# Vulnerabilities published in 2017


- [CVE-2017-18904](https://insights.sbomify.com/CVE-2017-18904/): Mattermost Server vulnerable to XSS via an uploaded file (medium 6.1)
- [CVE-2017-18903](https://insights.sbomify.com/CVE-2017-18903/): Mattermost Server vulnerable to CSRF if CORS is enabled (high 8.8)
- [CVE-2017-18902](https://insights.sbomify.com/CVE-2017-18902/): Mattermost Server exposes team invite IDs through API endpoints (medium 5.3)
- [CVE-2017-18901](https://insights.sbomify.com/CVE-2017-18901/): Mattermost Server exposes private team invite ID (medium 5.3)
- [CVE-2017-18900](https://insights.sbomify.com/CVE-2017-18900/): Mattermost Server is vulnerable CSV Injection (critical 9.8)
- [CVE-2017-18899](https://insights.sbomify.com/CVE-2017-18899/): Security feature bypass in mattermost:mattermost server (medium 5.3)
- [CVE-2017-18898](https://insights.sbomify.com/CVE-2017-18898/): Mattermost Server is vulnerable to DoS through maliciously crafted posts (medium 5.3)
- [CVE-2017-18897](https://insights.sbomify.com/CVE-2017-18897/): Mattermost Server mishandles redirect denial action (medium 6.1)
- [CVE-2017-18896](https://insights.sbomify.com/CVE-2017-18896/): Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint (medium 5.3)
- [CVE-2017-18895](https://insights.sbomify.com/CVE-2017-18895/): Mattermost Server exposes sensitive user status information via REST API version 4 endpoint (medium 5.3)
- [CVE-2017-18894](https://insights.sbomify.com/CVE-2017-18894/): Mattermost Server has intermittent Authorization bypass for resource-owners (high 8.1)
- [CVE-2017-18893](https://insights.sbomify.com/CVE-2017-18893/): Mattermost Server is vulnerable to XSS through display name field (medium 6.1)
- [CVE-2017-18892](https://insights.sbomify.com/CVE-2017-18892/): Mattermost Server does not neutralize HTML content in an Email template field (medium 6.1)
- [CVE-2017-18891](https://insights.sbomify.com/CVE-2017-18891/): Mattermost Server does not safeguard against phishing via error page links (medium 6.1)
- [CVE-2017-18890](https://insights.sbomify.com/CVE-2017-18890/): Mattermost Server allows attackers to create buttons that can launch API requests (medium 4.3)
- [CVE-2017-18889](https://insights.sbomify.com/CVE-2017-18889/): Mattermost Server is vulnerable to webhook and slash command manipulation (medium 4.3)
- [CVE-2017-18888](https://insights.sbomify.com/CVE-2017-18888/): Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests (critical 9.8)
- [CVE-2017-18887](https://insights.sbomify.com/CVE-2017-18887/): Mattermost Server exposes team creator's e-mail address to other members (medium 5.3)
- [CVE-2017-18886](https://insights.sbomify.com/CVE-2017-18886/): Mattermost Server does not properly restrict use of slash commands (high 8.8)
- [CVE-2017-18885](https://insights.sbomify.com/CVE-2017-18885/): Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials (critical 9.8)
- [CVE-2017-18884](https://insights.sbomify.com/CVE-2017-18884/): Mattermost Server exposes OAuth personal access tokens to attackers (high 8.1)
- [CVE-2017-18883](https://insights.sbomify.com/CVE-2017-18883/): Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider (critical 9.1)
- [CVE-2017-18882](https://insights.sbomify.com/CVE-2017-18882/): Cross-site scripting in mattermost:mattermost server (medium 6.1)
- [CVE-2017-18881](https://insights.sbomify.com/CVE-2017-18881/): Cross-site scripting in mattermost:mattermost server (medium 6.1)
- [CVE-2017-18880](https://insights.sbomify.com/CVE-2017-18880/): Cross-site scripting in mattermost:mattermost server (medium 6.1)
- [CVE-2017-18879](https://insights.sbomify.com/CVE-2017-18879/): Mattermost Server is vulnerable to XSS through author_link field in Slack attachments (medium 6.1)
- [CVE-2017-18878](https://insights.sbomify.com/CVE-2017-18878/): Mattermost Server allows users with a session ID to revoke another users' session (medium 4.3)
- [CVE-2017-18877](https://insights.sbomify.com/CVE-2017-18877/): Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page (medium 6.1)
- [CVE-2017-18876](https://insights.sbomify.com/CVE-2017-18876/): Mattermost Server is vulnerable to Path Traversal when files are stored locally (medium 4.9)
- [CVE-2017-18875](https://insights.sbomify.com/CVE-2017-18875/): Mattermost Server does not prevent System Admin from arbitrary file creation (medium 4.9)
- [CVE-2017-18874](https://insights.sbomify.com/CVE-2017-18874/): Mattermost Server is vulnerable to Directory Traversal by System Admins (medium 6.5)
- [CVE-2017-18873](https://insights.sbomify.com/CVE-2017-18873/): Mattermost Server is vulnerable to channel invisibility DoS via misformatted post (medium 5.3)
- [CVE-2017-18872](https://insights.sbomify.com/CVE-2017-18872/): Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization (medium 4.3)
- [CVE-2017-18871](https://insights.sbomify.com/CVE-2017-18871/): Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names (high 7.5)
- [CVE-2017-18870](https://insights.sbomify.com/CVE-2017-18870/): Missing authorization in mattermost:mattermost server (medium 4.3)
- [CVE-2017-18869](https://insights.sbomify.com/CVE-2017-18869/): Time-of-check Time-of-use (TOCTOU) Race Condition in chownr (low 2.5)
- [CVE-2017-18868](https://insights.sbomify.com/CVE-2017-18868/): Missing authorization in digi:xbee 2 firmware (high 7.7)
- [CVE-2017-18867](https://insights.sbomify.com/CVE-2017-18867/): Misconfiguration in netgear:d6100 firmware (medium 6.8)
- [CVE-2017-18866](https://insights.sbomify.com/CVE-2017-18866/): Cross-site scripting in netgear:6r7500 firmware (medium 5.2)
- [CVE-2017-18865](https://insights.sbomify.com/CVE-2017-18865/): Memory corruption in netgear:r8300 firmware (medium 6.8)
- [CVE-2017-18864](https://insights.sbomify.com/CVE-2017-18864/): Memory corruption in netgear:r6400 firmware (high 8.8)
- [CVE-2017-18863](https://insights.sbomify.com/CVE-2017-18863/): Command injection in netgear:wac120 firmware (high 7.1)
- [CVE-2017-18862](https://insights.sbomify.com/CVE-2017-18862/): Auth bypass in netgear:gs105e firmware (medium 6.5)
- [CVE-2017-18861](https://insights.sbomify.com/CVE-2017-18861/): Cross-site request forgery in netgear:readynas surveillance (high 8.0)
- [CVE-2017-18860](https://insights.sbomify.com/CVE-2017-18860/): Command injection in netgear:fs752tp firmware (high 7.7)
- [CVE-2017-18859](https://insights.sbomify.com/CVE-2017-18859/): Denial of service in netgear:c6300 firmware (high 7.5)
- [CVE-2017-18858](https://insights.sbomify.com/CVE-2017-18858/): Command injection in netgear:m4200-10mg-poe\+ firmware (critical 9.8)
- [CVE-2017-18857](https://insights.sbomify.com/CVE-2017-18857/): Other in netgear:insight (critical 9.8)
- [CVE-2017-18856](https://insights.sbomify.com/CVE-2017-18856/): Command injection in netgear:readynas os firmware (medium 6.7)
- [CVE-2017-18855](https://insights.sbomify.com/CVE-2017-18855/): Command injection in netgear:wnr854t firmware (high 8.8)
- [CVE-2017-18854](https://insights.sbomify.com/CVE-2017-18854/): Command injection in netgear:readynas os firmware (medium 6.7)
- [CVE-2017-18853](https://insights.sbomify.com/CVE-2017-18853/): Information disclosure in netgear:d8500 firmware (critical 9.6)
- [CVE-2017-18852](https://insights.sbomify.com/CVE-2017-18852/): Cross-site request forgery in netgear:r7300dst firmware (high 8.4)
- [CVE-2017-18851](https://insights.sbomify.com/CVE-2017-18851/): Command injection in netgear:d8500 firmware (medium 6.7)
- [CVE-2017-18850](https://insights.sbomify.com/CVE-2017-18850/): Auth bypass in netgear:d6220 firmware (high 8.4)
- [CVE-2017-18849](https://insights.sbomify.com/CVE-2017-18849/): Command injection in netgear:d6220 firmware (high 8.4)
- [CVE-2017-18848](https://insights.sbomify.com/CVE-2017-18848/): Cross-site request forgery in netgear:ac1450 firmware (high 8.8)
- [CVE-2017-18847](https://insights.sbomify.com/CVE-2017-18847/): Information disclosure in netgear:d8500 firmware (medium 6.2)
- [CVE-2017-18846](https://insights.sbomify.com/CVE-2017-18846/): Memory corruption in netgear:d8500 firmware (medium 6.7)
- [CVE-2017-18845](https://insights.sbomify.com/CVE-2017-18845/): Information disclosure in netgear:r6700 firmware (high 8.4)
- [CVE-2017-18844](https://insights.sbomify.com/CVE-2017-18844/): Information disclosure in netgear:d7000 firmware (high 8.4)
- [CVE-2017-18843](https://insights.sbomify.com/CVE-2017-18843/): Information disclosure in netgear:d7000 firmware (high 8.4)
- [CVE-2017-18842](https://insights.sbomify.com/CVE-2017-18842/): Cross-site request forgery in netgear:d2200d firmware (high 8.8)
- [CVE-2017-18841](https://insights.sbomify.com/CVE-2017-18841/): Command injection in netgear:d7000 firmware (medium 6.7)
- [CVE-2017-18840](https://insights.sbomify.com/CVE-2017-18840/): Denial of service in netgear:m4200 firmware (medium 6.2)
- [CVE-2017-18839](https://insights.sbomify.com/CVE-2017-18839/): Cross-site scripting in netgear:m4200 firmware (medium 5.2)
- [CVE-2017-18838](https://insights.sbomify.com/CVE-2017-18838/): Privilege escalation in netgear:m4200 firmware (high 7.8)
- [CVE-2017-18837](https://insights.sbomify.com/CVE-2017-18837/): Privilege escalation in netgear:m4200 firmware (high 7.8)
- [CVE-2017-18836](https://insights.sbomify.com/CVE-2017-18836/): Denial of service in netgear:m4200 firmware (medium 6.2)
- [CVE-2017-18835](https://insights.sbomify.com/CVE-2017-18835/): Cross-site scripting in netgear:m4200 firmware (medium 6.1)
- [CVE-2017-18834](https://insights.sbomify.com/CVE-2017-18834/): Cross-site scripting in netgear:m4200 firmware (medium 6.1)
- [CVE-2017-18833](https://insights.sbomify.com/CVE-2017-18833/): Cross-site scripting in netgear:m4200 firmware (medium 6.1)
- [CVE-2017-18832](https://insights.sbomify.com/CVE-2017-18832/): Cross-site scripting in netgear:m4200 firmware (medium 5.2)
- [CVE-2017-18831](https://insights.sbomify.com/CVE-2017-18831/): Cross-site scripting in netgear:m4200 firmware (high 7.8)
- [CVE-2017-18830](https://insights.sbomify.com/CVE-2017-18830/): Privilege escalation in netgear:m4200 firmware (high 7.8)
- [CVE-2017-18829](https://insights.sbomify.com/CVE-2017-18829/): Privilege escalation in netgear:m4200 firmware (high 7.8)
- [CVE-2017-18828](https://insights.sbomify.com/CVE-2017-18828/): Cross-site scripting in netgear:m4200 firmware (medium 5.2)
- [CVE-2017-18827](https://insights.sbomify.com/CVE-2017-18827/): Cross-site scripting in netgear:m4200 firmware (medium 5.2)
- [CVE-2017-18826](https://insights.sbomify.com/CVE-2017-18826/): Privilege escalation in netgear:m4200 firmware (high 7.8)
- [CVE-2017-18825](https://insights.sbomify.com/CVE-2017-18825/): Cross-site scripting in netgear:m4200 firmware (medium 5.2)
- [CVE-2017-18824](https://insights.sbomify.com/CVE-2017-18824/): Path traversal in netgear:m4200 firmware (medium 4.0)
- [CVE-2017-18823](https://insights.sbomify.com/CVE-2017-18823/): Misconfiguration in netgear:m4200 firmware (high 7.7)
- [CVE-2017-18822](https://insights.sbomify.com/CVE-2017-18822/): Privilege escalation in netgear:m4200 firmware (high 7.8)
- [CVE-2017-18821](https://insights.sbomify.com/CVE-2017-18821/): Cross-site scripting in netgear:m4200 firmware (medium 5.2)
- [CVE-2017-18820](https://insights.sbomify.com/CVE-2017-18820/): Cross-site scripting in netgear:readynas os (medium 5.2)
- [CVE-2017-18819](https://insights.sbomify.com/CVE-2017-18819/): Misconfiguration in netgear:readynas os (medium 4.0)
- [CVE-2017-18816](https://insights.sbomify.com/CVE-2017-18816/): Cross-site scripting in netgear:readynas os (medium 5.2)
- [CVE-2017-18815](https://insights.sbomify.com/CVE-2017-18815/): Cross-site scripting in netgear:readynas os (medium 5.2)
- [CVE-2017-18814](https://insights.sbomify.com/CVE-2017-18814/): Cross-site scripting in netgear:readynas os (medium 5.2)
- [CVE-2017-18813](https://insights.sbomify.com/CVE-2017-18813/): Cross-site scripting in netgear:readynas os (medium 5.2)
- [CVE-2017-18812](https://insights.sbomify.com/CVE-2017-18812/): Cross-site scripting in netgear:readynas os (medium 5.2)
- [CVE-2017-18811](https://insights.sbomify.com/CVE-2017-18811/): Cross-site scripting in netgear:readynas os (medium 5.2)
- [CVE-2017-18810](https://insights.sbomify.com/CVE-2017-18810/): Cross-site scripting in netgear:readynas os (medium 5.2)
- [CVE-2017-18809](https://insights.sbomify.com/CVE-2017-18809/): Cross-site scripting in netgear:readynas os (medium 5.2)
- [CVE-2017-18808](https://insights.sbomify.com/CVE-2017-18808/): Misconfiguration in netgear:readynas os (medium 4.2)
- [CVE-2017-18807](https://insights.sbomify.com/CVE-2017-18807/): Cross-site scripting in netgear:readynas os (medium 5.2)
- [CVE-2017-18806](https://insights.sbomify.com/CVE-2017-18806/): Command injection in netgear:wac120 firmware (medium 6.7)
- [CVE-2017-18805](https://insights.sbomify.com/CVE-2017-18805/): Command injection in netgear:wac120 firmware (medium 6.7)
- [CVE-2017-18804](https://insights.sbomify.com/CVE-2017-18804/): Command injection in netgear:r7800 firmware (medium 6.7)
- [CVE-2017-18803](https://insights.sbomify.com/CVE-2017-18803/): Misconfiguration in netgear:r7800 firmware (medium 6.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2017/page/64/