# Vulnerabilities published in 2017


- [CVE-2017-16774](https://insights.sbomify.com/CVE-2017-16774/): Cross-site scripting in DiskStation Manager (DSM) (medium 6.5)
- [CVE-2017-16773](https://insights.sbomify.com/CVE-2017-16773/): Missing authorization in Universal Search (medium 6.5)
- [CVE-2017-16772](https://insights.sbomify.com/CVE-2017-16772/): File upload in Photo Station (high 8.8)
- [CVE-2017-16771](https://insights.sbomify.com/CVE-2017-16771/): Cross-site scripting in Photo Station (medium 6.1)
- [CVE-2017-16770](https://insights.sbomify.com/CVE-2017-16770/): Information disclosure in Surveillance Station (medium 6.5)
- [CVE-2017-1677](https://insights.sbomify.com/CVE-2017-1677/): Deserialization in DB2 for Linux, UNIX and Windows (high 7.4)
- [CVE-2017-16769](https://insights.sbomify.com/CVE-2017-16769/): Information disclosure in Synology Photo Station (medium 5.3)
- [CVE-2017-16768](https://insights.sbomify.com/CVE-2017-16768/): Cross-site scripting in synology:mailplus server (medium 4.8)
- [CVE-2017-16767](https://insights.sbomify.com/CVE-2017-16767/): Cross-site scripting in Surveillance Station (medium 5.4)
- [CVE-2017-16766](https://insights.sbomify.com/CVE-2017-16766/): Cross-site scripting in DiskStation Manager (DSM) (medium 6.5)
- [CVE-2017-16765](https://insights.sbomify.com/CVE-2017-16765/): Cross-site scripting in dlink:dwr-933 firmware (medium 6.1)
- [CVE-2017-16764](https://insights.sbomify.com/CVE-2017-16764/): django_make_app is vulnerable to Code Injection (critical 9.8)
- [CVE-2017-16763](https://insights.sbomify.com/CVE-2017-16763/): Unsafe deserialization in confire (critical 9.8)
- [CVE-2017-16762](https://insights.sbomify.com/CVE-2017-16762/): Sanic arbitrary file read and directory traversal (high 7.5)
- [CVE-2017-16761](https://insights.sbomify.com/CVE-2017-16761/): Open redirect in inedo:buildmaster (medium 6.1)
- [CVE-2017-16760](https://insights.sbomify.com/CVE-2017-16760/): Inedo BuildMaster before 5.8.2 has XSS. (medium 6.1)
- [CVE-2017-16759](https://insights.sbomify.com/CVE-2017-16759/): LibreNMS Arbitrary File Read (medium 5.9)
- [CVE-2017-16758](https://insights.sbomify.com/CVE-2017-16758/): Cross-site scripting in ultimate instagram feed project:ultimate instagram feed (medium 4.8)
- [CVE-2017-16757](https://insights.sbomify.com/CVE-2017-16757/): Misconfiguration in hola:vpn (high 7.8)
- [CVE-2017-16756](https://insights.sbomify.com/CVE-2017-16756/): Cross-site request forgery in userscape:helpspot (high 8.8)
- [CVE-2017-16755](https://insights.sbomify.com/CVE-2017-16755/): Cross-site scripting in userscape:helpspot (medium 6.1)
- [CVE-2017-16754](https://insights.sbomify.com/CVE-2017-16754/): Bolt Improper Access Control (medium 5.3)
- [CVE-2017-16753](https://insights.sbomify.com/CVE-2017-16753/): Denial of service in Advantech WebAccess (high 7.5)
- [CVE-2017-16751](https://insights.sbomify.com/CVE-2017-16751/): Memory corruption in Delta Electronics Delta Industrial Automation Screen Editor (high 7.8)
- [CVE-2017-16749](https://insights.sbomify.com/CVE-2017-16749/): Use after free in Delta Electronics Delta Industrial Automation Screen Editor (high 7.8)
- [CVE-2017-16748](https://insights.sbomify.com/CVE-2017-16748/): Auth bypass in Niagara AX Framework and Niagara 4 Framework (critical 9.8)
- [CVE-2017-16747](https://insights.sbomify.com/CVE-2017-16747/): Memory corruption in Delta Electronics Delta Industrial Automation Screen Editor (high 7.8)
- [CVE-2017-16745](https://insights.sbomify.com/CVE-2017-16745/): Memory corruption in Delta Electronics Delta Industrial Automation Screen Editor (high 7.8)
- [CVE-2017-16744](https://insights.sbomify.com/CVE-2017-16744/): Path traversal in Niagara AX Framework and Niagara 4 Framework (high 7.2)
- [CVE-2017-16743](https://insights.sbomify.com/CVE-2017-16743/): Auth bypass in PHOENIX CONTACT FL SWITCH (critical 9.8)
- [CVE-2017-16741](https://insights.sbomify.com/CVE-2017-16741/): Information disclosure in PHOENIX CONTACT FL SWITCH (medium 5.3)
- [CVE-2017-16740](https://insights.sbomify.com/CVE-2017-16740/): Memory corruption in Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers (critical 10.0)
- [CVE-2017-16739](https://insights.sbomify.com/CVE-2017-16739/): Memory corruption in WECON Technology Co., Ltd. LeviStudio HMI Editor (high 7.8)
- [CVE-2017-16737](https://insights.sbomify.com/CVE-2017-16737/): Memory corruption in WECON Technology Co., Ltd. LeviStudio HMI Editor (high 7.8)
- [CVE-2017-16736](https://insights.sbomify.com/CVE-2017-16736/): File upload in Advantech WebAccess (high 7.5)
- [CVE-2017-16735](https://insights.sbomify.com/CVE-2017-16735/): SQL injection in Ecava IntegraXor (medium 5.3)
- [CVE-2017-16733](https://insights.sbomify.com/CVE-2017-16733/): SQL injection in Ecava IntegraXor (medium 5.3)
- [CVE-2017-16732](https://insights.sbomify.com/CVE-2017-16732/): Use after free in Advantech WebAccess (medium 6.5)
- [CVE-2017-16731](https://insights.sbomify.com/CVE-2017-16731/): Information disclosure in ABB Ellipse (high 8.8)
- [CVE-2017-1673](https://insights.sbomify.com/CVE-2017-1673/): Cross-site scripting in Security Key Lifecycle Manager (medium 6.1)
- [CVE-2017-16728](https://insights.sbomify.com/CVE-2017-16728/): Memory corruption in Advantech WebAccess (high 7.5)
- [CVE-2017-16727](https://insights.sbomify.com/CVE-2017-16727/): Hardcoded credentials in Moxa NPort W2150A and W2250A (critical 9.1)
- [CVE-2017-16726](https://insights.sbomify.com/CVE-2017-16726/): Weak cryptography in Beckhoff TwinCAT (critical 9.1)
- [CVE-2017-16725](https://insights.sbomify.com/CVE-2017-16725/): Memory corruption in Xiongmai Technology IP Cameras and DVRs (critical 9.8)
- [CVE-2017-16724](https://insights.sbomify.com/CVE-2017-16724/): Memory corruption in Advantech WebAccess (critical 9.8)
- [CVE-2017-16723](https://insights.sbomify.com/CVE-2017-16723/): Cross-site scripting in PHOENIX CONTACT FL COMSERVER, FL COM SERVER, and PSI-MODEM/ETH (medium 6.1)
- [CVE-2017-16721](https://insights.sbomify.com/CVE-2017-16721/): Cross-site scripting in Geovap Reliance SCADA (medium 6.1)
- [CVE-2017-16720](https://insights.sbomify.com/CVE-2017-16720/): Path traversal in Advantech WebAccess (critical 9.8)
- [CVE-2017-1672](https://insights.sbomify.com/CVE-2017-1672/): Cross-site request forgery in Security Key Lifecycle Manager (high 8.8)
- [CVE-2017-16719](https://insights.sbomify.com/CVE-2017-16719/): Other in Moxa NPort 5110, 5130, and 5150 (high 7.5)
- [CVE-2017-16718](https://insights.sbomify.com/CVE-2017-16718/): Weak cryptography in Beckhoff TwinCAT (medium 5.9)
- [CVE-2017-16717](https://insights.sbomify.com/CVE-2017-16717/): Memory corruption in WECON Technology Co., Ltd. LeviStudio HMI (high 8.6)
- [CVE-2017-16716](https://insights.sbomify.com/CVE-2017-16716/): SQL injection in Advantech WebAccess (critical 9.8)
- [CVE-2017-16715](https://insights.sbomify.com/CVE-2017-16715/): Information disclosure in Moxa NPort 5110, 5130, and 5150 (high 8.6)
- [CVE-2017-16714](https://insights.sbomify.com/CVE-2017-16714/): Information disclosure in Thermal Management Center (critical 9.8)
- [CVE-2017-16711](https://insights.sbomify.com/CVE-2017-16711/): Null dereference in swftools:swftools (medium 5.5)
- [CVE-2017-16710](https://insights.sbomify.com/CVE-2017-16710/): Cross-site scripting in crestron:airmedia am-100 firmware (medium 4.8)
- [CVE-2017-1671](https://insights.sbomify.com/CVE-2017-1671/): Path traversal in Security Key Lifecycle Manager (high 7.5)
- [CVE-2017-16709](https://insights.sbomify.com/CVE-2017-16709/): Other in crestron:airmedia am-100 firmware (high 7.2)
- [CVE-2017-1670](https://insights.sbomify.com/CVE-2017-1670/): SQL injection in Security Key Lifecycle Manager (critical 9.8)
- [CVE-2017-16691](https://insights.sbomify.com/CVE-2017-16691/): Security feature bypass in SAP Note Assistant (medium 6.5)
- [CVE-2017-16690](https://insights.sbomify.com/CVE-2017-16690/): Other in SAP Plant Connectivity (high 7.8)
- [CVE-2017-1669](https://insights.sbomify.com/CVE-2017-1669/): Information disclosure in Security Key Lifecycle Manager (low 3.7)
- [CVE-2017-16689](https://insights.sbomify.com/CVE-2017-16689/): Auth bypass in Trusted RFC connection (high 8.8)
- [CVE-2017-16687](https://insights.sbomify.com/CVE-2017-16687/): Information disclosure in SAP HANA extended application services (medium 5.3)
- [CVE-2017-16685](https://insights.sbomify.com/CVE-2017-16685/): Cross-site scripting in SAP Business Warehouse Universal Data Integration (medium 6.1)
- [CVE-2017-16684](https://insights.sbomify.com/CVE-2017-16684/): Auth bypass in SAP Business Intelligence Promotion Management Application (critical 9.8)
- [CVE-2017-16683](https://insights.sbomify.com/CVE-2017-16683/): Denial of service in SAP Business Objects Platform (medium 6.5)
- [CVE-2017-16682](https://insights.sbomify.com/CVE-2017-16682/): Code injection in SAP NetWeaver Internet Transaction Server (ITS) (high 7.2)
- [CVE-2017-16681](https://insights.sbomify.com/CVE-2017-16681/): Cross-site scripting in SAP Business Intelligence Promotion Management Application. (medium 6.1)
- [CVE-2017-16680](https://insights.sbomify.com/CVE-2017-16680/): Other in SAP HANA extended application services (high 7.5)
- [CVE-2017-1668](https://insights.sbomify.com/CVE-2017-1668/): Open redirect in Security Key Lifecycle Manager (medium 6.1)
- [CVE-2017-16679](https://insights.sbomify.com/CVE-2017-16679/): Open redirect in SAP Startup Service (medium 6.1)
- [CVE-2017-16678](https://insights.sbomify.com/CVE-2017-16678/): Server-side request forgery in SAP NetWeaver Knowledge Management Configuration Service (medium 4.7)
- [CVE-2017-16674](https://insights.sbomify.com/CVE-2017-16674/): Command injection in datto:windows agent (high 8.0)
- [CVE-2017-16673](https://insights.sbomify.com/CVE-2017-16673/): Auth bypass in datto:backup agent (medium 5.3)
- [CVE-2017-16672](https://insights.sbomify.com/CVE-2017-16672/): Denial of service in digium:asterisk (medium 5.9)
- [CVE-2017-16671](https://insights.sbomify.com/CVE-2017-16671/): Memory corruption in digium:asterisk (high 8.8)
- [CVE-2017-16670](https://insights.sbomify.com/CVE-2017-16670/): Code injection in smartbear:soapui (high 7.8)
- [CVE-2017-16669](https://insights.sbomify.com/CVE-2017-16669/): Memory corruption in debian:debian linux (high 8.8)
- [CVE-2017-16667](https://insights.sbomify.com/CVE-2017-16667/): Command injection in backintime project:backintime (high 7.8)
- [CVE-2017-16666](https://insights.sbomify.com/CVE-2017-16666/): Command injection in xplico:xplico (high 8.8)
- [CVE-2017-16665](https://insights.sbomify.com/CVE-2017-16665/): Cross-site scripting in remobjects:remoting sdk 9 (medium 6.1)
- [CVE-2017-16664](https://insights.sbomify.com/CVE-2017-16664/): Code injection in debian:debian linux (high 8.8)
- [CVE-2017-16663](https://insights.sbomify.com/CVE-2017-16663/): Integer overflow in sam2p project:sam2p (medium 5.5)
- [CVE-2017-16661](https://insights.sbomify.com/CVE-2017-16661/): Path traversal in cacti:cacti (medium 4.9)
- [CVE-2017-16660](https://insights.sbomify.com/CVE-2017-16660/): Code injection in cacti:cacti (high 7.2)
- [CVE-2017-1666](https://insights.sbomify.com/CVE-2017-1666/): XML external entity in Security Key Lifecycle Manager (high 8.1)
- [CVE-2017-16659](https://insights.sbomify.com/CVE-2017-16659/): Privilege escalation in anti-spam smtp proxy project:anti-spam smtp proxy (high 7.8)
- [CVE-2017-16654](https://insights.sbomify.com/CVE-2017-16654/): Symfony Directory Traversal (high 7.5)
- [CVE-2017-16653](https://insights.sbomify.com/CVE-2017-16653/): Symfony CSRF Vulnerability (medium 5.9)
- [CVE-2017-16652](https://insights.sbomify.com/CVE-2017-16652/): Symfony Open Redirect (medium 6.1)
- [CVE-2017-16651](https://insights.sbomify.com/CVE-2017-16651/): Roundcube Webmail File Disclosure (high 7.8, exploited in the wild)
- [CVE-2017-16650](https://insights.sbomify.com/CVE-2017-16650/): Denial of service in linux:linux kernel (medium 6.6)
- [CVE-2017-1665](https://insights.sbomify.com/CVE-2017-1665/): Weak cryptography in Security Key Lifecycle Manager (medium 5.9)
- [CVE-2017-16649](https://insights.sbomify.com/CVE-2017-16649/): Denial of service in linux:linux kernel (medium 6.6)
- [CVE-2017-16648](https://insights.sbomify.com/CVE-2017-16648/): Use after free in linux:linux kernel (medium 6.6)
- [CVE-2017-16647](https://insights.sbomify.com/CVE-2017-16647/): Null dereference in linux:linux kernel (medium 6.6)
- [CVE-2017-16646](https://insights.sbomify.com/CVE-2017-16646/): Null dereference in linux:linux kernel (medium 6.6)
- [CVE-2017-16645](https://insights.sbomify.com/CVE-2017-16645/): Memory corruption in linux:linux kernel (medium 6.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2017/page/82/