# Vulnerabilities published in 2017


- [CVE-2017-9368](https://insights.sbomify.com/CVE-2017-9368/): Information disclosure in Workspaces Server (high 7.5)
- [CVE-2017-9367](https://insights.sbomify.com/CVE-2017-9367/): Path traversal in Workspaces Server (critical 9.8)
- [CVE-2017-9366](https://insights.sbomify.com/CVE-2017-9366/): Cross-site scripting in n/a (medium 4.8)
- [CVE-2017-9365](https://insights.sbomify.com/CVE-2017-9365/): Cross-site request forgery in n/a (high 8.8)
- [CVE-2017-9364](https://insights.sbomify.com/CVE-2017-9364/): File upload in n/a (critical 9.8)
- [CVE-2017-9363](https://insights.sbomify.com/CVE-2017-9363/): Deserialization in n/a (critical 9.8)
- [CVE-2017-9362](https://insights.sbomify.com/CVE-2017-9362/): XML external entity in n/a (high 8.8)
- [CVE-2017-9361](https://insights.sbomify.com/CVE-2017-9361/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2017-9360](https://insights.sbomify.com/CVE-2017-9360/): SQL injection in n/a (critical 9.8)
- [CVE-2017-9359](https://insights.sbomify.com/CVE-2017-9359/): Denial of service in n/a (high 7.5)
- [CVE-2017-9358](https://insights.sbomify.com/CVE-2017-9358/): Denial of service in n/a (high 7.5)
- [CVE-2017-9356](https://insights.sbomify.com/CVE-2017-9356/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2017-9355](https://insights.sbomify.com/CVE-2017-9355/): XML external entity in n/a (high 7.4)
- [CVE-2017-9354](https://insights.sbomify.com/CVE-2017-9354/): Denial of service in n/a (high 7.5)
- [CVE-2017-9353](https://insights.sbomify.com/CVE-2017-9353/): Denial of service in n/a (high 7.5)
- [CVE-2017-9352](https://insights.sbomify.com/CVE-2017-9352/): Denial of service in n/a (high 7.5)
- [CVE-2017-9351](https://insights.sbomify.com/CVE-2017-9351/): Memory corruption in n/a (high 7.5)
- [CVE-2017-9350](https://insights.sbomify.com/CVE-2017-9350/): Denial of service in n/a (high 7.5)
- [CVE-2017-9349](https://insights.sbomify.com/CVE-2017-9349/): Denial of service in n/a (high 7.5)
- [CVE-2017-9348](https://insights.sbomify.com/CVE-2017-9348/): Memory corruption in n/a (high 7.5)
- [CVE-2017-9347](https://insights.sbomify.com/CVE-2017-9347/): Null dereference in n/a (high 7.5)
- [CVE-2017-9346](https://insights.sbomify.com/CVE-2017-9346/): Denial of service in n/a (high 7.5)
- [CVE-2017-9345](https://insights.sbomify.com/CVE-2017-9345/): Denial of service in n/a (high 7.5)
- [CVE-2017-9344](https://insights.sbomify.com/CVE-2017-9344/): Denial of service in n/a (high 7.5)
- [CVE-2017-9343](https://insights.sbomify.com/CVE-2017-9343/): Null dereference in n/a (high 7.5)
- [CVE-2017-9340](https://insights.sbomify.com/CVE-2017-9340/): Business logic in n/a (medium 6.5)
- [CVE-2017-9339](https://insights.sbomify.com/CVE-2017-9339/): Information disclosure in n/a (medium 5.3)
- [CVE-2017-9338](https://insights.sbomify.com/CVE-2017-9338/): Cross-site scripting in n/a (medium 5.4)
- [CVE-2017-9337](https://insights.sbomify.com/CVE-2017-9337/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2017-9336](https://insights.sbomify.com/CVE-2017-9336/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2017-9334](https://insights.sbomify.com/CVE-2017-9334/): Null dereference in n/a (high 7.5)
- [CVE-2017-9333](https://insights.sbomify.com/CVE-2017-9333/): Command injection in n/a (high 8.8)
- [CVE-2017-9332](https://insights.sbomify.com/CVE-2017-9332/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2017-9331](https://insights.sbomify.com/CVE-2017-9331/): Cross-site scripting in n/a (medium 5.4)
- [CVE-2017-9330](https://insights.sbomify.com/CVE-2017-9330/): Denial of service in n/a (medium 5.6)
- [CVE-2017-9328](https://insights.sbomify.com/CVE-2017-9328/): Command injection in n/a (critical 9.8)
- [CVE-2017-9327](https://insights.sbomify.com/CVE-2017-9327/): Information disclosure in n/a (medium 6.5)
- [CVE-2017-9326](https://insights.sbomify.com/CVE-2017-9326/): Information disclosure in n/a (high 7.5)
- [CVE-2017-9325](https://insights.sbomify.com/CVE-2017-9325/): Missing authorization in n/a (high 7.5)
- [CVE-2017-9324](https://insights.sbomify.com/CVE-2017-9324/): Privilege escalation in n/a (high 8.8)
- [CVE-2017-9317](https://insights.sbomify.com/CVE-2017-9317/): Privilege escalation in XVR 5x04, XVR 5x08, XVR 5x16, XVR 7x16, IPC-HDBW4XXX, IPC-HDBW5XXX (high 8.8)
- [CVE-2017-9316](https://insights.sbomify.com/CVE-2017-9316/): Auth bypass in IPC-HDW4300S\NVR11HS\IPC-HFW4X00\IPC-HDW4X00\IPC-HDBW4X00\IPC-HF5X00\IPC-HFW5X00\IPC-HDW5X00\IPC-HDBW5X00\NVR11HS (medium 6.5)
- [CVE-2017-9315](https://insights.sbomify.com/CVE-2017-9315/): Auth bypass in Dahua IP Camera and IP PTZ IPC-HFW1XXX, IPC-HDW1XXX, IPC-HDBW1XXX, IPC-HFW2XXX, IPC-HDW2XXX, IPC-HDBW2XXX, IPC-HFW4XXX, IPC-HDW4XXX, IPC-HDBW4XXX, IPC-HF5XXX, IPC-HFW5XXX, IPC-HDW5XXX, IPC-HDBW5XXX, IPC-HF8XXX, IPC-HFW8XXX, IPC-HDBW8XXX, IPC-EBW8XXX, IPC-PFW8xxx, IPC-PDBW8xxx, IPC-HUM8xxx, PSD8xxxx, DH-SD2XXXXX, DH-SD4XXXXX, DH-SD5XXXXX, DH-SD6XXXXX (critical 9.8)
- [CVE-2017-9314](https://insights.sbomify.com/CVE-2017-9314/): Auth bypass in NVR50XX, VR52XX, VR54XX, VR58XX (high 8.8)
- [CVE-2017-9313](https://insights.sbomify.com/CVE-2017-9313/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2017-9312](https://insights.sbomify.com/CVE-2017-9312/): Denial of service in n/a (high 7.5)
- [CVE-2017-9310](https://insights.sbomify.com/CVE-2017-9310/): Denial of service in n/a (medium 5.6)
- [CVE-2017-9307](https://insights.sbomify.com/CVE-2017-9307/): Server-side request forgery in n/a (medium 6.5)
- [CVE-2017-9306](https://insights.sbomify.com/CVE-2017-9306/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2017-9305](https://insights.sbomify.com/CVE-2017-9305/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2017-9304](https://insights.sbomify.com/CVE-2017-9304/): Denial of service in n/a (high 7.5)
- [CVE-2017-9303](https://insights.sbomify.com/CVE-2017-9303/): Laravel does not properly constrain the host portion of a password-reset URL (medium 6.1)
- [CVE-2017-9302](https://insights.sbomify.com/CVE-2017-9302/): Denial of service in n/a (medium 5.5)
- [CVE-2017-9301](https://insights.sbomify.com/CVE-2017-9301/): Denial of service in n/a (high 7.8)
- [CVE-2017-9300](https://insights.sbomify.com/CVE-2017-9300/): Memory corruption in n/a (high 7.8)
- [CVE-2017-9299](https://insights.sbomify.com/CVE-2017-9299/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2017-9298](https://insights.sbomify.com/CVE-2017-9298/): Cross-site scripting in n/a (medium 5.4)
- [CVE-2017-9297](https://insights.sbomify.com/CVE-2017-9297/): Open redirect in n/a (medium 6.1)
- [CVE-2017-9296](https://insights.sbomify.com/CVE-2017-9296/): Open redirect in n/a (medium 6.1)
- [CVE-2017-9295](https://insights.sbomify.com/CVE-2017-9295/): XML external entity in n/a (medium 6.5)
- [CVE-2017-9294](https://insights.sbomify.com/CVE-2017-9294/): Missing authorization in n/a (critical 9.8)
- [CVE-2017-9292](https://insights.sbomify.com/CVE-2017-9292/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2017-9289](https://insights.sbomify.com/CVE-2017-9289/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2017-9288](https://insights.sbomify.com/CVE-2017-9288/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2017-9287](https://insights.sbomify.com/CVE-2017-9287/): Use after free in n/a (medium 6.5)
- [CVE-2017-9286](https://insights.sbomify.com/CVE-2017-9286/): nextcloud package security issues with /srv/www/htdocs (high 7.8)
- [CVE-2017-9285](https://insights.sbomify.com/CVE-2017-9285/): Login restrictions not applied when using ebaclient against NetIQ eDirectory EBA interface (medium 5.4)
- [CVE-2017-9284](https://insights.sbomify.com/CVE-2017-9284/): IDM 4.6 Identity Applications information leakage (medium 4.8)
- [CVE-2017-9283](https://insights.sbomify.com/CVE-2017-9283/): Information disclosure in Micro Focus VisiBroker (critical 9.8)
- [CVE-2017-9282](https://insights.sbomify.com/CVE-2017-9282/): Integer overflow in Micro Focus VisiBroker (critical 9.8)
- [CVE-2017-9281](https://insights.sbomify.com/CVE-2017-9281/): Integer overflow in n/a (high 7.5)
- [CVE-2017-9280](https://insights.sbomify.com/CVE-2017-9280/): Novell Identity Manager User Application get request url contains the session token. (medium 4.3)
- [CVE-2017-9279](https://insights.sbomify.com/CVE-2017-9279/): NetIQ Identity Manager allowed uploading of user icons with incorrect types or extensions (low 2.0)
- [CVE-2017-9278](https://insights.sbomify.com/CVE-2017-9278/): Avoid password disclosure via EBS event logging in the iManager Oracle driver (low 3.3)
- [CVE-2017-9277](https://insights.sbomify.com/CVE-2017-9277/): existing connection is being used even though eDirectory LDAP server is upgraded to EBA (medium 4.2)
- [CVE-2017-9276](https://insights.sbomify.com/CVE-2017-9276/): XSS Vulnerability in iManager (medium 5.4)
- [CVE-2017-9275](https://insights.sbomify.com/CVE-2017-9275/): NetIQ Identity Reporting XSS exposure (low 2.8)
- [CVE-2017-9274](https://insights.sbomify.com/CVE-2017-9274/): osc executes spec code during "osc commit" (high 7.8)
- [CVE-2017-9273](https://insights.sbomify.com/CVE-2017-9273/): Missing authorization in IDM 4.5 bidirectional eDir Driver Version (medium 5.3)
- [CVE-2017-9272](https://insights.sbomify.com/CVE-2017-9272/): Denial of service in IDM 4.5 bidirectional eDir Driver Version (high 7.5)
- [CVE-2017-9271](https://insights.sbomify.com/CVE-2017-9271/): proxy credentials written to log files by zypper (medium 4.0)
- [CVE-2017-9270](https://insights.sbomify.com/CVE-2017-9270/): post-auth arbitrary file write on cryptctl server (high 8.7)
- [CVE-2017-9269](https://insights.sbomify.com/CVE-2017-9269/): lack of keypinning in libzypp could lead to repository switching (high 7.7)
- [CVE-2017-9268](https://insights.sbomify.com/CVE-2017-9268/): open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions (medium 4.4)
- [CVE-2017-9267](https://insights.sbomify.com/CVE-2017-9267/): eDirectory LDAP peer certificate validation issue (medium 6.5)
- [CVE-2017-9265](https://insights.sbomify.com/CVE-2017-9265/): Memory corruption in n/a (critical 9.8)
- [CVE-2017-9264](https://insights.sbomify.com/CVE-2017-9264/): Memory corruption in n/a (critical 9.8)
- [CVE-2017-9263](https://insights.sbomify.com/CVE-2017-9263/): Denial of service in n/a (medium 6.5)
- [CVE-2017-9262](https://insights.sbomify.com/CVE-2017-9262/): Denial of service in n/a (medium 6.5)
- [CVE-2017-9261](https://insights.sbomify.com/CVE-2017-9261/): Denial of service in n/a (medium 6.5)
- [CVE-2017-9260](https://insights.sbomify.com/CVE-2017-9260/): Memory corruption in n/a (medium 5.5)
- [CVE-2017-9259](https://insights.sbomify.com/CVE-2017-9259/): Denial of service in n/a (medium 5.5)
- [CVE-2017-9258](https://insights.sbomify.com/CVE-2017-9258/): Denial of service in n/a (medium 5.5)
- [CVE-2017-9257](https://insights.sbomify.com/CVE-2017-9257/): Denial of service in n/a (medium 5.5)
- [CVE-2017-9256](https://insights.sbomify.com/CVE-2017-9256/): Denial of service in n/a (medium 5.5)
- [CVE-2017-9255](https://insights.sbomify.com/CVE-2017-9255/): Denial of service in n/a (medium 5.5)
- [CVE-2017-9254](https://insights.sbomify.com/CVE-2017-9254/): Denial of service in n/a (medium 5.5)
- [CVE-2017-9253](https://insights.sbomify.com/CVE-2017-9253/): Denial of service in n/a (medium 5.5)
- [CVE-2017-9252](https://insights.sbomify.com/CVE-2017-9252/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2017-9251](https://insights.sbomify.com/CVE-2017-9251/): Cross-site scripting in n/a (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2017/page/7/