PUBLIÉES EN
novembre 2017
1 077 CVE, des plus récentes aux plus anciennes.
CVE-2017-1000405Les systèmes Linux utilisant des versions du noyau allant de 2.6.38 à 4.14 sont affectés par une faille dans la manière dont le noyau gère les « huge pages » en mémoire. Un utilisa…
7.0 ÉLEVÉE
CVE-2017-17081The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of servic…
6.5 MOYENNE
CVE-2017-17080elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate sizes of core notes, which allows remote attackers to cause…
5.5 MOYENNE
CVE-2017-1000406OpenDaylight Karaf (version 0.6.1-Carbon) ne vide pas son cache lorsqu'un utilisateur change son mot de passe, ce qui permet à l'ancien mot de passe de rester valide jusqu'au redém…
7.5 ÉLEVÉE
CVE-2017-3764A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with access to the LXCA we…
5.3 MOYENNE
CVE-2017-15116The rngapi_reset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service (NULL pointer dereference).
5.5 MOYENNE
CVE-2017-14949Les applications utilisant le framework Restlet (versions antérieures à la 2.3.12) sont vulnérables à une attaque par entité externe XML (XXE). Un attaquant distant non authentifié…
7.5 ÉLEVÉE
CVE-2017-14868Les applications Java utilisant le framework Restlet (plus précisément l'extension Jax-rs et le SimpleXMLProvider) sont vulnérables à une attaque par entité externe XML (XXE). Un a…
7.5 ÉLEVÉE
CVE-2017-17065Les routeurs D-Link DIR-605L (Modèle B) utilisant un micrologiciel antérieur à la version 2.11betaB06_hbrf sont concernés. Un attaquant non authentifié disposant d'un accès au rése…
7.5 ÉLEVÉE
CVE-2017-12631Les applications utilisant Apache CXF Fediz avec les plug-ins Spring 2, 3 ou 4 sont vulnérables à une attaque par falsification de requête intersite (CSRF). Un attaquant distant no…
8.8 ÉLEVÉE
CVE-2017-12372Le lecteur d'enregistrements réseau Cisco WebEx est vulnérable lors du traitement de fichiers d'enregistrement ARF ou WRF spécialement conçus. Un attaquant peut exécuter du code ar…
9.6 CRITIQUE
CVE-2017-12371Les utilisateurs du Cisco WebEx Network Recording Player sont exposés à un risque s'ils ouvrent des fichiers d'enregistrement ARF ou WRF spécialement conçus. Un attaquant peut décl…
9.6 CRITIQUE
CVE-2017-12370Le lecteur d'enregistrements réseau Cisco WebEx est vulnérable lors du traitement de fichiers d'enregistrement ARF ou WRF spécialement conçus. Un attaquant peut exécuter du code ar…
9.6 CRITIQUE
CVE-2017-12369Le lecteur d'enregistrements réseau Cisco WebEx est affecté lors du traitement de fichiers d'enregistrement ARF ou WRF spécifiquement conçus. Un attaquant peut exécuter du code arb…
9.6 CRITIQUE
CVE-2017-12368Le Cisco WebEx Network Recording Player est vulnérable lors du traitement de fichiers d'enregistrement ARF ou WRF spécialement conçus. Un attaquant peut exécuter du code arbitraire…
9.6 CRITIQUE
CVE-2017-12367Les utilisateurs du Cisco WebEx Network Recording Player sont concernés s'ils ouvrent un fichier d'enregistrement ARF ou WRF spécialement conçu. Un attaquant peut déclencher cela e…
9.6 CRITIQUE
CVE-2017-12366A vulnerability in Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected system. T…
6.1 MOYENNE
CVE-2017-12365A vulnerability in Cisco WebEx Event Center could allow an authenticated, remote attacker to view unlisted meeting information. The vulnerability is due to a design flaw in the pro…
4.3 MOYENNE
CVE-2017-12364A SQL Injection vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unauthorized Structured Query Language …
6.5 MOYENNE
CVE-2017-12363A vulnerability in Cisco WebEx Meeting Server could allow an unauthenticated, remote attacker to modify the welcome message of a meeting on an affected system. The vulnerability is…
5.3 MOYENNE
CVE-2017-12362A vulnerability in Cisco Meeting Server versions prior to 2.2.2 could allow an authenticated, remote attacker to cause the system to reload, resulting in a denial of service (DoS) …
6.5 MOYENNE
CVE-2017-12361A vulnerability in Cisco Jabber for Windows could allow an unauthenticated, local attacker to access sensitive communications made by the Jabber client. An attacker could exploit t…
4.0 MOYENNE
CVE-2017-12360A vulnerability in Cisco WebEx Network Recording Player for WebEx Recording Format (WRF) files could allow an attacker to cause a denial of service (DoS) condition. An attacker cou…
4.3 MOYENNE
CVE-2017-12359A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (.arf) files could allow an attacker to execute arbitrary code on a system. An…
6.5 MOYENNE
CVE-2017-12358A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an authenticated, remote attacker to conduct a cross-site scrip…
5.4 MOYENNE
CVE-2017-12357A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) …
5.4 MOYENNE
CVE-2017-12356A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an unauthenticated, remote attacker to conduct a cross-site scr…
6.1 MOYENNE
CVE-2017-12355A vulnerability in the Local Packet Transport Services (LPTS) ingress frame-processing functionality of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cau…
5.3 MOYENNE
CVE-2017-12354A vulnerability in the web-based interface of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to view sensitive information on an affected …
5.3 MOYENNE
CVE-2017-12353A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remo…
5.8 MOYENNE
CVE-2017-12352A vulnerability in certain system script files that are installed at boot time on Cisco Application Policy Infrastructure Controllers could allow an authenticated, local attacker t…
6.7 MOYENNE
CVE-2017-12351A vulnerability in the guest shell feature of Cisco NX-OS System Software could allow an authenticated, local attacker to read and send packets outside the scope of the guest shell…
5.7 MOYENNE
CVE-2017-12349Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a …
5.4 MOYENNE
CVE-2017-12348Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a …
5.4 MOYENNE
CVE-2017-12347Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect …
6.1 MOYENNE
CVE-2017-12346Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect …
6.1 MOYENNE
CVE-2017-12345Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect …
4.7 MOYENNE
CVE-2017-12344Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect …
6.1 MOYENNE
CVE-2017-12343Le logiciel Cisco Data Center Network Manager (DCNM) est sensible à plusieurs failles d'injection et de cross-site scripting. Un attaquant disposant d'identifiants d'utilisateur de…
8.8 ÉLEVÉE
CVE-2017-12342A vulnerability in the Open Agent Container (OAC) feature of Cisco Nexus Series Switches could allow an unauthenticated, local attacker to read and send packets outside the scope o…
6.8 MOYENNE
CVE-2017-12341A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. An attacker would need valid administr…
6.7 MOYENNE
CVE-2017-12340A vulnerability in Cisco NX-OS System Software running on Cisco MDS Multilayer Director Switches, Cisco Nexus 7000 Series Switches, and Cisco Nexus 7700 Series Switches could allow…
4.2 MOYENNE
CVE-2017-12339A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficie…
5.7 MOYENNE
CVE-2017-12338A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to read the contents of arbitrary files. The vulnerability is due to insuffic…
6.0 MOYENNE
CVE-2017-12336A vulnerability in the TCL scripting subsystem of Cisco NX-OS System Software could allow an authenticated, local attacker to escape the interactive TCL shell and gain unauthorized…
4.2 MOYENNE
CVE-2017-12335A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficie…
6.3 MOYENNE
CVE-2017-12334A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. An attacker would need valid administr…
6.7 MOYENNE
CVE-2017-12333A vulnerability in Cisco NX-OS System Software could allow an authenticated, local attacker to bypass signature verification when loading a software image. The vulnerability is due…
6.7 MOYENNE
CVE-2017-12332A vulnerability in Cisco NX-OS System Software patch installation could allow an authenticated, local attacker to write a file to arbitrary locations. The vulnerability is due to i…
4.4 MOYENNE
CVE-2017-12331A vulnerability in Cisco NX-OS System Software could allow an authenticated, local attacker to bypass signature verification when loading a software patch. The vulnerability is due…
6.7 MOYENNE