# Vulnerabilities published in 2017


- [CVE-2017-20288](https://insights.sbomify.com/CVE-2017-20288/): QCubed 3.1.1 Reflected XSS via installer step_2.php (medium 5.1)
- [CVE-2017-20287](https://insights.sbomify.com/CVE-2017-20287/): Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter (high 8.7)
- [CVE-2017-20286](https://insights.sbomify.com/CVE-2017-20286/): DevIL through 1.8.0 Heap Buffer Overflow via GIF iGetPalette (high 8.5)
- [CVE-2017-20285](https://insights.sbomify.com/CVE-2017-20285/): YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes (critical 9.1)
- [CVE-2017-20284](https://insights.sbomify.com/CVE-2017-20284/): Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig Servlet (high 8.7)
- [CVE-2017-20283](https://insights.sbomify.com/CVE-2017-20283/): Memory corruption in MQX (medium 6.5)
- [CVE-2017-20282](https://insights.sbomify.com/CVE-2017-20282/): Joomla! Component jCart for OpenCart 2.0 SQL Injection (high 8.8)
- [CVE-2017-20281](https://insights.sbomify.com/CVE-2017-20281/): Joomla! Component Extra Search 2.2.8 SQL Injection (high 8.8)
- [CVE-2017-20280](https://insights.sbomify.com/CVE-2017-20280/): Joomla Component Myportfolio 3.0.2 SQL Injection via pid Parameter (high 8.8)
- [CVE-2017-20279](https://insights.sbomify.com/CVE-2017-20279/): Joomla Payage 2.05 SQL Injection via aid Parameter (high 8.8)
- [CVE-2017-20278](https://insights.sbomify.com/CVE-2017-20278/): Joomla JoomRecipe 1.0.3 SQL Injection via category parameter (high 8.8)
- [CVE-2017-20277](https://insights.sbomify.com/CVE-2017-20277/): Joomla JoomRecipe 1.0.4 Component Blind SQL Injection via search_author (high 8.8)
- [CVE-2017-20276](https://insights.sbomify.com/CVE-2017-20276/): Joomla! Component SIMGenealogy 2.1.5 SQL Injection (high 8.8)
- [CVE-2017-20275](https://insights.sbomify.com/CVE-2017-20275/): Joomla! Component PHP-Bridge 1.2.3 SQL Injection via id Parameter (high 8.8)
- [CVE-2017-20274](https://insights.sbomify.com/CVE-2017-20274/): Joomla LMS King Professional 3.2.4.0 SQL Injection via learningpath (high 8.8)
- [CVE-2017-20273](https://insights.sbomify.com/CVE-2017-20273/): Joomla Event Registration Pro Calendar 4.1.3 SQL Injection (high 8.8)
- [CVE-2017-20272](https://insights.sbomify.com/CVE-2017-20272/): Joomla Ultimate Property Listing 1.0.2 SQL Injection via sf_selectuser_id (high 8.8)
- [CVE-2017-20271](https://insights.sbomify.com/CVE-2017-20271/): Joomla StreetGuessr Game 1.1.8 SQL Injection via catid (high 8.8)
- [CVE-2017-20270](https://insights.sbomify.com/CVE-2017-20270/): Joomla! Component Twitch Tv 1.1 SQL Injection (high 8.8)
- [CVE-2017-20269](https://insights.sbomify.com/CVE-2017-20269/): Joomla! Component KissGallery 1.0.0 SQL Injection (high 8.8)
- [CVE-2017-20268](https://insights.sbomify.com/CVE-2017-20268/): Joomla! Component Zap Calendar Lite 4.3.4 SQL Injection (high 8.8)
- [CVE-2017-20267](https://insights.sbomify.com/CVE-2017-20267/): Joomla! Component Calendar Planner 1.0.1 SQL Injection (high 8.8)
- [CVE-2017-20266](https://insights.sbomify.com/CVE-2017-20266/): Joomla SP Movie Database 1.3 SQL Injection via searchword (high 8.8)
- [CVE-2017-20265](https://insights.sbomify.com/CVE-2017-20265/): Joomla! Component Flip Wall 8.0 SQL Injection (high 7.1)
- [CVE-2017-20264](https://insights.sbomify.com/CVE-2017-20264/): Joomla! Component Sponsor Wall 8.0 SQL Injection (high 7.1)
- [CVE-2017-20263](https://insights.sbomify.com/CVE-2017-20263/): Joomla! FocalPoint Pro Free 1.2.3 SQL Injection via location (high 8.8)
- [CVE-2017-20262](https://insights.sbomify.com/CVE-2017-20262/): Joomla! Component Ajax Quiz 1.8 SQL Injection (high 8.8)
- [CVE-2017-20261](https://insights.sbomify.com/CVE-2017-20261/): Joomla! Component Bargain Product VM3 1.0 SQL Injection (high 8.8)
- [CVE-2017-20260](https://insights.sbomify.com/CVE-2017-20260/): Joomla! Component Price Alert 3.0.2 SQL Injection (high 8.8)
- [CVE-2017-20259](https://insights.sbomify.com/CVE-2017-20259/): Joomla OSDownloads 1.7.4 SQL Injection via item view (high 8.8)
- [CVE-2017-20258](https://insights.sbomify.com/CVE-2017-20258/): Joomla! Component RPC Responsive Portfolio 1.6.1 SQL Injection (high 8.8)
- [CVE-2017-20257](https://insights.sbomify.com/CVE-2017-20257/): Joomla! Component Quiz Deluxe 3.7.4 SQL Injection (high 8.8)
- [CVE-2017-20256](https://insights.sbomify.com/CVE-2017-20256/): Joomla Survey Force Deluxe 3.2.4 SQL Injection via invite Parameter (high 8.8)
- [CVE-2017-20255](https://insights.sbomify.com/CVE-2017-20255/): Joomla! Component JB Visa 1.0 SQL Injection via visatype (high 8.8)
- [CVE-2017-20254](https://insights.sbomify.com/CVE-2017-20254/): Joomla! Component User Bench 1.0 SQL Injection via userid (high 8.8)
- [CVE-2017-20253](https://insights.sbomify.com/CVE-2017-20253/): Joomla! Component My Projects 2.0 SQL Injection (high 8.8)
- [CVE-2017-20252](https://insights.sbomify.com/CVE-2017-20252/): Joomla NextGen Editor 2.1.0 SQL Injection via plname Parameter (high 8.8)
- [CVE-2017-20251](https://insights.sbomify.com/CVE-2017-20251/): WordPress Insert PHP Plugin < 3.3.1 PHP Code Injection via REST API (critical 9.3)
- [CVE-2017-20250](https://insights.sbomify.com/CVE-2017-20250/): WordPress Plugin Mac Photo Gallery 3.0 Arbitrary File Download (high 8.7)
- [CVE-2017-20249](https://insights.sbomify.com/CVE-2017-20249/): WordPress Plugin Apptha Slider Gallery 1.0 SQL Injection (high 8.8)
- [CVE-2017-20248](https://insights.sbomify.com/CVE-2017-20248/): WordPress Plugin Apptha Slider Gallery 1.0 Path Traversal File Download (high 8.7)
- [CVE-2017-20247](https://insights.sbomify.com/CVE-2017-20247/): WordPress Plugin PICA Photo Gallery 1.0 SQL Injection (high 8.8)
- [CVE-2017-20246](https://insights.sbomify.com/CVE-2017-20246/): KittyCatfish 2.2 Plugin for WordPress SQL Injection (high 8.8)
- [CVE-2017-20245](https://insights.sbomify.com/CVE-2017-20245/): Wow Viral Signups 2.1 WordPress Plugin SQL Injection (high 8.8)
- [CVE-2017-20244](https://insights.sbomify.com/CVE-2017-20244/): Wow Forms WordPress Plugin 2.1 SQL Injection (high 8.8)
- [CVE-2017-20243](https://insights.sbomify.com/CVE-2017-20243/): WordPress Car Park Booking Plugin SQL Injection via space_id (high 8.8)
- [CVE-2017-20242](https://insights.sbomify.com/CVE-2017-20242/): Keysight IxChariot Endpoint stack-based buffer overflow (critical 9.3)
- [CVE-2017-20241](https://insights.sbomify.com/CVE-2017-20241/): Keysight IxChariot Endpoint heap-based buffer overflow (critical 9.3)
- [CVE-2017-20240](https://insights.sbomify.com/CVE-2017-20240/): Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks (medium 5.9)
- [CVE-2017-20239](https://insights.sbomify.com/CVE-2017-20239/): MDwiki Cross-Site Scripting via Location Hash Parameter (medium 5.1)
- [CVE-2017-20238](https://insights.sbomify.com/CVE-2017-20238/): Hirschmann Industrial HiVision Improper Authorization Privilege Escalation (high 7.1)
- [CVE-2017-20237](https://insights.sbomify.com/CVE-2017-20237/): Hirschmann Industrial HiVision Authentication Bypass Remote Code Execution (critical 9.3)
- [CVE-2017-20236](https://insights.sbomify.com/CVE-2017-20236/): ProSoft Technology ICX35-HWC Command Injection via Web Interface (critical 9.3)
- [CVE-2017-20235](https://insights.sbomify.com/CVE-2017-20235/): ProSoft Technology ICX35-HWC Authentication Bypass (critical 9.3)
- [CVE-2017-20234](https://insights.sbomify.com/CVE-2017-20234/): GarrettCom Magnum 6K and 10K Authentication Bypass via Hardcoded String (critical 9.3)
- [CVE-2017-20233](https://insights.sbomify.com/CVE-2017-20233/): Hirschmann HiLCOS Layer-2 Firewall Multicast Broadcast Traffic Bypass (medium 5.3)
- [CVE-2017-20230](https://insights.sbomify.com/CVE-2017-20230/): Storable versions before 3.05 for Perl has a stack overflow (critical 10.0)
- [CVE-2017-20229](https://insights.sbomify.com/CVE-2017-20229/): MAWK 1.3.3-17 Stack-Based Buffer Overflow (critical 9.3)
- [CVE-2017-20228](https://insights.sbomify.com/CVE-2017-20228/): Flat Assembler 1.71.21 Stack-Based Buffer Overflow ROP (high 8.6)
- [CVE-2017-20227](https://insights.sbomify.com/CVE-2017-20227/): JAD 1.5.8e-1kali1 Stack-Based Buffer Overflow (critical 9.3)
- [CVE-2017-20226](https://insights.sbomify.com/CVE-2017-20226/): Mapscrn 2.0.3 Stack-Based Buffer Overflow (high 8.6)
- [CVE-2017-20225](https://insights.sbomify.com/CVE-2017-20225/): TiEmu 2.08 Stack-Based Buffer Overflow Vulnerability (critical 9.3)
- [CVE-2017-20224](https://insights.sbomify.com/CVE-2017-20224/): Telesquare SKT LTE Router SDT-CS3B1 WebDAV Arbitrary File Upload (critical 9.3)
- [CVE-2017-20223](https://insights.sbomify.com/CVE-2017-20223/): Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference (critical 9.3)
- [CVE-2017-20222](https://insights.sbomify.com/CVE-2017-20222/): Telesquare SKT LTE Router SDT-CS3B1 Unauthenticated Remote Reboot (high 8.7)
- [CVE-2017-20221](https://insights.sbomify.com/CVE-2017-20221/): Telesquare SKT LTE Router SDT-CS3B1 CSRF System Command Execution (medium 5.3)
- [CVE-2017-20220](https://insights.sbomify.com/CVE-2017-20220/): Serviio PRO 1.8 Unauthenticated Password Change via REST API (high 8.7)
- [CVE-2017-20219](https://insights.sbomify.com/CVE-2017-20219/): Serviio PRO 1.8 DOM-based Cross-Site Scripting via mediabrowser (medium 5.1)
- [CVE-2017-20218](https://insights.sbomify.com/CVE-2017-20218/): Serviio PRO 1.8 Local Privilege Escalation via Unquoted Path (high 8.5)
- [CVE-2017-20217](https://insights.sbomify.com/CVE-2017-20217/): Serviio PRO 1.8 REST API Information Disclosure (high 8.7)
- [CVE-2017-20216](https://insights.sbomify.com/CVE-2017-20216/): FLIR Thermal Camera PT-Series firmware version 8.0.0.64 Unauthenticated Remote Command Injection (critical 9.3)
- [CVE-2017-20215](https://insights.sbomify.com/CVE-2017-20215/): FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 Authenticated OS Command Injection (high 8.7)
- [CVE-2017-20214](https://insights.sbomify.com/CVE-2017-20214/): FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 Hard-Coded SSH Credentials Vulnerability (critical 9.3)
- [CVE-2017-20213](https://insights.sbomify.com/CVE-2017-20213/): FLIR Thermal Camera F/FC/PT/D Stream 8.0.0.64 Unauthenticated Stream Disclosure (high 8.7)
- [CVE-2017-20212](https://insights.sbomify.com/CVE-2017-20212/): FLIR Thermal Camera F/FC/PT/D 8.0.0.64 Information Disclosure via File Reading (high 8.7)
- [CVE-2017-20211](https://insights.sbomify.com/CVE-2017-20211/): UCanCode E-XD++ Visualization Enterprise Suite Untrusted Pointer Dereference RCE (high 8.6)
- [CVE-2017-20210](https://insights.sbomify.com/CVE-2017-20210/): Photo Station (critical 9.8)
- [CVE-2017-20209](https://insights.sbomify.com/CVE-2017-20209/): Nagios Fusion < 4.0.1 XSS via Users/Servers Page (medium 5.1)
- [CVE-2017-20208](https://insights.sbomify.com/CVE-2017-20208/): RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection (critical 9.8)
- [CVE-2017-20207](https://insights.sbomify.com/CVE-2017-20207/): Flickr Gallery <= 1.5.2 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2017-20206](https://insights.sbomify.com/CVE-2017-20206/): Appointments <= 2.2.1 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2017-20205](https://insights.sbomify.com/CVE-2017-20205/): Valve Source SDK Stack-Based Buffer Overflow RCE (critical 9.2)
- [CVE-2017-20204](https://insights.sbomify.com/CVE-2017-20204/): DBLTek GoIP Telnet Admin Interface Undocumented Backdoor (critical 9.3)
- [CVE-2017-20203](https://insights.sbomify.com/CVE-2017-20203/): NetSarang v5.0 Malicious Backdoor Supply Chain Compromise (critical 9.3)
- [CVE-2017-20202](https://insights.sbomify.com/CVE-2017-20202/): Web Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain Compromise (critical 9.3)
- [CVE-2017-20201](https://insights.sbomify.com/CVE-2017-20201/): CCleaner v5.33.6162 & CCleaner Cloud v1.07.3191 Malicious Backdoor Supply Chain Compromise (critical 9.3)
- [CVE-2017-20200](https://insights.sbomify.com/CVE-2017-20200/): Coinomi cleartext transmission (medium 6.3)
- [CVE-2017-20199](https://insights.sbomify.com/CVE-2017-20199/): Buttercup buttercup-browser-extension Vault access control (low 2.3)
- [CVE-2017-20198](https://insights.sbomify.com/CVE-2017-20198/): DC/OS Marathon UI < 1.9.0 Unauthenticated RCE via Docker Mount Abuse (critical 9.3)
- [CVE-2017-20197](https://insights.sbomify.com/CVE-2017-20197/): propanetank Roommate-Bill-Tracking login.php sql injection (medium 6.9)
- [CVE-2017-20196](https://insights.sbomify.com/CVE-2017-20196/): Itechscripts School Management Software notice-edit.php sql injection (medium 5.3)
- [CVE-2017-20195](https://insights.sbomify.com/CVE-2017-20195/): LUNAD3v AreaLoad request.php sql injection (medium 5.1)
- [CVE-2017-20194](https://insights.sbomify.com/CVE-2017-20194/): Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure (medium 5.3)
- [CVE-2017-20193](https://insights.sbomify.com/CVE-2017-20193/): Product Vendors <= 2.0.35 - Reflected Cross Site Scripting (medium 4.7)
- [CVE-2017-20192](https://insights.sbomify.com/CVE-2017-20192/): Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting (high 8.3)
- [CVE-2017-20191](https://insights.sbomify.com/CVE-2017-20191/): Zimbra zm-admin-ajax Form Textbox Field Error XFormItem.js XFormItem.prototype.setError cross site scripting (low 3.5)
- [CVE-2017-20190](https://insights.sbomify.com/CVE-2017-20190/): Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of multi (not scored)
- [CVE-2017-20189](https://insights.sbomify.com/CVE-2017-20189/): Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization (critical 9.8)
- [CVE-2017-20188](https://insights.sbomify.com/CVE-2017-20188/): Zimbra zm-ajax XFormItem.js XFormItem.prototype.setError cross site scripting (low 2.6)
- [CVE-2017-20187](https://insights.sbomify.com/CVE-2017-20187/): Magnesium-PHP Base.php formatEmailString injection (low 3.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2017/page/61/