# Vulnerabilities published in 2017


- [CVE-2017-1000134](https://insights.sbomify.com/CVE-2017-1000134/): Missing authorization in mahara:mahara (high 8.1)
- [CVE-2017-1000133](https://insights.sbomify.com/CVE-2017-1000133/): Information disclosure in mahara:mahara (high 7.5)
- [CVE-2017-1000132](https://insights.sbomify.com/CVE-2017-1000132/): Cross-site scripting in mahara:mahara (medium 4.8)
- [CVE-2017-1000131](https://insights.sbomify.com/CVE-2017-1000131/): Auth bypass in mahara:mahara (medium 6.5)
- [CVE-2017-1000129](https://insights.sbomify.com/CVE-2017-1000129/): SQL injection in s9y:serendipity (high 7.5)
- [CVE-2017-1000128](https://insights.sbomify.com/CVE-2017-1000128/): Memory corruption in exiv2:exiv2 (medium 5.5)
- [CVE-2017-1000127](https://insights.sbomify.com/CVE-2017-1000127/): Memory corruption in exiv2:exiv2 (medium 5.5)
- [CVE-2017-1000126](https://insights.sbomify.com/CVE-2017-1000126/): Memory corruption in exiv2:exiv2 (medium 5.5)
- [CVE-2017-1000125](https://insights.sbomify.com/CVE-2017-1000125/): Misconfiguration in codiad:codiad (high 7.5)
- [CVE-2017-1000122](https://insights.sbomify.com/CVE-2017-1000122/): Denial of service in webkitgtk:webkitgtk\+ (medium 5.3)
- [CVE-2017-1000121](https://insights.sbomify.com/CVE-2017-1000121/): Integer overflow in webkitgtk:webkitgtk\+ (critical 9.8)
- [CVE-2017-1000120](https://insights.sbomify.com/CVE-2017-1000120/): SQL injection in frappe:frappe (high 8.8)
- [CVE-2017-1000119](https://insights.sbomify.com/CVE-2017-1000119/): October CMS PHP Code Execution (high 7.2)
- [CVE-2017-1000118](https://insights.sbomify.com/CVE-2017-1000118/): Improper Restriction of Operations within the Bounds of a Memory Buffer in akka-http-core (high 7.5)
- [CVE-2017-1000117](https://insights.sbomify.com/CVE-2017-1000117/): Code injection in git-scm:git (high 8.8)
- [CVE-2017-1000116](https://insights.sbomify.com/CVE-2017-1000116/): Mercurial is vulnerable to shell injection attack (critical 9.8)
- [CVE-2017-1000115](https://insights.sbomify.com/CVE-2017-1000115/): Mercurial missing symlink check (high 7.5)
- [CVE-2017-1000114](https://insights.sbomify.com/CVE-2017-1000114/): Exposure of Sensitive Information in Jenkins Datadog plugin (low 3.1)
- [CVE-2017-1000113](https://insights.sbomify.com/CVE-2017-1000113/): Jenkins Deploy to container Plugin stored plain text passwords in job configuration (medium 5.5)
- [CVE-2017-1000112](https://insights.sbomify.com/CVE-2017-1000112/): Race condition in linux:linux kernel (high 7.0)
- [CVE-2017-1000111](https://insights.sbomify.com/CVE-2017-1000111/): Race condition in debian:debian linux (high 7.8)
- [CVE-2017-1000110](https://insights.sbomify.com/CVE-2017-1000110/): Improper Authentication in Jenkins Blue Ocean Plugin (medium 4.3)
- [CVE-2017-1000109](https://insights.sbomify.com/CVE-2017-1000109/): Persistent XSS vulnerability in Jenkins OWASP Dependency-Check Plugin (medium 6.1)
- [CVE-2017-1000108](https://insights.sbomify.com/CVE-2017-1000108/): Jenkins Pipeline: Input Step Plugin (high 7.5)
- [CVE-2017-1000107](https://insights.sbomify.com/CVE-2017-1000107/): Sandbox bypass in Jenkins Script Security Plugin sandbox bypass (high 8.8)
- [CVE-2017-1000106](https://insights.sbomify.com/CVE-2017-1000106/): Improper Authentication in Jenkins Blue Ocean Plugin (high 8.5)
- [CVE-2017-1000105](https://insights.sbomify.com/CVE-2017-1000105/): Missing Authorization in Jenkins Blue Ocean Plugin (medium 5.3)
- [CVE-2017-1000104](https://insights.sbomify.com/CVE-2017-1000104/): Improper Privilege Management in Jenkins Config File Provider Plugin (medium 6.5)
- [CVE-2017-1000103](https://insights.sbomify.com/CVE-2017-1000103/): Persistent XSS vulnerability in Jenkins DRY Plugin (medium 5.4)
- [CVE-2017-1000102](https://insights.sbomify.com/CVE-2017-1000102/): Persistent XSS vulnerability in Static Analysis Utilities (medium 5.4)
- [CVE-2017-1000101](https://insights.sbomify.com/CVE-2017-1000101/): Memory corruption in haxx:curl (medium 6.5)
- [CVE-2017-1000100](https://insights.sbomify.com/CVE-2017-1000100/): Information disclosure in haxx:libcurl (medium 6.5)
- [CVE-2017-10001](https://insights.sbomify.com/CVE-2017-10001/): Other in Hospitality Simphony First Edition (high 7.6)
- [CVE-2017-1000099](https://insights.sbomify.com/CVE-2017-1000099/): Information disclosure in haxx:libcurl (medium 6.5)
- [CVE-2017-1000098](https://insights.sbomify.com/CVE-2017-1000098/): Denial of service in golang:go (high 7.5)
- [CVE-2017-1000097](https://insights.sbomify.com/CVE-2017-1000097/): Security feature bypass in golang:go (high 7.5)
- [CVE-2017-1000096](https://insights.sbomify.com/CVE-2017-1000096/): Arbitrary code execution due to incomplete sandbox protection in Jenkins Pipeline (high 8.8)
- [CVE-2017-1000095](https://insights.sbomify.com/CVE-2017-1000095/): Unsafe methods in the default list of approved signatures in Jenkins Script Security Plugin (medium 6.5)
- [CVE-2017-1000094](https://insights.sbomify.com/CVE-2017-1000094/): Jenkins Docker Commons Plugin allows any user with Overall/Read permission to get list of valid credentials IDs (medium 6.5)
- [CVE-2017-1000093](https://insights.sbomify.com/CVE-2017-1000093/): Jenkins Poll SCM Plugin vulnerable to Cross-Site Request Forgery (high 8.8)
- [CVE-2017-1000092](https://insights.sbomify.com/CVE-2017-1000092/): Cross-Site Request Forgery in Jenkins Git Plugin (high 7.5)
- [CVE-2017-1000091](https://insights.sbomify.com/CVE-2017-1000091/): Jenkins GitHub Branch Source Plugin vulnerable to Cross-Site Request Forgery (medium 6.3)
- [CVE-2017-1000090](https://insights.sbomify.com/CVE-2017-1000090/): CSRF vulnerability in Jenkins Role-based Authorization Strategy Plugin configuration (high 8.8)
- [CVE-2017-1000089](https://insights.sbomify.com/CVE-2017-1000089/): Jenkins Build Step Plugin fails to check Item/Build permission (medium 5.3)
- [CVE-2017-1000088](https://insights.sbomify.com/CVE-2017-1000088/): Persisted XSS Vulnerability in Jenkins Sidebar Link Plugin (medium 5.4)
- [CVE-2017-1000087](https://insights.sbomify.com/CVE-2017-1000087/): Jenkins GitHub Branch Source Plugin allows any user with Overall/Read permission to get list of valid credentials IDs (medium 4.3)
- [CVE-2017-1000086](https://insights.sbomify.com/CVE-2017-1000086/): Missing permission checks in Jenkins Periodic Backup Plugin allow every user to change settings (high 8.0)
- [CVE-2017-1000085](https://insights.sbomify.com/CVE-2017-1000085/): Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability (medium 6.5)
- [CVE-2017-1000084](https://insights.sbomify.com/CVE-2017-1000084/): Parameterized Trigger Plugin fails to check Item/Build permission (medium 6.5)
- [CVE-2017-1000083](https://insights.sbomify.com/CVE-2017-1000083/): Command injection in debian:debian linux (high 7.8)
- [CVE-2017-1000082](https://insights.sbomify.com/CVE-2017-1000082/): Privilege escalation in systemd project:systemd (critical 9.8)
- [CVE-2017-1000081](https://insights.sbomify.com/CVE-2017-1000081/): File upload in onosproject:onos (critical 9.8)
- [CVE-2017-1000080](https://insights.sbomify.com/CVE-2017-1000080/): Auth bypass in onosproject:onos (high 7.5)
- [CVE-2017-1000079](https://insights.sbomify.com/CVE-2017-1000079/): Denial of service in onosproject:onos (high 7.5)
- [CVE-2017-1000078](https://insights.sbomify.com/CVE-2017-1000078/): Cross-site scripting in onosproject:onos (medium 6.1)
- [CVE-2017-1000075](https://insights.sbomify.com/CVE-2017-1000075/): Memory corruption in creolabs:gravity (critical 9.8)
- [CVE-2017-1000074](https://insights.sbomify.com/CVE-2017-1000074/): Memory corruption in creolabs:gravity (critical 9.8)
- [CVE-2017-1000073](https://insights.sbomify.com/CVE-2017-1000073/): Memory corruption in creolabs:gravity (critical 9.8)
- [CVE-2017-1000072](https://insights.sbomify.com/CVE-2017-1000072/): Memory corruption in creolabs:gravity (critical 9.8)
- [CVE-2017-1000071](https://insights.sbomify.com/CVE-2017-1000071/): Auth bypass in apereo:phpcas (high 8.1)
- [CVE-2017-1000070](https://insights.sbomify.com/CVE-2017-1000070/): Open Redirect in oauth2_proxy (medium 6.1)
- [CVE-2017-1000069](https://insights.sbomify.com/CVE-2017-1000069/): Cross-site Request Forgery (CSRF) (high 8.8)
- [CVE-2017-1000068](https://insights.sbomify.com/CVE-2017-1000068/): Auth bypass in betterment:testtrack (high 7.5)
- [CVE-2017-1000067](https://insights.sbomify.com/CVE-2017-1000067/): MODX Revolution blind SQL injection (high 8.8)
- [CVE-2017-1000066](https://insights.sbomify.com/CVE-2017-1000066/): Information disclosure in keepass:keepass (high 7.5)
- [CVE-2017-1000065](https://insights.sbomify.com/CVE-2017-1000065/): Cross-site scripting in openmediavault:openmediavault (medium 6.1)
- [CVE-2017-1000064](https://insights.sbomify.com/CVE-2017-1000064/): Denial of service in kitto project:kitto (high 7.5)
- [CVE-2017-1000063](https://insights.sbomify.com/CVE-2017-1000063/): Cross-site scripting in kitto project:kitto (medium 6.1)
- [CVE-2017-1000062](https://insights.sbomify.com/CVE-2017-1000062/): Path traversal in kitto project:kitto (high 7.5)
- [CVE-2017-1000061](https://insights.sbomify.com/CVE-2017-1000061/): XML external entity in xmlsec project:xmlsec (high 7.1)
- [CVE-2017-1000060](https://insights.sbomify.com/CVE-2017-1000060/): SQL injection in eyesofnetwork:eyesofnetwork (critical 9.8)
- [CVE-2017-1000059](https://insights.sbomify.com/CVE-2017-1000059/): Cross-site scripting in livehelperchat:live helper chat (medium 6.1)
- [CVE-2017-1000058](https://insights.sbomify.com/CVE-2017-1000058/): Cross-site scripting in chevereto:chevereto (medium 6.1)
- [CVE-2017-1000056](https://insights.sbomify.com/CVE-2017-1000056/): Kubernetes Privilege Escalation (critical 9.8)
- [CVE-2017-1000054](https://insights.sbomify.com/CVE-2017-1000054/): Cross-site scripting in rocketchat:rocket.chat (medium 6.1)
- [CVE-2017-1000053](https://insights.sbomify.com/CVE-2017-1000053/): Arbitrary Code Execution in Cookie Serialization (high 8.1)
- [CVE-2017-1000052](https://insights.sbomify.com/CVE-2017-1000052/): Null Byte Injection in Plug.Static (high 7.8)
- [CVE-2017-1000051](https://insights.sbomify.com/CVE-2017-1000051/): Cross-site scripting in xwiki:cryptpad (medium 6.1)
- [CVE-2017-1000050](https://insights.sbomify.com/CVE-2017-1000050/): Null dereference in canonical:ubuntu linux (high 7.5)
- [CVE-2017-1000048](https://insights.sbomify.com/CVE-2017-1000048/): Prototype Pollution Protection Bypass in qs (high 7.5)
- [CVE-2017-1000047](https://insights.sbomify.com/CVE-2017-1000047/): Path traversal in rbenv project:rbenv (critical 9.8)
- [CVE-2017-1000046](https://insights.sbomify.com/CVE-2017-1000046/): Sensitive Cookie Without HttpOnly and Secure Flag (high 7.5)
- [CVE-2017-1000044](https://insights.sbomify.com/CVE-2017-1000044/): Memory corruption in gnome:gtk-vnc (critical 9.8)
- [CVE-2017-1000043](https://insights.sbomify.com/CVE-2017-1000043/): Content Injection via TileJSON Name in mapbox.js (medium 6.1)
- [CVE-2017-1000042](https://insights.sbomify.com/CVE-2017-1000042/): Content Injection via TileJSON attribute in mapbox.js (medium 6.1)
- [CVE-2017-1000039](https://insights.sbomify.com/CVE-2017-1000039/): Code injection in framasoft:framadate (critical 9.8)
- [CVE-2017-1000038](https://insights.sbomify.com/CVE-2017-1000038/): Cross-site scripting in relevanssi:relevanssi (medium 6.1)
- [CVE-2017-1000037](https://insights.sbomify.com/CVE-2017-1000037/): Command injection in rvm project:rvm (critical 9.8)
- [CVE-2017-1000035](https://insights.sbomify.com/CVE-2017-1000035/): Cross-site scripting in tt-rss:tiny tiny rss (medium 6.1)
- [CVE-2017-1000034](https://insights.sbomify.com/CVE-2017-1000034/): Akka Java Serialization vulnerability (high 8.1)
- [CVE-2017-1000033](https://insights.sbomify.com/CVE-2017-1000033/): Cross-site scripting in vospari forms project:vospari forms (medium 6.1)
- [CVE-2017-1000032](https://insights.sbomify.com/CVE-2017-1000032/): Cross-site scripting in cacti:cacti (medium 6.1)
- [CVE-2017-1000031](https://insights.sbomify.com/CVE-2017-1000031/): SQL injection in cacti:cacti (high 8.8)
- [CVE-2017-1000030](https://insights.sbomify.com/CVE-2017-1000030/): Information disclosure in oracle:glassfish server (critical 9.8)
- [CVE-2017-1000029](https://insights.sbomify.com/CVE-2017-1000029/): Path traversal in oracle:glassfish server (high 7.5)
- [CVE-2017-1000028](https://insights.sbomify.com/CVE-2017-1000028/): Path traversal in oracle:glassfish server (high 7.5)
- [CVE-2017-1000027](https://insights.sbomify.com/CVE-2017-1000027/): Open redirect in koozali:sme server (medium 6.1)
- [CVE-2017-1000026](https://insights.sbomify.com/CVE-2017-1000026/): mixlib-archive Path Traversal vulnerability (high 7.5)
- [CVE-2017-1000025](https://insights.sbomify.com/CVE-2017-1000025/): Information disclosure in gnome:epiphany (high 7.5)
- [CVE-2017-1000024](https://insights.sbomify.com/CVE-2017-1000024/): Information disclosure in gnome:shotwell (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2017/page/139/