# Vulnerabilities published in 2017


- [CVE-2017-20086](https://insights.sbomify.com/CVE-2017-20086/): VaultPress Plugin code injection (medium 6.3)
- [CVE-2017-20085](https://insights.sbomify.com/CVE-2017-20085/): Atahualpa Theme cross site scriting (low 3.5)
- [CVE-2017-20084](https://insights.sbomify.com/CVE-2017-20084/): JUNG Smart Visu Server KNX Group Address backdoor (medium 5.3)
- [CVE-2017-20083](https://insights.sbomify.com/CVE-2017-20083/): JUNG Smart Visu Server SSH Server backdoor (medium 5.3)
- [CVE-2017-20082](https://insights.sbomify.com/CVE-2017-20082/): JUNG Smart Visu Server backdoor (medium 5.5)
- [CVE-2017-20081](https://insights.sbomify.com/CVE-2017-20081/): Hindu Matrimonial Script reports.php privileges management (medium 6.3)
- [CVE-2017-20080](https://insights.sbomify.com/CVE-2017-20080/): Hindu Matrimonial Script googleads.php privileges management (medium 6.3)
- [CVE-2017-20079](https://insights.sbomify.com/CVE-2017-20079/): Hindu Matrimonial Script photo.php privileges management (medium 6.3)
- [CVE-2017-20078](https://insights.sbomify.com/CVE-2017-20078/): Hindu Matrimonial Script featured.php privileges management (medium 6.3)
- [CVE-2017-20077](https://insights.sbomify.com/CVE-2017-20077/): Hindu Matrimonial Script success_story.php privileges management (medium 6.3)
- [CVE-2017-20076](https://insights.sbomify.com/CVE-2017-20076/): Hindu Matrimonial Script searchview.php privileges management (medium 6.3)
- [CVE-2017-20075](https://insights.sbomify.com/CVE-2017-20075/): Hindu Matrimonial Script payment.php privileges management (medium 6.3)
- [CVE-2017-20074](https://insights.sbomify.com/CVE-2017-20074/): Hindu Matrimonial Script newsletter1.php privileges management (medium 6.3)
- [CVE-2017-20073](https://insights.sbomify.com/CVE-2017-20073/): Hindu Matrimonial Script cms.php privileges management (medium 6.3)
- [CVE-2017-20072](https://insights.sbomify.com/CVE-2017-20072/): Hindu Matrimonial Script generalsettings.php privileges management (medium 6.3)
- [CVE-2017-20071](https://insights.sbomify.com/CVE-2017-20071/): Hindu Matrimonial Script renewaldue.php privileges management (medium 6.3)
- [CVE-2017-20070](https://insights.sbomify.com/CVE-2017-20070/): Hindu Matrimonial Script communitymanagement.php privileges management (medium 6.3)
- [CVE-2017-20069](https://insights.sbomify.com/CVE-2017-20069/): Hindu Matrimonial Script countrymanagement.php privileges management (medium 6.3)
- [CVE-2017-20068](https://insights.sbomify.com/CVE-2017-20068/): Hindu Matrimonial Script usermanagement.php privileges management (medium 6.3)
- [CVE-2017-20067](https://insights.sbomify.com/CVE-2017-20067/): Hindu Matrimonial Script sql injection (high 7.3)
- [CVE-2017-20066](https://insights.sbomify.com/CVE-2017-20066/): Adminer Login access control (medium 5.3)
- [CVE-2017-20065](https://insights.sbomify.com/CVE-2017-20065/): Supsystic Popup Plugin cross-site request forgery (medium 4.3)
- [CVE-2017-20064](https://insights.sbomify.com/CVE-2017-20064/): Elefant CMS layout code injection (medium 6.3)
- [CVE-2017-20063](https://insights.sbomify.com/CVE-2017-20063/): Elefant CMS File Upload drop privileges management (medium 6.3)
- [CVE-2017-20062](https://insights.sbomify.com/CVE-2017-20062/): Elefant CMS cross-site request forgery (medium 5.0)
- [CVE-2017-20061](https://insights.sbomify.com/CVE-2017-20061/): Elefant CMS extended Reflected cross site scriting (medium 4.3)
- [CVE-2017-20060](https://insights.sbomify.com/CVE-2017-20060/): Elefant CMS Blog Post Persistent cross site scriting (low 3.5)
- [CVE-2017-20059](https://insights.sbomify.com/CVE-2017-20059/): Elefant CMS Title Persistent cross site scriting (low 3.5)
- [CVE-2017-20058](https://insights.sbomify.com/CVE-2017-20058/): Elefant CMS Version Comparison Persistent cross site scriting (medium 4.3)
- [CVE-2017-20057](https://insights.sbomify.com/CVE-2017-20057/): Elefant CMS Persistent cross site scriting (medium 4.3)
- [CVE-2017-20056](https://insights.sbomify.com/CVE-2017-20056/): weblizar User Login Log Plugin Stored cross site scriting (low 3.5)
- [CVE-2017-20055](https://insights.sbomify.com/CVE-2017-20055/): BestWebSoft Contact Form Plugin Stored cross site scriting (low 3.5)
- [CVE-2017-20054](https://insights.sbomify.com/CVE-2017-20054/): XYZScripts Contact Form Manager Plugin cross site scriting (low 3.5)
- [CVE-2017-20053](https://insights.sbomify.com/CVE-2017-20053/): XYZScripts Contact Form Manager Plugin cross-site request forgery (medium 4.3)
- [CVE-2017-20052](https://insights.sbomify.com/CVE-2017-20052/): Python pgAdmin4 uncontrolled search path (medium 5.0)
- [CVE-2017-20049](https://insights.sbomify.com/CVE-2017-20049/): Privilege escalation in AXIS OS (critical 9.8)
- [CVE-2017-20045](https://insights.sbomify.com/CVE-2017-20045/): Navetti PricePoint cross-site request forgery (high 7.3)
- [CVE-2017-20044](https://insights.sbomify.com/CVE-2017-20044/): Navetti PricePoint Reflected cross site scriting (medium 4.3)
- [CVE-2017-20043](https://insights.sbomify.com/CVE-2017-20043/): Navetti PricePoint Persistent cross site scriting (medium 4.3)
- [CVE-2017-20042](https://insights.sbomify.com/CVE-2017-20042/): Navetti PricePoint Blind sql injection (medium 6.3)
- [CVE-2017-20041](https://insights.sbomify.com/CVE-2017-20041/): Ucweb UC Browser HTML URL improper restriction of rendered ui layers (medium 5.4)
- [CVE-2017-20040](https://insights.sbomify.com/CVE-2017-20040/): SICUNET Access Controller Password Storage cleartext storage (medium 5.9)
- [CVE-2017-20039](https://insights.sbomify.com/CVE-2017-20039/): SICUNET Access Controller hard-coded password (critical 9.8)
- [CVE-2017-20038](https://insights.sbomify.com/CVE-2017-20038/): SICUNET Access Controller card_scan_decoder.php privileges management (medium 6.3)
- [CVE-2017-20037](https://insights.sbomify.com/CVE-2017-20037/): SICUNET Access Controller privileges management (medium 6.3)
- [CVE-2017-20036](https://insights.sbomify.com/CVE-2017-20036/): PHPList Bounce Rule Persistent cross site scriting (low 3.5)
- [CVE-2017-20035](https://insights.sbomify.com/CVE-2017-20035/): PHPList Subscribe Persistent cross site scriting (low 3.5)
- [CVE-2017-20034](https://insights.sbomify.com/CVE-2017-20034/): PHPList List Name Persistent cross site scriting (low 3.5)
- [CVE-2017-20033](https://insights.sbomify.com/CVE-2017-20033/): PHPList Reflected cross site scriting (medium 4.3)
- [CVE-2017-20032](https://insights.sbomify.com/CVE-2017-20032/): PHPList Subscription sql injection (medium 6.3)
- [CVE-2017-20031](https://insights.sbomify.com/CVE-2017-20031/): PHPList information disclosure (low 2.7)
- [CVE-2017-20030](https://insights.sbomify.com/CVE-2017-20030/): PHPList Sending Campain sql injection (medium 4.7)
- [CVE-2017-20029](https://insights.sbomify.com/CVE-2017-20029/): PHPList Edit Subscription index.php sql injection (high 7.3)
- [CVE-2017-20028](https://insights.sbomify.com/CVE-2017-20028/): HumHub privileges management (medium 5.6)
- [CVE-2017-20027](https://insights.sbomify.com/CVE-2017-20027/): HumHub DOM cross site scriting (medium 4.3)
- [CVE-2017-20026](https://insights.sbomify.com/CVE-2017-20026/): HumHub Reflected cross site scriting (medium 4.3)
- [CVE-2017-20025](https://insights.sbomify.com/CVE-2017-20025/): Solare Solar-Log Flash Memory privileges management (high 7.3)
- [CVE-2017-20024](https://insights.sbomify.com/CVE-2017-20024/): Solare Solar-Log denial of service (medium 5.3)
- [CVE-2017-20023](https://insights.sbomify.com/CVE-2017-20023/): Solare Solar-Log Network Config privileges management (medium 6.3)
- [CVE-2017-20022](https://insights.sbomify.com/CVE-2017-20022/): Solare Solar-Log information disclosure (high 7.5)
- [CVE-2017-20021](https://insights.sbomify.com/CVE-2017-20021/): Solare Solar-Log File Upload privileges management (medium 6.5)
- [CVE-2017-20020](https://insights.sbomify.com/CVE-2017-20020/): Solare Solar-Log cross-site request forgery (medium 5.3)
- [CVE-2017-20019](https://insights.sbomify.com/CVE-2017-20019/): Solare Solar-Log Config information disclosure (medium 4.3)
- [CVE-2017-20018](https://insights.sbomify.com/CVE-2017-20018/): XAMPP Installer uncontrolled search path (medium 6.3)
- [CVE-2017-20017](https://insights.sbomify.com/CVE-2017-20017/): The Next Generation of Genealogy Sitebuilding timeline2.php sql injection (medium 6.3)
- [CVE-2017-20016](https://insights.sbomify.com/CVE-2017-20016/): WEKA INTEREST Security Scanner Portscan memory allocation (medium 4.3)
- [CVE-2017-20015](https://insights.sbomify.com/CVE-2017-20015/): WEKA INTEREST Security Scanner LAN Viewer denial of service (low 2.8)
- [CVE-2017-20014](https://insights.sbomify.com/CVE-2017-20014/): WEKA INTEREST Security Scanner Webspider denial of service (low 2.8)
- [CVE-2017-20013](https://insights.sbomify.com/CVE-2017-20013/): WEKA INTEREST Security Scanner Stresstest Configuration denial of service (low 2.8)
- [CVE-2017-20012](https://insights.sbomify.com/CVE-2017-20012/): WEKA INTEREST Security Scanner Stresstest Scheme denial of service (low 2.8)
- [CVE-2017-20011](https://insights.sbomify.com/CVE-2017-20011/): WEKA INTEREST Security Scanner HTTP denial of service (low 2.8)
- [CVE-2017-20008](https://insights.sbomify.com/CVE-2017-20008/): myCRED < 1.7.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2017-20007](https://insights.sbomify.com/CVE-2017-20007/): Information Exposure in INGEPAC DA AU (medium 5.3)
- [CVE-2017-20006](https://insights.sbomify.com/CVE-2017-20006/): Memory corruption in rarlab:unrar (high 7.8)
- [CVE-2017-20005](https://insights.sbomify.com/CVE-2017-20005/): Integer overflow in debian:debian linux (critical 9.8)
- [CVE-2017-20004](https://insights.sbomify.com/CVE-2017-20004/): Race condition in rust-lang:rust (medium 5.9)
- [CVE-2017-20002](https://insights.sbomify.com/CVE-2017-20002/): Misconfiguration in debian:debian linux (high 7.8)
- [CVE-2017-20001](https://insights.sbomify.com/CVE-2017-20001/): Weak cryptography in aes encryption project:aes encryption (high 7.5)
- [CVE-2017-18926](https://insights.sbomify.com/CVE-2017-18926/): Memory corruption in debian:debian linux (high 7.1)
- [CVE-2017-18925](https://insights.sbomify.com/CVE-2017-18925/): Privilege escalation in openr:opentmpfiles (medium 5.5)
- [CVE-2017-18924](https://insights.sbomify.com/CVE-2017-18924/): Code Injection in oauth2-server (high 7.5)
- [CVE-2017-18923](https://insights.sbomify.com/CVE-2017-18923/): Path traversal in beronet:voice over internet protocol gateways firmware (high 7.5)
- [CVE-2017-18922](https://insights.sbomify.com/CVE-2017-18922/): Memory corruption in canonical:ubuntu linux (critical 9.8)
- [CVE-2017-18921](https://insights.sbomify.com/CVE-2017-18921/): Cross-site scripting in mattermost:mattermost server (medium 6.1)
- [CVE-2017-18920](https://insights.sbomify.com/CVE-2017-18920/): Security feature bypass in mattermost:mattermost server (critical 9.8)
- [CVE-2017-18919](https://insights.sbomify.com/CVE-2017-18919/): Auth bypass in mattermost:mattermost server (medium 5.3)
- [CVE-2017-18918](https://insights.sbomify.com/CVE-2017-18918/): Mattermost Server does not restrict SAML certificate path for System Administrators (medium 4.9)
- [CVE-2017-18917](https://insights.sbomify.com/CVE-2017-18917/): Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations (high 7.5)
- [CVE-2017-18916](https://insights.sbomify.com/CVE-2017-18916/): Mattermost Server has Improper Authorization for Integration Requests (medium 5.3)
- [CVE-2017-18915](https://insights.sbomify.com/CVE-2017-18915/): Mattermost Server server restarts may provide attackers with API access (critical 9.8)
- [CVE-2017-18914](https://insights.sbomify.com/CVE-2017-18914/): Other in mattermost:mattermost server (medium 5.3)
- [CVE-2017-18913](https://insights.sbomify.com/CVE-2017-18913/): Cross-site scripting in mattermost:mattermost server (medium 6.1)
- [CVE-2017-18912](https://insights.sbomify.com/CVE-2017-18912/): Mattermost Server allows an attacker to specify a full pathname of a log file (critical 9.8)
- [CVE-2017-18911](https://insights.sbomify.com/CVE-2017-18911/): Mattermost Server has X.509 Improper Certificate Validation (critical 9.1)
- [CVE-2017-18910](https://insights.sbomify.com/CVE-2017-18910/): Other in mattermost:mattermost server (medium 4.3)
- [CVE-2017-18909](https://insights.sbomify.com/CVE-2017-18909/): Mattermost Server SAML implementation does not require encryption or signature verification as default (high 7.5)
- [CVE-2017-18908](https://insights.sbomify.com/CVE-2017-18908/): Mattermost Server password reset email requests can be sent to attacker-provided email addresses (critical 9.8)
- [CVE-2017-18907](https://insights.sbomify.com/CVE-2017-18907/): Mattermost Server vulnerable to XSS through channel headers (medium 6.1)
- [CVE-2017-18906](https://insights.sbomify.com/CVE-2017-18906/): Mattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used (high 8.1)
- [CVE-2017-18905](https://insights.sbomify.com/CVE-2017-18905/): Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2017/page/63/