 9.8)
- [CVE-2017-1000218](https://insights.sbomify.com/CVE-2017-1000218/): Memory corruption in hfiref0x:lightftp (critical 9.8)
- [CVE-2017-1000217](https://insights.sbomify.com/CVE-2017-1000217/): Opencast RCE Vulnerability (high 8.8)
- [CVE-2017-1000215](https://insights.sbomify.com/CVE-2017-1000215/): Command injection in xrootd:xrootd (critical 9.8)
- [CVE-2017-1000214](https://insights.sbomify.com/CVE-2017-1000214/): Command injection in gitphp project:gitphp (critical 9.8)
- [CVE-2017-1000213](https://insights.sbomify.com/CVE-2017-1000213/): Cross-site scripting in wbce:wbce cms (medium 4.8)
- [CVE-2017-1000212](https://insights.sbomify.com/CVE-2017-1000212/): alchemist.vim vulnerable to remote code execution (critical 9.8)
- [CVE-2017-1000211](https://insights.sbomify.com/CVE-2017-1000211/): Use after free in lynx project:lynx (medium 5.3)
- [CVE-2017-1000210](https://insights.sbomify.com/CVE-2017-1000210/): Memory corruption in altran:picotcp (critical 9.8)
- [CVE-2017-1000209](https://insights.sbomify.com/CVE-2017-1000209/): nv-websocket-client allows attackers to spoof SSL/TLS servers via an arbitrary valid certificate (medium 5.9)
- [CVE-2017-1000208](https://insights.sbomify.com/CVE-2017-1000208/): Deserialization of Untrusted Data in swagger-parser (high 8.8)
- [CVE-2017-1000207](https://insights.sbomify.com/CVE-2017-1000207/): Deserialization of Untrusted Data in swagger-codegen (high 8.8)
- [CVE-2017-1000206](https://insights.sbomify.com/CVE-2017-1000206/): Memory corruption in htslib:htslib (critical 9.8)
- [CVE-2017-1000203](https://insights.sbomify.com/CVE-2017-1000203/): Command injection in cern:root (high 8.8)
- [CVE-2017-1000201](https://insights.sbomify.com/CVE-2017-1000201/): Denial of service in tcmu-runner project:tcmu-runner (medium 5.5)
- [CVE-2017-1000200](https://insights.sbomify.com/CVE-2017-1000200/): Null dereference in tcmu-runner project:tcmu-runner (high 7.5)
- [CVE-2017-10002](https://insights.sbomify.com/CVE-2017-10002/): Other in Hospitality Inventory Management (medium 5.4)
- [CVE-2017-1000199](https://insights.sbomify.com/CVE-2017-1000199/): Information disclosure in tcmu-runner project:tcmu-runner (high 7.5)
- [CVE-2017-1000198](https://insights.sbomify.com/CVE-2017-1000198/): Memory corruption in tcmu-runner project:tcmu-runner (high 7.5)
- [CVE-2017-1000197](https://insights.sbomify.com/CVE-2017-1000197/): Path traversal in octobercms:october (critical 9.8)
- [CVE-2017-1000196](https://insights.sbomify.com/CVE-2017-1000196/): Code injection in octobercms:october (critical 9.8)
- [CVE-2017-1000195](https://insights.sbomify.com/CVE-2017-1000195/): Deserialization in octobercms:october (high 7.5)
- [CVE-2017-1000194](https://insights.sbomify.com/CVE-2017-1000194/): October CMS File Upload Vulnerability (critical 9.8)
- [CVE-2017-1000193](https://insights.sbomify.com/CVE-2017-1000193/): October CMS XSS (medium 6.1)
- [CVE-2017-1000192](https://insights.sbomify.com/CVE-2017-1000192/): Path traversal in cygnux:syspass (critical 9.8)
- [CVE-2017-1000191](https://insights.sbomify.com/CVE-2017-1000191/): Denial of service in jool:jool (high 7.5)
- [CVE-2017-1000190](https://insights.sbomify.com/CVE-2017-1000190/): SimpleXML has XML External Entity (XXE) vulnerability (critical 9.1)
- [CVE-2017-1000189](https://insights.sbomify.com/CVE-2017-1000189/): ejs vulnerable to DoS due to weak input validation (high 7.5)
- [CVE-2017-1000188](https://insights.sbomify.com/CVE-2017-1000188/): mde ejs vulnerable to XSS (medium 6.1)
- [CVE-2017-1000187](https://insights.sbomify.com/CVE-2017-1000187/): Memory corruption in swftools:swftools (high 7.8)
- [CVE-2017-1000186](https://insights.sbomify.com/CVE-2017-1000186/): Memory corruption in swftools:swftools (medium 5.5)
- [CVE-2017-1000185](https://insights.sbomify.com/CVE-2017-1000185/): Memory corruption in swftools:swftools (medium 5.5)
- [CVE-2017-1000182](https://insights.sbomify.com/CVE-2017-1000182/): Denial of service in swftools:swftools (medium 5.5)
- [CVE-2017-1000176](https://insights.sbomify.com/CVE-2017-1000176/): Memory corruption in swftools:swftools (medium 5.5)
- [CVE-2017-1000174](https://insights.sbomify.com/CVE-2017-1000174/): Memory corruption in swftools:swftools (medium 5.5)
- [CVE-2017-1000173](https://insights.sbomify.com/CVE-2017-1000173/): Memory corruption in creolabs:gravity (critical 9.8)
- [CVE-2017-1000172](https://insights.sbomify.com/CVE-2017-1000172/): Use after free in creolabs:gravity (critical 9.8)
- [CVE-2017-1000171](https://insights.sbomify.com/CVE-2017-1000171/): Information disclosure in mahara:mahara mobile (critical 9.8)
- [CVE-2017-1000170](https://insights.sbomify.com/CVE-2017-1000170/): jqueryFileTree vulnerable to Directory Traversal (high 7.5)
- [CVE-2017-1000169](https://insights.sbomify.com/CVE-2017-1000169/): File upload in quickerbb project:quickerbb (critical 9.8)
- [CVE-2017-1000168](https://insights.sbomify.com/CVE-2017-1000168/): scalarmult() vulnerable to degenerate public keys (medium 6.5)
- [CVE-2017-1000164](https://insights.sbomify.com/CVE-2017-1000164/): Cross-site scripting in tine20:tine 2.0 (medium 5.4)
- [CVE-2017-1000163](https://insights.sbomify.com/CVE-2017-1000163/): Phoenix Arbitrary URL Redirect (medium 6.1)
- [CVE-2017-1000160](https://insights.sbomify.com/CVE-2017-1000160/): Cross-site scripting in expressionengine:expressionengine (medium 5.4)
- [CVE-2017-1000159](https://insights.sbomify.com/CVE-2017-1000159/): Command injection in gnome:evince (high 7.8)
- [CVE-2017-1000158](https://insights.sbomify.com/CVE-2017-1000158/): Integer overflow in debian:debian linux (critical 9.8)
- [CVE-2017-1000157](https://insights.sbomify.com/CVE-2017-1000157/): Information disclosure in mahara:mahara (medium 4.4)
- [CVE-2017-1000156](https://insights.sbomify.com/CVE-2017-1000156/): Privilege escalation in mahara:mahara (medium 6.5)
- [CVE-2017-1000155](https://insights.sbomify.com/CVE-2017-1000155/): Missing authorization in mahara:mahara (medium 4.3)
- [CVE-2017-1000154](https://insights.sbomify.com/CVE-2017-1000154/): Auth bypass in mahara:mahara (critical 9.8)
- [CVE-2017-1000153](https://insights.sbomify.com/CVE-2017-1000153/): Auth bypass in mahara:mahara (critical 9.8)
- [CVE-2017-1000152](https://insights.sbomify.com/CVE-2017-1000152/): Auth bypass in mahara:mahara (critical 9.8)
- [CVE-2017-1000151](https://insights.sbomify.com/CVE-2017-1000151/): Information disclosure in mahara:mahara (high 7.5)
- [CVE-2017-1000150](https://insights.sbomify.com/CVE-2017-1000150/): Auth bypass in mahara:mahara (high 8.8)
- [CVE-2017-1000149](https://insights.sbomify.com/CVE-2017-1000149/): Cross-site scripting in mahara:mahara (medium 5.4)
- [CVE-2017-1000148](https://insights.sbomify.com/CVE-2017-1000148/): Deserialization in mahara:mahara (high 8.8)
- [CVE-2017-1000147](https://insights.sbomify.com/CVE-2017-1000147/): Cross-site request forgery in mahara:mahara (medium 6.8)
- [CVE-2017-1000146](https://insights.sbomify.com/CVE-2017-1000146/): Cross-site scripting in mahara:mahara (medium 5.4)
- [CVE-2017-1000145](https://insights.sbomify.com/CVE-2017-1000145/): Security feature bypass in mahara:mahara (medium 4.9)
- [CVE-2017-1000144](https://insights.sbomify.com/CVE-2017-1000144/): Cross-site scripting in mahara:mahara (medium 4.8)
- [CVE-2017-1000143](https://insights.sbomify.com/CVE-2017-1000143/): Information disclosure in mahara:mahara (medium 4.3)
- [CVE-2017-1000142](https://insights.sbomify.com/CVE-2017-1000142/): Business logic in mahara:mahara (medium 6.5)
- [CVE-2017-1000141](https://insights.sbomify.com/CVE-2017-1000141/): Business logic in mahara:mahara (medium 6.5)
- [CVE-2017-1000140](https://insights.sbomify.com/CVE-2017-1000140/): Cross-site scripting in mahara:mahara (medium 5.4)
- [CVE-2017-1000139](https://insights.sbomify.com/CVE-2017-1000139/): Server-side request forgery in mahara:mahara (high 8.0)
- [CVE-2017-1000138](https://insights.sbomify.com/CVE-2017-1000138/): Cross-site scripting in mahara:mahara (medium 5.4)
- [CVE-2017-1000137](https://insights.sbomify.com/CVE-2017-1000137/): Cross-site scripting in mahara:mahara (medium 5.4)
- [CVE-2017-1000136](https://insights.sbomify.com/CVE-2017-1000136/): Auth bypass in mahara:mahara (medium 6.5)
- [CVE-2017-1000135](https://insights.sbomify.com/CVE-2017-1000135/): Auth bypass in mahara:mahara (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2017/page/138/