LanGuard reports



Supported OVAL Bulletins


More information on 2023 updates


ID:
CISEC:3713		 Title:
Windows Wireless WPA Group Key Reinstallation Vulnerability		 Type:
Software		 Bulletins:
CISEC:3713
CVE-2017-13080 		Severity:
Low
Description:
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.
Applies to:
 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3721		 Title:
Vulnerability in the MySQL Serverk component of Oracle MySQL (subcomponent: Server: Optimizer		 Type:
Software		 Bulletins:
CISEC:3721
CVE-2017-10294 		Severity:
Low
Description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3709		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication		 Type:
Software		 Bulletins:
CISEC:3709
CVE-2017-10268 		Severity:
Low
Description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data.
Applies to:
MySQL Server 5.5
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3718		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Auth		 Type:
Software		 Bulletins:
CISEC:3718
CVE-2017-10155 		Severity:
Medium
Description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Auth). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3719		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Performance Schema		 Type:
Software		 Bulletins:
CISEC:3719
CVE-2017-10283 		Severity:
Low
Description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Performance Schema). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3710		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer		 Type:
Software		 Bulletins:
CISEC:3710
CVE-2017-10279 		Severity:
Medium
Description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.36 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3707		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer		 Type:
Software		 Bulletins:
CISEC:3707
CVE-2017-10378 		Severity:
Medium
Description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.11 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server 5.5
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3717		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer		 Type:
Software		 Bulletins:
CISEC:3717
CVE-2017-10227 		Severity:
Medium
Description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3722		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Memcached		 Type:
Software		 Bulletins:
CISEC:3722
CVE-2017-10314 		Severity:
Medium
Description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Memcached). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3720		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB		 Type:
Software		 Bulletins:
CISEC:3720
CVE-2017-10286 		Severity:
Low
Description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3723		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: FTS		 Type:
Software		 Bulletins:
CISEC:3723
CVE-2017-10276 		Severity:
Medium
Description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: FTS). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3708		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL		 Type:
Software		 Bulletins:
CISEC:3708
CVE-2017-10384 		Severity:
Medium
Description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.57 and earlier 5.6.37 and earlier 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server 5.5
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3706		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs		 Type:
Software		 Bulletins:
CISEC:3706
CVE-2017-10379 		Severity:
Medium
Description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data.
Applies to:
MySQL Server 5.5
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3711		 Title:
Vulnerability in MySQL Server 5.6.35 and earlier, 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:3711
CVE-2017-3731 		Severity:
Medium
Description:
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.
Applies to:
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3724		 Title:
Type confusion vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3724
CVE-2017-16367 		Severity:
High
Description:
Type confusion vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3725		 Title:
Type confusion vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3725
CVE-2017-16379 		Severity:
High
Description:
Type confusion vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3727		 Title:
Type confusion vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3727
CVE-2017-16406 		Severity:
High
Description:
Type confusion vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3726		 Title:
Stack exhaustion vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3726
CVE-2017-16419 		Severity:
Medium
Description:
Stack exhaustion vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3675		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3675
CVE-2017-16403 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3714		 Title:
Microsoft Office Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3714
CVE-2017-11884 		Severity:
High
Description:
Microsoft Excel 2016 Click-to-Run (C2R) allows an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11882.
Applies to:
Microsoft Office 2016		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3705		 Title:
Microsoft Office Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3705
CVE-2017-11882 		Severity:
High
Description:
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.
Applies to:
Microsoft Office 2010
Microsoft Office 2013
Microsoft Office 2016		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3716		 Title:
Microsoft Excel Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:3716
CVE-2017-11877 		Severity:
Medium
Description:
Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1, Microsoft Excel 2016, Microsoft Office Compatibility Pack Service Pack 3, Microsoft Excel Viewer 2007 Service Pack 3, and Microsoft Excel 2016 for Mac allow a security feature bypass by not enforcing macro settings on an Excel document, aka "Microsoft Excel Security Feature Bypass Vulnerability".
Applies to:
Microsoft Excel 2007
Microsoft Excel 2010
Microsoft Excel 2013
Microsoft Excel 2016
Microsoft Office Compatibility Pack		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3715		 Title:
Microsoft Excel Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3715
CVE-2017-11878 		Severity:
High
Description:
Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1, Microsoft Excel 2016, Microsoft Office Compatibility Pack Service Pack 3, and Microsoft Excel Viewer 2007 Service Pack 3 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Excel Memory Corruption Vulnerability".
Applies to:
Microsoft Excel 2007
Microsoft Excel 2010
Microsoft Excel 2013
Microsoft Excel 2016
Microsoft Excel Viewer 2007
Microsoft Office Compatibility Pack		 Created:
2017-12-29		 Updated:
2023-01-26
ID:
CISEC:3654		 Title:
Windows Search Denial of Service Vulnerability		 Type:
Software		 Bulletins:
CISEC:3654
CVE-2017-11788 		Severity:
Medium
Description:
Windows Search in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows server, version 1709 allows an unauthenticated attacker to remotely send specially crafted messages that could cause a denial of service against the system due to improperly handing objects in memory, aka "Windows Search Denial of Service Vulnerability".
Applies to:
 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3648		 Title:
Windows Media Player Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3648
CVE-2017-11768 		Severity:
Low
Description:
Windows Media Player in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows remote attackers to test for the presence of files on disk via a specially crafted application. due to the way Windows Media Player discloses file information, aka "Windows Media Player Information Disclosure Vulnerability."
Applies to:
 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3655		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3655
CVE-2017-11851 		Severity:
Low
Description:
The Windows kernel component on Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709, allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11842, CVE-2017-11849, and CVE-2017-11853.
Applies to:
 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3656		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3656
CVE-2017-11849 		Severity:
Low
Description:
Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows an attacker to log in and run a specially crafted application due to the Windows kernel improperly initializing a memory address, aka "Windows Kernel Information Disclosure Vulnerability".
Applies to:
 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3657		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3657
CVE-2017-11847 		Severity:
High
Description:
Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows an attacker to run arbitrary code in kernel mode, install programs, view, change or delete data, and create new accounts with full user rights due to improperly handing objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3658		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3658
CVE-2017-11853 		Severity:
Medium
Description:
Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows an attacker to log in and run a specially crafted application due to the Windows kernel improperly initializing a memory address, aka "Windows Kernel Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11842, CVE-2017-11849, and CVE-2017-11851.
Applies to:
 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3653		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3653
CVE-2017-11842 		Severity:
Low
Description:
Windows kernel in Windows 8.1 and RT 8.1, Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows an attacker to log in and run a specially crafted application due to the Windows kernel improperly initializing a memory address, aka "Windows Kernel Information Disclosure Vulnerability".
Applies to:
 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3642		 Title:
Windows Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3642
CVE-2017-11831 		Severity:
Medium
Description:
Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016, and Windows Server, version 1709 allows an attacker to log on to an affected system, and run a specially crafted application that can compromise the user's system due to how the Windows kernel initializes memory, aka "Windows Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11880.
Applies to:
 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3644		 Title:
Windows Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3644
CVE-2017-11880 		Severity:
Low
Description:
Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to run a specially crafted application and obtain information to further compromise the user's system due to the Windows kernel improperly initializing objects in memory, aka "Windows Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11831.
Applies to:
 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3652		 Title:
Windows GDI Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3652
CVE-2017-11852 		Severity:
Low
Description:
Microsoft GDI Component in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to log on to an affected system and run a specially crafted application to compromise the user's system, due improperly disclosing kernel memory addresses, aka "Windows GDI Information Disclosure Vulnerability".
Applies to:
 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3641		 Title:
Windows EOT Font Engine Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3641
CVE-2017-11835 		Severity:
Low
Description:
Microsoft graphics in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to potentially read data that was not intended to be disclosed due to the way that the Microsoft Windows Embedded OpenType (EOT) font engine parses specially crafted embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11832.
Applies to:
 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3643		 Title:
Windows EOT Font Engine Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3643
CVE-2017-11832 		Severity:
Low
Description:
The Microsoft Windows embedded OpenType (EOT) font engine in Windows 7 SP1, Windows Server 2008 SP2 and 2008 R2 SP1, and Windows Server 2012 allows an attacker to potentially read data that was not intended to be disclosed, due to the way that the Microsoft Windows EOT font engine parses specially crafted embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability." This CVE ID is unique from CVE-2017-11835.
Applies to:
 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3635		 Title:
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAX-WS		 Type:
Software		 Bulletins:
CISEC:3635
CVE-2017-10350 		Severity:
Medium
Description:
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAX-WS). Supported versions that are affected are Java SE: 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Applies to:
Java Development Kit 1.7
Java Development Kit 1.8
Java Development Kit 1.9
Java Runtime Environment 1.7
Java Runtime Environment 1.8
Java Runtime Environment 1.9		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3637		 Title:
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Javadoc		 Type:
Software		 Bulletins:
CISEC:3637
CVE-2017-10293 		Severity:
Medium
Description:
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Javadoc). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Applies to:
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Development Kit 1.9
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8
Java Runtime Environment 1.9		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3638		 Title:
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment		 Type:
Software		 Bulletins:
CISEC:3638
CVE-2017-10309 		Severity:
Medium
Description:
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 8u144 and 9. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Applies to:
Java Development Kit 1.8
Java Development Kit 1.9
Java Runtime Environment 1.8
Java Runtime Environment 1.9		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3636		 Title:
Vulnerability in Java SE: 7u151, 8u144, 9; Java SE Embedded: 8u144; JRockit: R28.3.15		 Type:
Software		 Bulletins:
CISEC:3636
CVE-2016-10165 		Severity:
Medium
Description:
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
Applies to:
JRockit R28
Java Development Kit 1.7
Java Development Kit 1.8
Java Development Kit 1.9
Java Runtime Environment 1.7
Java Runtime Environment 1.8
Java Runtime Environment 1.9		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3639		 Title:
Stack overflow in V8		 Type:
Web		 Bulletins:
CISEC:3639
CVE-2017-15396 		Severity:
Medium
Description:
Stack overflow in V8.
Applies to:
Google Chrome		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3669		 Title:
Security bypass vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3669
CVE-2017-16369 		Severity:
Medium
Description:
Security bypass vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3674		 Title:
Security bypass vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3674
CVE-2017-16380 		Severity:
High
Description:
Security bypass vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3684		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3684
CVE-2017-11858 		Severity:
High
Description:
ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how Microsoft browsers handle objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3682		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3682
CVE-2017-11862 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Windows 10 1709 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.
Applies to:
Microsoft Edge		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3683		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3683
CVE-2017-11861 		Severity:
High
Description:
Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.
Applies to:
Microsoft Edge		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3685		 Title:
Scripting Engine Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3685
CVE-2017-11791 		Severity:
Low
Description:
ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to obtain information to further compromise the user's system, due to how the scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11834.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3659		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3659
CVE-2017-16401 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3660		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3660
CVE-2017-16362 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3661		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3661
CVE-2017-16399 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3662		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3662
CVE-2017-16394 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3663		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3663
CVE-2017-16418 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3664		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3664
CVE-2017-16405 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3665		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3665
CVE-2017-16402 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3666		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3666
CVE-2017-16400 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3667		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3667
CVE-2017-16404 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3668		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3668
CVE-2017-16414 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3670		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3670
CVE-2017-16409 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3671		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3671
CVE-2017-16412 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3672		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3672
CVE-2017-16376 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3673		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3673
CVE-2017-16397 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3676		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3676
CVE-2017-16417 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3677		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3677
CVE-2017-11293 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3678		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3678
CVE-2017-16370 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3679		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3679
CVE-2017-16382 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3680		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3680
CVE-2017-16420 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3681		 Title:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier		 Type:
Software		 Bulletins:
CISEC:3681
CVE-2017-16408 		Severity:
High
Description:
Out-of-bounds read vulnerability in Adobe Acrobat Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3704		 Title:
Microsoft Word Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3704
CVE-2017-11854 		Severity:
High
Description:
Microsoft Word 2007 Service Pack 3, Microsoft Word 2010 Service Pack 2, Microsoft Office 2010 Service Pack 2, and Microsoft Office Compatibility Pack Service Pack 3 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Word Memory Corruption Vulnerability".
Applies to:
Microsoft Office 2010
Microsoft Office Compatibility Pack
Microsoft Word 2007
Microsoft Word 2010		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3650		 Title:
Microsoft Project Server Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:3650
CVE-2017-11876 		Severity:
Medium
Description:
Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not authorized to read, use the victim's identity to take actions on the web application on behalf of the victim, such as change permissions and delete content, and inject malicious content in the browser of the victim, aka "Microsoft Project Server Elevation of Privilege Vulnerability".
Applies to:
Microsoft Project Server 2013
Microsoft SharePoint Enterprise Server 2016		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3651		 Title:
Microsoft Graphics Component Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3651
CVE-2017-11850 		Severity:
Low
Description:
Microsoft Graphics Component in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to log on to an affected system and run a specially crafted application due to improper handling of objects in memory, aka "Microsoft Graphics Component Information Disclosure Vulnerability".
Applies to:
 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3649		 Title:
Microsoft Browser Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3649
CVE-2017-11827 		Severity:
High
Description:
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how Microsoft browsers handle objects in memory, aka "Microsoft Browser Memory Corruption Vulnerability".
Applies to:
Internet Explorer 10
Internet Explorer 11
Microsoft Edge		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3646		 Title:
Internet Explorer Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3646
CVE-2017-11855 		Severity:
High
Description:
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how Internet Explorer handles objects in memory, aka "Internet Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11856.
Applies to:
Internet Explorer 10
Internet Explorer 11
Internet Explorer 9		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3647		 Title:
Internet Explorer Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3647
CVE-2017-11856 		Severity:
High
Description:
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how Internet Explorer handles objects in memory, aka "Internet Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11855.
Applies to:
Internet Explorer 11		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3645		 Title:
Internet Explorer Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3645
CVE-2017-11848 		Severity:
Medium
Description:
Internet Explorer in Microsoft Microsoft Windows 7 SP1, Windows Server 2008 SP2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to detect the navigation of the user leaving a maliciously crafted page, due to how page content is handled by Internet Explorer, aka "Internet Explorer Information Disclosure Vulnerability".
Applies to:
Internet Explorer 10
Internet Explorer 11
Internet Explorer 9		 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3640		 Title:
Device Guard Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:3640
CVE-2017-11830 		Severity:
Medium
Description:
Device Guard in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows an attacker to make an unsigned file appear to be signed, due to a security feature bypass, aka "Device Guard Security Feature Bypass Vulnerability".
Applies to:
 Created:
2017-12-22		 Updated:
2023-01-26
ID:
CISEC:3634		 Title:
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Smart Card IO		 Type:
Software		 Bulletins:
CISEC:3634
CVE-2017-10274 		Severity:
Medium
Description:
Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data as well as unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N).
Applies to:
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Development Kit 1.9
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8
Java Runtime Environment 1.9		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3613		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3613
CVE-2017-11846 		Severity:
High
Description:
ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3614		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3614
CVE-2017-11866 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.
Applies to:
Microsoft Edge		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3615		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3615
CVE-2017-11871 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, and CVE-2017-11873.
Applies to:
Microsoft Edge		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3616		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3616
CVE-2017-11843 		Severity:
High
Description:
ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3617		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3617
CVE-2017-11836 		Severity:
High
Description:
ChakraCore, and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to take control of an affected system, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.
Applies to:
Microsoft Edge		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3618		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3618
CVE-2017-11841 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.
Applies to:
Microsoft Edge		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3619		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3619
CVE-2017-11869 		Severity:
High
Description:
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how Microsoft browsers handle objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3620		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3620
CVE-2017-11838 		Severity:
High
Description:
ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 11		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3621		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3621
CVE-2017-11839 		Severity:
High
Description:
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to take control of an affected system, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.
Applies to:
Microsoft Edge		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3622		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3622
CVE-2017-11840 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.
Applies to:
Microsoft Edge		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3623		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3623
CVE-2017-11870 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11871, and CVE-2017-11873.
Applies to:
Microsoft Edge		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3624		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3624
CVE-2017-11873 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, and CVE-2017-11871.
Applies to:
Microsoft Edge		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3626		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3626
CVE-2017-11837 		Severity:
High
Description:
ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 11		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3625		 Title:
Scripting Engine Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3625
CVE-2017-11834 		Severity:
Low
Description:
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to obtain information to further compromise the user's system, due to how the scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11791.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3627		 Title:
Microsoft Edge Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:3627
CVE-2017-11874 		Severity:
Low
Description:
Microsoft Edge in Microsoft Windows 10 1703, 1709, Windows Server, version 1709, and ChakraCore allows an attacker to bypass Control Flow Guard (CFG) to run arbitrary code on a target system, due to how Microsoft Edge handles accessing memory in code compiled by the Edge Just-In-Time (JIT) compiler, aka "Microsoft Edge Security Feature Bypass Vulnerability". This CVE ID is unique from CVE-2017-11863 and CVE-2017-11872.
Applies to:
Microsoft Edge		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3630		 Title:
Microsoft Edge Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:3630
CVE-2017-11872 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to force the browser to send data that would otherwise be restricted to a destination website of the attacker's choice, due to how Microsoft Edge handles redirect requests, aka "Microsoft Edge Security Feature Bypass Vulnerability". This CVE ID is unique from CVE-2017-11863 and CVE-2017-11874.
Applies to:
Microsoft Edge		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3632		 Title:
Microsoft Edge Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:3632
CVE-2017-11863 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to trick a user into loading a page containing malicious content, due to how the Edge Content Security Policy (CSP) validates documents, aka "Microsoft Edge Security Feature Bypass Vulnerability". This CVE ID is unique from CVE-2017-11872 and CVE-2017-11874.
Applies to:
Microsoft Edge		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3629		 Title:
Microsoft Edge Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3629
CVE-2017-11845 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how Microsoft Edge handles objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability".
Applies to:
Microsoft Edge		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3628		 Title:
Microsoft Edge Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3628
CVE-2017-11844 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 1703, 1709 and Windows Server, version 1709 allows an attacker to obtain information to further compromise the user's system, due to how Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11803 and CVE-2017-11833.
Applies to:
Microsoft Edge		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3631		 Title:
Microsoft Edge Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3631
CVE-2017-11803 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 1703, 1709 and Windows Server, version 1709 allows an attacker to obtain information to further compromise the user's system, due to how Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11833 and CVE-2017-11844.
Applies to:
Microsoft Edge		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3633		 Title:
Microsoft Edge Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3633
CVE-2017-11833 		Severity:
Low
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to determine the origin of all webpages in the affected browser, due to how Microsoft Edge handles cross-origin requests, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11803 and CVE-2017-11844.
Applies to:
Microsoft Edge		 Created:
2017-12-15		 Updated:
2023-01-26
ID:
CISEC:3579		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication		 Type:
Software		 Bulletins:
CISEC:3579
CVE-2017-10165 		Severity:
Medium
Description:
Supported versions that are affected are 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3576		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: FTS		 Type:
Software		 Bulletins:
CISEC:3576
CVE-2017-10311 		Severity:
Medium
Description:
Supported versions that are affected are 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3577		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: FTS		 Type:
Software		 Bulletins:
CISEC:3577
CVE-2017-10320 		Severity:
Medium
Description:
Supported versions that are affected are 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3578		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Group Replication GCS		 Type:
Software		 Bulletins:
CISEC:3578
CVE-2017-10313 		Severity:
Medium
Description:
Supported versions that are affected are 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3553		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL		 Type:
Software		 Bulletins:
CISEC:3553
CVE-2017-10365 		Severity:
Medium
Description:
Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server.
Applies to:
MySQL Server		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3554		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL		 Type:
Software		 Bulletins:
CISEC:3554
CVE-2017-10284 		Severity:
Medium
Description:
Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3555		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL		 Type:
Software		 Bulletins:
CISEC:3555
CVE-2017-10296 		Severity:
Medium
Description:
Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3575		 Title:
Vulnerability in the MySQL Server component of Oracle MySQL		 Type:
Software		 Bulletins:
CISEC:3575
CVE-2017-10167 		Severity:
Medium
Description:
Supported versions that are affected are 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Applies to:
MySQL Server		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3573		 Title:
Vulnerability in Java SE: 6u161, 7u151, 8u144; Java SE Embedded: 8u144		 Type:
Software		 Bulletins:
CISEC:3573
CVE-2016-9841 		Severity:
High
Description:
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
Applies to:
Java Development Kit 6
Java Development Kit 7
Java Development Kit 8
Java Runtime Environment 6
Java Runtime Environment 7
Java Runtime Environment 8		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3562		 Title:
Vulnerability in Java SE: 6u161, 7u151, 8u144, 9; Java SE Embedded: 8u144; JRockit: R28.3.15		 Type:
Software		 Bulletins:
CISEC:3562
CVE-2017-10345 		Severity:
Low
Description:
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).
Applies to:
JRockit R28
Java Development Kit 6
Java Development Kit 7
Java Development Kit 8
Java Development Kit 9
Java Runtime Environment 6
Java Runtime Environment 7
Java Runtime Environment 8
Java Runtime Environment 9		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3563		 Title:
Vulnerability in Java SE: 6u161, 7u151, 8u144, 9; Java SE Embedded: 8u144; JRockit: R28.3.15		 Type:
Software		 Bulletins:
CISEC:3563
CVE-2017-10356 		Severity:
Low
Description:
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, Java SE Embedded, JRockit executes to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 6.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Applies to:
JRockit R28
Java Development Kit 6
Java Development Kit 7
Java Development Kit 8
Java Development Kit 9
Java Runtime Environment 6
Java Runtime Environment 7
Java Runtime Environment 8
Java Runtime Environment 9		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3565		 Title:
Vulnerability in Java SE: 6u161, 7u151, 8u144, 9; Java SE Embedded: 8u144; JRockit: R28.3.15		 Type:
Software		 Bulletins:
CISEC:3565
CVE-2017-10355 		Severity:
Medium
Description:
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Applies to:
JRockit R28
Java Development Kit 6
Java Development Kit 7
Java Development Kit 8
Java Development Kit 9
Java Runtime Environment 6
Java Runtime Environment 7
Java Runtime Environment 8
Java Runtime Environment 9		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3567		 Title:
Vulnerability in Java SE: 6u161, 7u151, 8u144, 9; Java SE Embedded: 8u144; JRockit: R28.3.15		 Type:
Software		 Bulletins:
CISEC:3567
CVE-2017-10281 		Severity:
Medium
Description:
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Applies to:
JRockit R28
Java Development Kit 6
Java Development Kit 7
Java Development Kit 8
Java Development Kit 9
Java Runtime Environment 6
Java Runtime Environment 7
Java Runtime Environment 8
Java Runtime Environment 9		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3574		 Title:
Vulnerability in Java SE: 6u161, 7u151, 8u144, 9; Java SE Embedded: 8u144; JRockit: R28.3.15		 Type:
Software		 Bulletins:
CISEC:3574
CVE-2017-10295 		Severity:
Medium
Description:
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.0 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N).
Applies to:
JRockit R28
Java Development Kit 6
Java Development Kit 7
Java Development Kit 8
Java Development Kit 9
Java Runtime Environment 6
Java Runtime Environment 7
Java Runtime Environment 8
Java Runtime Environment 9		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3564		 Title:
Vulnerability in Java SE: 6u161, 7u151, 8u144, 9; Java SE Embedded: 8u144		 Type:
Software		 Bulletins:
CISEC:3564
CVE-2017-10285 		Severity:
Medium
Description:
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
Applies to:
Java Development Kit 6
Java Development Kit 7
Java Development Kit 8
Java Development Kit 9
Java Runtime Environment 6
Java Runtime Environment 7
Java Runtime Environment 8
Java Runtime Environment 9		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3566		 Title:
Vulnerability in Java SE: 6u161, 7u151, 8u144, 9; Java SE Embedded: 8u144		 Type:
Software		 Bulletins:
CISEC:3566
CVE-2017-10346 		Severity:
Medium
Description:
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
Applies to:
Java Development Kit 6
Java Development Kit 7
Java Development Kit 8
Java Development Kit 9
Java Runtime Environment 6
Java Runtime Environment 7
Java Runtime Environment 8
Java Runtime Environment 9		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3568		 Title:
Vulnerability in Java SE: 6u161, 7u151, 8u144, 9; Java SE Embedded: 8u144		 Type:
Software		 Bulletins:
CISEC:3568
CVE-2017-10357 		Severity:
Medium
Description:
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Applies to:
Java Development Kit 6
Java Development Kit 7
Java Development Kit 8
Java Development Kit 9
Java Runtime Environment 6
Java Runtime Environment 7
Java Runtime Environment 8
Java Runtime Environment 9		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3569		 Title:
Vulnerability in Java SE: 6u161, 7u151, 8u144, 9; Java SE Embedded: 8u144		 Type:
Software		 Bulletins:
CISEC:3569
CVE-2017-10349 		Severity:
Medium
Description:
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Applies to:
Java Development Kit 6
Java Development Kit 7
Java Development Kit 8
Java Development Kit 9
Java Runtime Environment 6
Java Runtime Environment 7
Java Runtime Environment 8
Java Runtime Environment 9		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3570		 Title:
Vulnerability in Java SE: 6u161, 7u151, 8u144, 9; Java SE Embedded: 8u144		 Type:
Software		 Bulletins:
CISEC:3570
CVE-2017-10388 		Severity:
Medium
Description:
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: Applies to the Java SE Kerberos client. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Applies to:
Java Development Kit 6
Java Development Kit 7
Java Development Kit 8
Java Development Kit 9
Java Runtime Environment 6
Java Runtime Environment 7
Java Runtime Environment 8
Java Runtime Environment 9		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3571		 Title:
Vulnerability in Java SE: 6u161, 7u151, 8u144, 9; Java SE Embedded: 8u144		 Type:
Software		 Bulletins:
CISEC:3571
CVE-2017-10348 		Severity:
Medium
Description:
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Applies to:
Java Development Kit 6
Java Development Kit 7
Java Development Kit 8
Java Development Kit 9
Java Runtime Environment 6
Java Runtime Environment 7
Java Runtime Environment 8
Java Runtime Environment 9		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3572		 Title:
Vulnerability in Java SE: 6u161, 7u151, 8u144, 9; Java SE Embedded: 8u144		 Type:
Software		 Bulletins:
CISEC:3572
CVE-2017-10347 		Severity:
Medium
Description:
Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Applies to:
Java Development Kit 6
Java Development Kit 7
Java Development Kit 8
Java Development Kit 9
Java Runtime Environment 6
Java Runtime Environment 7
Java Runtime Environment 8
Java Runtime Environment 9		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3559		 Title:
URL spoofing in OmniBox		 Type:
Web		 Bulletins:
CISEC:3559
CVE-2017-15390 		Severity:
Medium
Description:
Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
Applies to:
Google Chrome		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3558		 Title:
URL spoofing in extensions UI		 Type:
Web		 Bulletins:
CISEC:3558
CVE-2017-15394 		Severity:
Medium
Description:
Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing in permission dialogs via IDN homographs in a crafted Chrome Extension.
Applies to:
Google Chrome		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3560		 Title:
Referrer leak in Devtools		 Type:
Web		 Bulletins:
CISEC:3560
CVE-2017-15393 		Severity:
Medium
Description:
Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak.
Applies to:
Google Chrome		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3557		 Title:
Null pointer dereference in ImageCapture		 Type:
Web		 Bulletins:
CISEC:3557
CVE-2017-15395 		Severity:
Medium
Description:
A use after free in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka an ImageCapture NULL pointer dereference.
Applies to:
Google Chrome		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3561		 Title:
Incorrect registry key handling in PlatformIntegration		 Type:
Web		 Bulletins:
CISEC:3561
CVE-2017-15392 		Severity:
Medium
Description:
Insufficient data validation in V8 in Google Chrome prior to 62.0.3202.62 allowed an attacker who can write to the Windows Registry to potentially exploit heap corruption via a crafted Windows Registry entry, related to PlatformIntegration.
Applies to:
Google Chrome		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3544		 Title:
Incorrect handling of picture ID in WebRTC		 Type:
Web		 Bulletins:
CISEC:3544
CVE-2017-5068 		Severity:
Medium
Description:
Incorrect handling of picture ID in WebRTC in Google Chrome prior to 58.0.3029.96 for Mac, Windows, and Linux allowed a remote attacker to trigger a race condition via a crafted HTML page.
Applies to:
Google Chrome		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3556		 Title:
Extension limitation bypass in Extensions		 Type:
Web		 Bulletins:
CISEC:3556
CVE-2017-15391 		Severity:
Medium
Description:
Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to access Extension pages without authorisation via a crafted HTML page.
Applies to:
Google Chrome		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3550		 Title:
Blink in Google Chrome		 Type:
Web		 Bulletins:
CISEC:3550
CVE-2017-5027 		Severity:
Medium
Description:
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inline content security policy, which allowed a remote attacker to bypass content security policy via a crafted HTML page.
Applies to:
Google Chrome		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3545		 Title:
An out-of-bounds read in V8		 Type:
Web		 Bulletins:
CISEC:3545
CVE-2017-5053 		Severity:
Medium
Description:
An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to Array.prototype.indexOf.
Applies to:
Google Chrome		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3547		 Title:
An out-of-bounds read in V8		 Type:
Web		 Bulletins:
CISEC:3547
CVE-2017-5054 		Severity:
Medium
Description:
An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to obtain heap memory contents via a crafted HTML page.
Applies to:
Google Chrome		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3546		 Title:
An incorrect assumption about block structure in Blink		 Type:
Web		 Bulletins:
CISEC:3546
CVE-2017-5052 		Severity:
Medium
Description:
An incorrect assumption about block structure in Blink in Google Chrome prior to 57.0.2987.133 for Mac, Windows, and Linux, and 57.0.2987.132 for Android, allowed a remote attacker to potentially exploit memory corruption via a crafted HTML page that triggers improper casting.
Applies to:
Google Chrome		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3543		 Title:
Address spoofing in Omnibox		 Type:
Web		 Bulletins:
CISEC:3543
CVE-2017-5086 		Severity:
Medium
Description:
Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Windows and Mac allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
Applies to:
Google Chrome		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3548		 Title:
A use after free in printing		 Type:
Web		 Bulletins:
CISEC:3548
CVE-2017-5055 		Severity:
High
Description:
A use after free in printing in Google Chrome prior to 57.0.2987.133 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Applies to:
Google Chrome		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3549		 Title:
A use after free in Blink		 Type:
Web		 Bulletins:
CISEC:3549
CVE-2017-5056 		Severity:
Medium
Description:
A use after free in Blink in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Applies to:
Google Chrome		 Created:
2017-12-08		 Updated:
2023-01-26
ID:
CISEC:3518		 Title:
URL spoofing in OmniBox		 Type:
Web		 Bulletins:
CISEC:3518
CVE-2017-15389 		Severity:
Medium
Description:
URL spoofing in OmniBox.
Applies to:
Google Chrome		 Created:
2017-12-01		 Updated:
2023-01-26
ID:
CISEC:3519		 Title:
UI spoofing in Blink		 Type:
Web		 Bulletins:
CISEC:3519
CVE-2017-15386 		Severity:
Medium
Description:
UI spoofing in Blink.
Applies to:
Google Chrome		 Created:
2017-12-01		 Updated:
2023-01-26
ID:
CISEC:3523		 Title:
The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY...		 Type:
Services		 Bulletins:
CISEC:3523
CVE-2016-0703 		Severity:
Medium
Description:
The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.
Applies to:
OpenSSL		 Created:
2017-12-01		 Updated:
2023-01-26
ID:
CISEC:3525		 Title:
The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange		 Type:
Services		 Bulletins:
CISEC:3525
CVE-2016-0701 		Severity:
Low
Description:
The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.
Applies to:
OpenSSL		 Created:
2017-12-01		 Updated:
2023-01-26
ID:
CISEC:3520		 Title:
Out of bounds write in Skia		 Type:
Web		 Bulletins:
CISEC:3520
CVE-2017-5133 		Severity:
Medium
Description:
Out of bounds write in Skia.
Applies to:
Google Chrome		 Created:
2017-12-01		 Updated:
2023-01-26
ID:
CISEC:3522		 Title:
Out of bounds write in Skia		 Type:
Web		 Bulletins:
CISEC:3522
CVE-2017-5131 		Severity:
Medium
Description:
Out of bounds write in Skia.
Applies to:
Google Chrome		 Created:
2017-12-01		 Updated:
2023-01-26
ID:
CISEC:3521		 Title:
Out of bounds read in Skia		 Type:
Web		 Bulletins:
CISEC:3521
CVE-2017-15388 		Severity:
Medium
Description:
Out of bounds read in Skia.
Applies to:
Google Chrome		 Created:
2017-12-01		 Updated:
2023-01-26
ID:
CISEC:3516		 Title:
Heap overflow in libxml2		 Type:
Web		 Bulletins:
CISEC:3516
CVE-2017-5130 		Severity:
Medium
Description:
Heap overflow in libxml2.
Applies to:
Google Chrome		 Created:
2017-12-01		 Updated:
2023-01-26
ID:
CISEC:3517		 Title:
Content security bypass		 Type:
Web		 Bulletins:
CISEC:3517
CVE-2017-15387 		Severity:
Medium
Description:
Content security bypass.
Applies to:
Google Chrome		 Created:
2017-12-01		 Updated:
2023-01-26
ID:
CISEC:3524		 Title:
An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites...		 Type:
Services		 Bulletins:
CISEC:3524
CVE-2016-0704 		Severity:
Medium
Description:
An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.
Applies to:
OpenSSL		 Created:
2017-12-01		 Updated:
2023-01-26
ID:
CISEC:3502		 Title:
UXSS with MHTML		 Type:
Web		 Bulletins:
CISEC:3502
CVE-2017-5124 		Severity:
Medium
Description:
UXSS with MHTML
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3498		 Title:
Use after free in WebAudio		 Type:
Web		 Bulletins:
CISEC:3498
CVE-2017-5129 		Severity:
Medium
Description:
Use after free in WebAudio
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3495		 Title:
Use after free in PDFium		 Type:
Web		 Bulletins:
CISEC:3495
CVE-2017-5126 		Severity:
Medium
Description:
Use after free in PDFium
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3503		 Title:
Use after free in PDFium		 Type:
Web		 Bulletins:
CISEC:3503
CVE-2017-5127 		Severity:
Medium
Description:
Use after free in PDFium
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3492		 Title:
Use after free in Chrome Apps		 Type:
Web		 Bulletins:
CISEC:3492
CVE-2017-5100 		Severity:
Medium
Description:
Use after free in Chrome Apps.
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3493		 Title:
URL spoofing in OmniBox		 Type:
Web		 Bulletins:
CISEC:3493
CVE-2017-5106 		Severity:
Medium
Description:
URL spoofing in OmniBox.
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3485		 Title:
URL spoofing in OmniBox		 Type:
Web		 Bulletins:
CISEC:3485
CVE-2017-5101 		Severity:
Medium
Description:
URL spoofing in OmniBox.
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3490		 Title:
URL spoofing in OmniBox		 Type:
Web		 Bulletins:
CISEC:3490
CVE-2017-5105 		Severity:
Medium
Description:
URL spoofing in OmniBox.
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3488		 Title:
Uninitialized use in Skia		 Type:
Web		 Bulletins:
CISEC:3488
CVE-2017-5103 		Severity:
Medium
Description:
Uninitialized use in Skia.
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3489		 Title:
Uninitialized use in Skia		 Type:
Web		 Bulletins:
CISEC:3489
CVE-2017-5102 		Severity:
Medium
Description:
Uninitialized use in Skia.
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3491		 Title:
UI spoofing in payments dialog		 Type:
Web		 Bulletins:
CISEC:3491
CVE-2017-5110 		Severity:
Medium
Description:
UI spoofing in browser.
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3494		 Title:
UI spoofing in browser		 Type:
Web		 Bulletins:
CISEC:3494
CVE-2017-5109 		Severity:
Medium
Description:
UI spoofing in browser.
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3486		 Title:
Type confusion in PDFium		 Type:
Web		 Bulletins:
CISEC:3486
CVE-2017-5108 		Severity:
Medium
Description:
Type confusion in PDFium.
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3512		 Title:
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message		 Type:
Services		 Bulletins:
CISEC:3512
CVE-2016-0800 		Severity:
Medium
Description:
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.
Applies to:
OpenSSL		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3513		 Title:
The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times		 Type:
Services		 Bulletins:
CISEC:3513
CVE-2016-0702 		Severity:
Low
Description:
The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack.
Applies to:
OpenSSL		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3514		 Title:
The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths		 Type:
Services		 Bulletins:
CISEC:3514
CVE-2016-0799 		Severity:
High
Description:
The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842.
Applies to:
OpenSSL		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3496		 Title:
Out of bounds read in V8		 Type:
Web		 Bulletins:
CISEC:3496
CVE-2017-5088 		Severity:
Medium
Description:
Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3515		 Title:
Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service		 Type:
Services		 Bulletins:
CISEC:3515
CVE-2016-0797 		Severity:
Medium
Description:
Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.
Applies to:
OpenSSL		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3511		 Title:
Memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service		 Type:
Services		 Bulletins:
CISEC:3511
CVE-2016-0798 		Severity:
High
Description:
Memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory consumption) by providing an invalid username in a connection attempt, related to apps/s_server.c and crypto/srp/srp_vfy.c.
Applies to:
OpenSSL		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3497		 Title:
Incorrect stack manipulation in WebAssembly		 Type:
Web		 Bulletins:
CISEC:3497
CVE-2017-5132 		Severity:
Medium
Description:
Incorrect stack manipulation in WebAssembly
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3504		 Title:
Heap overflow in WebGL		 Type:
Web		 Bulletins:
CISEC:3504
CVE-2017-5128 		Severity:
Medium
Description:
Heap overflow in WebGL
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3501		 Title:
Heap overflow in Skia		 Type:
Web		 Bulletins:
CISEC:3501
CVE-2017-5125 		Severity:
Medium
Description:
Heap overflow in Skia
Applies to:
Google Chrome		 Created:
2017-11-24		 Updated:
2023-01-26
ID:
CISEC:3426		 Title:
Windows Update Delivery Optimization Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:3426
CVE-2017-11829 		Severity:
Low
Description:
Microsoft Windows 10 allows an elevation of privilege vulnerability when the Windows Update Delivery Optimization does not properly enforce file share permissions.
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3421		 Title:
Windows Subsystem for Linux Denial of Service Vulnerability		 Type:
Software		 Bulletins:
CISEC:3421
CVE-2017-8703 		Severity:
Medium
Description:
The Microsoft Windows Subsystem for Linux on Microsoft Windows 10 1703 allows a denial of service vulnerability when it improperly handles objects in memory, aka "Windows Subsystem for Linux Denial of Service Vulnerability".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3465		 Title:
Windows Storage Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:3465
CVE-2017-11818 		Severity:
Medium
Description:
The Microsoft Windows Storage component on Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a security feature bypass vulnerability when it fails to validate an integrity-level check, aka "Windows Storage Security Feature Bypass Vulnerability".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3410		 Title:
Windows SMB Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3410
CVE-2017-11780 		Severity:
Medium
Description:
The Server Message Block 1.0 (SMBv1) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows a remote code execution vulnerability when it fails to properly handle certain requests, aka "Windows SMB Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3416		 Title:
Windows SMB Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3416
CVE-2017-11815 		Severity:
Low
Description:
The Microsoft Server Block Message (SMB) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows an information disclosure vulnerability in the way that it handles certain requests, aka "Windows SMB Information Disclosure Vulnerability".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3466		 Title:
Windows SMB Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:3466
CVE-2017-11782 		Severity:
Medium
Description:
The Microsoft Server Block Message (SMB) on Microsoft Windows 10 1607 and Windows Server 2016, allows an elevation of privilege vulnerability when an attacker sends specially crafted requests to the server, aka "Windows SMB Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3413		 Title:
Windows SMB Denial of Service Vulnerability		 Type:
Software		 Bulletins:
CISEC:3413
CVE-2017-11781 		Severity:
High
Description:
The Microsoft Server Block Message (SMB) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows a denial of service vulnerability when an attacker sends specially crafted requests to the server, aka "Windows SMB Denial of Service Vulnerability".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3429		 Title:
Windows Shell Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3429
CVE-2017-11819 		Severity:
High
Description:
Microsoft Windows 7 SP1 allows an attacker to execute arbitrary code in the context of the current user, due to how Microsoft browsers handle objects in memory, aka "Windows Shell Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3427		 Title:
Windows Shell Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3427
CVE-2017-8727 		Severity:
High
Description:
Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user, due to how Microsoft Windows Text Services Framework handles objects in memory, aka "Windows Shell Memory Corruption Vulnerability".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3432		 Title:
Windows Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:3432
CVE-2017-8715 		Severity:
Medium
Description:
The Microsoft Device Guard on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a security feature bypass by the way it handles Windows PowerShell sessions, aka "Windows Security Feature Bypass".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3431		 Title:
Windows Search Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3431
CVE-2017-11771 		Severity:
High
Description:
The Microsoft Windows Search component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly handle DNS responses, aka "Windows Search Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3411		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3411
CVE-2017-11784 		Severity:
Low
Description:
The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11765, CVE-2017-11785, and CVE-2017-11814.
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3412		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3412
CVE-2017-11765 		Severity:
Low
Description:
The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11784, CVE-2017-11785, and CVE-2017-11814.
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3414		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3414
CVE-2017-11814 		Severity:
Low
Description:
The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11765, CVE-2017-11784, and CVE-2017-11785.
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3415		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3415
CVE-2017-11785 		Severity:
Low
Description:
The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11765, CVE-2017-11784, and CVE-2017-11814.
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3422		 Title:
Windows Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3422
CVE-2017-11817 		Severity:
Low
Description:
The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows an information disclosure vulnerability when it improperly validates objects in memory, aka "Windows Information Disclosure Vulnerability".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3474		 Title:
Windows GDI Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3474
CVE-2017-11816 		Severity:
Low
Description:
The Microsoft Windows Graphics Device Interface (GDI) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability in the way it handles objects in memory, aka "Windows GDI Information Disclosure Vulnerability".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3424		 Title:
Windows Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:3424
CVE-2017-11783 		Severity:
Medium
Description:
Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability in the way it handles calls to Advanced Local Procedure Call (ALPC), aka "Windows Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3428		 Title:
Windows DNSAPI Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3428
CVE-2017-11779 		Severity:
High
Description:
The Microsoft Windows Domain Name System (DNS) DNSAPI.dll on Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly handle DNS responses, aka "Windows DNSAPI Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3484		 Title:
User information leak via SVG		 Type:
Web		 Bulletins:
CISEC:3484
CVE-2017-5107 		Severity:
Low
Description:
User information leak via SVG.
Applies to:
Google Chrome		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3470		 Title:
Use after free in V8		 Type:
Web		 Bulletins:
CISEC:3470
CVE-2017-5098 		Severity:
Medium
Description:
Use after free in V8.
Applies to:
Google Chrome		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3441		 Title:
Use after free in print preview		 Type:
Web		 Bulletins:
CISEC:3441
CVE-2017-5073 		Severity:
Medium
Description:
Use after free in print preview
Applies to:
Google Chrome		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3445		 Title:
Use after free in credit card autofill		 Type:
Web		 Bulletins:
CISEC:3445
CVE-2017-5080 		Severity:
Medium
Description:
Use after free in credit card autofill
Applies to:
Google Chrome		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3439		 Title:
Use after free in Apps Bluetooth		 Type:
Web		 Bulletins:
CISEC:3439
CVE-2017-5074 		Severity:
Medium
Description:
Use after free in Apps Bluetooth
Applies to:
Google Chrome		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3436		 Title:
UI spoofing in Blink		 Type:
Web		 Bulletins:
CISEC:3436
CVE-2017-5079 		Severity:
Medium
Description:
UI spoofing in Blink
Applies to:
Google Chrome		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3440		 Title:
UI spoofing in Blink		 Type:
Web		 Bulletins:
CISEC:3440
CVE-2017-5083 		Severity:
Medium
Description:
UI spoofing in Blink
Applies to:
Google Chrome		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3434		 Title:
Type confusion in V8		 Type:
Web		 Bulletins:
CISEC:3434
CVE-2017-5070 		Severity:
Medium
Description:
Type confusion in V8
Applies to:
Google Chrome		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3430		 Title:
TRIE Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3430
CVE-2017-11769 		Severity:
High
Description:
The Microsoft Windows TRIE component on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability in the way it handles loading dll files, aka "TRIE Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3460		 Title:
Skype for Business Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:3460
CVE-2017-11786 		Severity:
High
Description:
Skype for Business in Microsoft Lync 2013 SP1 and Skype for Business 2016 allows an attacker to steal an authentication hash that can be reused elsewhere, due to how Skype for Business handles authentication requests, aka "Skype for Business Elevation of Privilege Vulnerability."
Applies to:
Microsoft Lync 2013
Skype for Business 2016		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3417		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3417
CVE-2017-11800 		Severity:
High
Description:
Scripting Engine Memory Corruption Vulnerability.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3418		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3418
CVE-2017-11798 		Severity:
High
Description:
Scripting Engine Memory Corruption Vulnerability.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3419		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3419
CVE-2017-11799 		Severity:
High
Description:
Scripting Engine Memory Corruption Vulnerability.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3420		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3420
CVE-2017-11792 		Severity:
High
Description:
Scripting Engine Memory Corruption Vulnerability.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3452		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3452
CVE-2017-11821 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, and CVE-2017-11812.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3453		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3453
CVE-2017-11812 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11812, and CVE-2017-11821.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3454		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3454
CVE-2017-11805 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3455		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3455
CVE-2017-11811 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11812, and CVE-2017-11821.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3456		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3456
CVE-2017-11796 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3457		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3457
CVE-2017-11802 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3447		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3447
CVE-2017-11804 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3448		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3448
CVE-2017-11807 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3449		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3449
CVE-2017-11808 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3450		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3450
CVE-2017-11806 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3451		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3451
CVE-2017-11809 		Severity:
High
Description:
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3438		 Title:
Possible command injection in mailto handling		 Type:
Web		 Bulletins:
CISEC:3438
CVE-2017-5078 		Severity:
Medium
Description:
Possible command injection in mailto handling
Applies to:
Google Chrome		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3444		 Title:
Out of bounds read in V8		 Type:
Web		 Bulletins:
CISEC:3444
CVE-2017-5071 		Severity:
Medium
Description:
Out of bounds read in V8
Applies to:
Google Chrome		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3425		 Title:
Microsoft Windows Security Feature Bypass		 Type:
Software		 Bulletins:
CISEC:3425
CVE-2017-11823 		Severity:
High
Description:
The Microsoft Device Guard on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a security feature bypass by the way it handles Windows PowerShell sessions, aka "Microsoft Windows Security Feature Bypass".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3423		 Title:
Microsoft Search Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3423
CVE-2017-11772 		Severity:
Medium
Description:
The Microsoft Windows Search component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure when it fails to properly handle objects in memory, aka "Microsoft Search Information Disclosure Vulnerability".
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3464		 Title:
Microsoft Outlook Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:3464
CVE-2017-11774 		Severity:
Medium
Description:
Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
Applies to:
Microsoft Outlook 2010
Microsoft Outlook 2013
Microsoft Outlook 2016		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3459		 Title:
Microsoft Outlook Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3459
CVE-2017-11776 		Severity:
Medium
Description:
Microsoft Outlook 2016 allows an attacker to obtain the email content of a user, due to how Outlook 2016 discloses user email content, aka "Microsoft Outlook Information Disclosure Vulnerability."
Applies to:
Microsoft Outlook 2016		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3461		 Title:
Microsoft Office SharePoint XSS Vulnerability		 Type:
Software		 Bulletins:
CISEC:3461
CVE-2017-11775 		Severity:
Low
Description:
Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting (XSS) vulnerability by sending a specially crafted request to an affected SharePoint server, due to how SharePoint Server sanitizes web requests, aka "Microsoft Office SharePoint XSS Vulnerability". This CVE ID is unique from CVE-2017-11777 and CVE-2017-11820.
Applies to:
Microsoft SharePoint Server 2013
Microsoft SharePoint Server 2016		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3462		 Title:
Microsoft Office SharePoint XSS Vulnerability		 Type:
Software		 Bulletins:
CISEC:3462
CVE-2017-11820 		Severity:
Low
Description:
Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting (XSS) vulnerability by sending a specially crafted request to an affected SharePoint server, due to how SharePoint Server sanitizes web requests, aka "Microsoft Office SharePoint XSS Vulnerability". This CVE ID is unique from CVE-2017-11775 and CVE-2017-11777.
Applies to:
Microsoft SharePoint Server 2013
Microsoft SharePoint Server 2016		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3463		 Title:
Microsoft Office SharePoint XSS Vulnerability		 Type:
Software		 Bulletins:
CISEC:3463
CVE-2017-11777 		Severity:
Low
Description:
Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting (XSS) vulnerability by sending a specially crafted request to an affected SharePoint server, due to how SharePoint Server sanitizes web requests, aka "Microsoft Office SharePoint XSS Vulnerability". This CVE ID is unique from CVE-2017-11775 and CVE-2017-11820.
Applies to:
Microsoft SharePoint Server 2013
Microsoft SharePoint Server 2016		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3467		 Title:
Microsoft JET Database Engine Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3467
CVE-2017-8718 		Severity:
High
Description:
The Microsoft JET Database Engine in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to take control of an affected system, due to how it handles objects in memory, aka "Microsoft JET Database Engine Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8717.
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3468		 Title:
Microsoft JET Database Engine Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3468
CVE-2017-8717 		Severity:
High
Description:
The Microsoft JET Database Engine in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to take control of an affected system, due to how it handles objects in memory, aka "Microsoft JET Database Engine Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8718.
Applies to:
 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3472		 Title:
Microsoft Edge Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3472
CVE-2017-8726 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how affected Microsoft scripting engines handle objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11794 and CVE-2017-11803.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3473		 Title:
Microsoft Edge Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3473
CVE-2017-11794 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system, due to how Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8726 and CVE-2017-11803.
Applies to:
Microsoft Edge		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3446		 Title:
Information leak in CSP reporting		 Type:
Web		 Bulletins:
CISEC:3446
CVE-2017-5075 		Severity:
Medium
Description:
Information leak in CSP reporting
Applies to:
Google Chrome		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3442		 Title:
Heap buffer overflow in Skia		 Type:
Web		 Bulletins:
CISEC:3442
CVE-2017-5077 		Severity:
Medium
Description:
Heap buffer overflow in Skia
Applies to:
Google Chrome		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3435		 Title:
Extension verification bypass		 Type:
Web		 Bulletins:
CISEC:3435
CVE-2017-5081 		Severity:
Low
Description:
Extension verification bypass
Applies to:
Google Chrome		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3437		 Title:
Address spoofing in Omnibox		 Type:
Web		 Bulletins:
CISEC:3437
CVE-2017-5076 		Severity:
Medium
Description:
Address spoofing in Omnibox
Applies to:
Google Chrome		 Created:
2017-11-17		 Updated:
2023-01-26
ID:
CISEC:3397		 Title:
Windows Graphics Component Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:3397
CVE-2017-11824 		Severity:
Medium
Description:
An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
Applies to:
 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3390		 Title:
Win32k Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:3390
CVE-2017-8694 		Severity:
Medium
Description:
The Microsoft Windows Kernel Mode Driver on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8689.
Applies to:
 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3391		 Title:
Win32k Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:3391
CVE-2017-8689 		Severity:
Medium
Description:
The Microsoft Windows Kernel Mode Driver on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8694.
Applies to:
 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3378		 Title:
Use after free in PPAPI		 Type:
Web		 Bulletins:
CISEC:3378
CVE-2017-5092 		Severity:
Medium
Description:
Use after free in PPAPI.
Applies to:
Google Chrome		 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3379		 Title:
Use after free in IndexedDB		 Type:
Web		 Bulletins:
CISEC:3379
CVE-2017-5091 		Severity:
Medium
Description:
Use after free in IndexedDB.
Applies to:
Google Chrome		 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3384		 Title:
UI spoofing in Blink		 Type:
Web		 Bulletins:
CISEC:3384
CVE-2017-5093 		Severity:
Medium
Description:
UI spoofing in Blink.
Applies to:
Google Chrome		 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3386		 Title:
Type confusion in extensions		 Type:
Web		 Bulletins:
CISEC:3386
CVE-2017-5094 		Severity:
Medium
Description:
Type confusion in extensions.
Applies to:
Google Chrome		 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3408		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3408
CVE-2017-11810 		Severity:
High
Description:
Scripting Engine Memory Corruption Vulnerability.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3409		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3409
CVE-2017-11793 		Severity:
High
Description:
Scripting Engine Memory Corruption Vulnerability.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3385		 Title:
Out-of-bounds write in PDFium		 Type:
Web		 Bulletins:
CISEC:3385
CVE-2017-5095 		Severity:
Medium
Description:
Out-of-bounds write in PDFium.
Applies to:
Google Chrome		 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3377		 Title:
OpenSSL Security Bypass Vulnerability		 Type:
Services		 Bulletins:
CISEC:3377
CVE-2017-3735 		Severity:
Medium
Description:
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL since then.
Applies to:
OpenSSL		 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3394		 Title:
Microsoft Office Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3394
CVE-2017-11825 		Severity:
High
Description:
A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user.
Applies to:
Microsoft Office 2016		 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3395		 Title:
Microsoft Office Memory Corruption Vulnerability		 Type:
Miscellaneous		 Bulletins:
CISEC:3395
CVE-2017-11826 		Severity:
High
Description:
A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Applies to:
Microsoft Office Compatibility Pack
Microsoft SharePoint Server 2010
Microsoft SharePoint Server 2013
Microsoft SharePoint Server 2016
Microsoft Word 2007
Microsoft Word 2010
Microsoft Word 2013
Microsoft Word 2016
Microsoft Word Viewer		 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3392		 Title:
Microsoft Graphics Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3392
CVE-2017-11763 		Severity:
Medium
Description:
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Applies to:
 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3396		 Title:
Microsoft Graphics Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3396
CVE-2017-11762 		Severity:
Medium
Description:
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Applies to:
 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3393		 Title:
Microsoft Graphics Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3393
CVE-2017-8693 		Severity:
Low
Description:
An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.
Applies to:
 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3387		 Title:
Internet Explorer Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3387
CVE-2017-11822 		Severity:
High
Description:
Internet Explorer Information Disclosure Vulnerability.
Applies to:
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3388		 Title:
Internet Explorer Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3388
CVE-2017-11790 		Severity:
Medium
Description:
Internet Explorer Information Disclosure Vulnerability.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3389		 Title:
Internet Explorer Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3389
CVE-2017-11813 		Severity:
High
Description:
Internet Explorer Information Disclosure Vulnerability.
Applies to:
Microsoft Internet Explorer 11		 Created:
2017-11-10		 Updated:
2023-01-26
ID:
CISEC:3353		 Title:
Remote Code Execution Vulnerability in Apache Tomcat 7.0.0 to 7.0.79		 Type:
Software		 Bulletins:
CISEC:3353
CVE-2017-12615 		Severity:
Medium
Description:
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Applies to:
Apache Tomcat		 Created:
2017-11-03		 Updated:
2018-05-25
ID:
CISEC:3358		 Title:
RAR decompression memory corruption		 Type:
Software		 Bulletins:
CISEC:3358
CVE-2016-5310 		Severity:
Medium
Description:
The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP); Symantec Email Security.Cloud; Symantec Data Center Security: Server; Symantec Endpoint Protection (SEP) for Windows before 12.1.6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1.6 MP6; Symantec Endpoint Protection for Small Business Enterprise (SEP SBE/SEP.Cloud); Symantec Endpoint Protection Cloud (SEPC) for Windows/Mac; Symantec Endpoint Protection Small Business Edition 12.1; CSAPI before 10.0.4 HF02; Symantec Protection Engine (SPE) before 7.0.5 HF02, 7.5.x before 7.5.4 HF02, 7.5.5 before 7.5.5 HF01, and 7.8.x before 7.8.0 HF03; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF2.1, 8.1.x before 8.1.2 HF2.3, and 8.1.3 before 8.1.3 HF2.2; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 6.5.8_3968140 HF2.3, 7.x before 7.0_3966002 HF2.1, and 7.5.x before 7.5_3966008 VHF2.2; Symantec Protection for SharePoint Servers (SPSS) before SPSS_6.0.3_To_6.0.5_HF_2.5 update, 6.0.6 before 6.0.6 HF_2.6, and 6.0.7 before 6.0.7_HF_2.7; Symantec Messaging Gateway (SMG) before 10.6.2; Symantec Messaging Gateway for Service Providers (SMG-SP) before 10.5 patch 260 and 10.6 before patch 259; Symantec Web Gateway; and Symantec Web Security.Cloud allows remote attackers to cause a denial of service (memory corruption) via a crafted RAR file that is mishandled during decompression.
Applies to:
Symantec Endpoint Protection		 Created:
2017-11-03		 Updated:
2023-01-26
ID:
CISEC:3357		 Title:
RAR Decompression Denial Of Service Vulnerability		 Type:
Software		 Bulletins:
CISEC:3357
CVE-2016-5309 		Severity:
Medium
Description:
The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP); Symantec Email Security.Cloud; Symantec Data Center Security: Server; Symantec Endpoint Protection (SEP) for Windows before 12.1.6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1.6 MP6; Symantec Endpoint Protection for Small Business Enterprise (SEP SBE/SEP.Cloud); Symantec Endpoint Protection Cloud (SEPC) for Windows/Mac; Symantec Endpoint Protection Small Business Edition 12.1; CSAPI before 10.0.4 HF02; Symantec Protection Engine (SPE) before 7.0.5 HF02, 7.5.x before 7.5.4 HF02, 7.5.5 before 7.5.5 HF01, and 7.8.x before 7.8.0 HF03; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF2.1, 8.1.x before 8.1.2 HF2.3, and 8.1.3 before 8.1.3 HF2.2; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 6.5.8_3968140 HF2.3, 7.x before 7.0_3966002 HF2.1, and 7.5.x before 7.5_3966008 VHF2.2; Symantec Protection for SharePoint Servers (SPSS) before SPSS_6.0.3_To_6.0.5_HF_2.5 update, 6.0.6 before 6.0.6 HF_2.6, and 6.0.7 before 6.0.7_HF_2.7; Symantec Messaging Gateway (SMG) before 10.6.2; Symantec Messaging Gateway for Service Providers (SMG-SP) before 10.5 patch 260 and 10.6 before patch 259; Symantec Web Gateway; and Symantec Web Security.Cloud allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted RAR file that is mishandled during decompression.
Applies to:
Symantec Endpoint Protection		 Created:
2017-11-03		 Updated:
2023-01-26
ID:
CISEC:3355		 Title:
Out-of-bounds access in V8		 Type:
Web		 Bulletins:
CISEC:3355
CVE-2017-5121 		Severity:
Medium
Description:
Out-of-bounds access in V8.
Applies to:
Google Chrome		 Created:
2017-11-03		 Updated:
2023-01-26
ID:
CISEC:3356		 Title:
Out-of-bounds access in V8		 Type:
Web		 Bulletins:
CISEC:3356
CVE-2017-5122 		Severity:
Medium
Description:
Out-of-bounds access in V8
Applies to:
Google Chrome		 Created:
2017-11-03		 Updated:
2023-01-26
ID:
CISEC:3354		 Title:
Information Disclosure Vulnerability in Apache Tomcat 7.0.0 to 7.0.80		 Type:
Software		 Bulletins:
CISEC:3354
CVE-2017-12616 		Severity:
Medium
Description:
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
Applies to:
Apache Tomcat		 Created:
2017-11-03		 Updated:
2018-05-25
ID:
CISEC:3351		 Title:
IBM WebSphere MQ and IBM MQ Appliance proliferation of channel agents causes denial of service		 Type:
Software		 Bulletins:
CISEC:3351
CVE-2017-1145 		Severity:
High
Description:
IBM WebSphere MQ 8.0.0.6 does not properly terminate channel agents when they are no longer needed, which could allow a user to cause a denial of service through resource exhaustion. IBM Reference #: 1999672.
Applies to:
IBM WebSphere MQ		 Created:
2017-11-03		 Updated:
2023-01-26
ID:
CISEC:3352		 Title:
IBM MQ Java clients might send a password in clear text		 Type:
Software		 Bulletins:
CISEC:3352
CVE-2016-3052 		Severity:
Medium
Description:
Under non-standard configurations, IBM WebSphere MQ might send password data in clear text over the network. This data could be intercepted using man in the middle techniques.
Applies to:
IBM WebSphere MQ		 Created:
2017-11-03		 Updated:
2023-01-26
ID:
CISEC:3311		 Title:
IBM MQ cluster channel definition causes denial of service to cluster		 Type:
Software		 Bulletins:
CISEC:3311
CVE-2016-9009 		Severity:
Medium
Description:
IBM WebSphere MQ 8.0 could allow an authenticated user with authority to create a cluster object to cause a denial of service to MQ clustering. IBM Reference #: 1998647.
Applies to:
IBM WebSphere MQ		 Created:
2017-11-03		 Updated:
2023-01-26
ID:
CISEC:3350		 Title:
IBM MQ and IBM WebSphere MQ Trace enablement could cause denial of service		 Type:
Software		 Bulletins:
CISEC:3350
CVE-2017-1117 		Severity:
Low
Description:
IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user to cause a denial of service to the MQXR channel when trace is enabled. IBM X-Force ID: 121155.
Applies to:
IBM WebSphere MQ		 Created:
2017-11-03		 Updated:
2023-01-26
ID:
CISEC:3310		 Title:
IBM MQ administration command could cause denial of service		 Type:
Software		 Bulletins:
CISEC:3310
CVE-2016-8971 		Severity:
Medium
Description:
IBM WebSphere MQ 8.0 could allow an authenticated user with queue manager permissions to cause a segmentation fault which would result in the box having to be rebooted to resume normal operations. IBM Reference #: 1998663.
Applies to:
IBM WebSphere MQ		 Created:
2017-11-03		 Updated:
2023-01-26
ID:
CISEC:3264		 Title:
Windows Shell Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3264
CVE-2017-8699 		Severity:
High
Description:
Windows Shell in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to run arbitrary code in the context of the current user, due to the way that Windows Shell validates file copy destinations, aka "Windows Shell Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3267		 Title:
Windows Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:3267
CVE-2017-8716 		Severity:
Medium
Description:
Windows Control Flow Guard in Microsoft Windows 10 Version 1703 allows an attacker to run a specially crafted application to bypass Control Flow Guard, due to the way that Control Flow Guard handles objects in memory, aka "Windows Security Feature Bypass Vulnerability".
Applies to:
 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3257		 Title:
Windows Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3257
CVE-2017-8710 		Severity:
Medium
Description:
The Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1 allows an attacker to read arbitrary files via an XML external entity (XXE) declaration, due to the way that the Microsoft Common Console Document (.msc) parses XML input containing a reference to an external entity, aka "Windows Information Disclosure Vulnerability".
Applies to:
 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3256		 Title:
Windows Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:3256
CVE-2017-8702 		Severity:
Medium
Description:
Windows Error Reporting (WER) in Microsoft Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows an attacker to gain greater access to sensitive information and system functionality, due to the way that WER handles and executes files, aka "Windows Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3270		 Title:
Windows DHCP Server Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3270
CVE-2017-8686 		Severity:
High
Description:
The Windows Server DHCP service in Windows Server 2012 Gold and R2, and Windows Server 2016 allows an attacker to either run arbitrary code on the DHCP failover server or cause the DHCP service to become nonresponsive, due to a memory corruption vulnerability in the Windows Server DHCP service, aka "Windows DHCP Server Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3268		 Title:
Uniscribe Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3268
CVE-2017-8692 		Severity:
High
Description:
The Windows Uniscribe component on Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows remote code execution vulnerability when it fails to properly handle objects in memory, aka "Uniscribe Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3259		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3259
CVE-2017-8740 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
Applies to:
Microsoft Edge		 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3260		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3260
CVE-2017-8755 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8756, and CVE-2017-11764.
Applies to:
Microsoft Edge		 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3261		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3261
CVE-2017-8753 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
Applies to:
Microsoft Edge		 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3262		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3262
CVE-2017-8729 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
Applies to:
Microsoft Edge		 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3263		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3263
CVE-2017-8756 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft Edge accesses objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, and CVE-2017-11764.
Applies to:
Microsoft Edge		 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3269		 Title:
Remote Desktop Virtual Host Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3269
CVE-2017-8714 		Severity:
Medium
Description:
The Windows Hyper-V component on Microsoft Windows 8.1, Windows Server 2012 Gold and R2,, Windows 10 1607, and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly validate input from an authenticated user on a guest operating system, aka "Remote Desktop Virtual Host Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3286		 Title:
Plaintext Credentials Information Disclosure Vulnerability in IBM WebSphere MQ 9.0.1 and 9.0.2		 Type:
Software		 Bulletins:
CISEC:3286
CVE-2017-1337 		Severity:
Medium
Description:
IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text. IBM X-Force ID: 126245.
Applies to:
IBM WebSphere MQ		 Created:
2017-10-27		 Updated:
2018-05-25
ID:
CISEC:3251		 Title:
Microsoft Office Publisher Remote Code Execution		 Type:
Software		 Bulletins:
CISEC:3251
CVE-2017-8725 		Severity:
High
Description:
A remote code execution vulnerability exists in Microsoft Publisher 2007 Service Pack 3 and Microsoft Publisher 2010 Service Pack 2 when they fail to properly handle objects in memory, aka "Microsoft Office Publisher Remote Code Execution".
Applies to:
Microsoft Publisher 2007
Microsoft Publisher 2010		 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3252		 Title:
Microsoft Office Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3252
CVE-2017-8744 		Severity:
High
Description:
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1, and Microsoft Excel 2016 when they fail to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8630, CVE-2017-8632, and CVE-2017-8731.
Applies to:
Microsoft Office 2007
Microsoft Office 2010
Microsoft Office 2013
Microsoft Office 2016		 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3258		 Title:
Microsoft Bluetooth Driver Spoofing Vulnerability		 Type:
Software		 Bulletins:
CISEC:3258
CVE-2017-8628 		Severity:
Medium
Description:
Microsoft Bluetooth Driver in Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703 allows a spoofing vulnerability due to Microsoft's implementation of the Bluetooth stack, aka "Microsoft Bluetooth Driver Spoofing Vulnerability".
Applies to:
 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3280		 Title:
Local Information Disclosure Vulnerability in IBM WebSphere MQ 9.0.1 and 9.0.2		 Type:
Software		 Bulletins:
CISEC:3280
CVE-2017-1284 		Severity:
Low
Description:
IBM WebSphere MQ 9.0.1 and 9.0.2 could allow a local user with ability to run or enable trace, to obtain sensitive information from WebSphere Application Server traces including user credentials. IBM X-Force ID: 125145.
Applies to:
IBM WebSphere MQ		 Created:
2017-10-27		 Updated:
2018-05-25
ID:
CISEC:3254		 Title:
Internet Explorer Spoofing Vulnerability		 Type:
Software		 Bulletins:
CISEC:3254
CVE-2017-8733 		Severity:
Medium
Description:
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to trick a user into believing that the user was visiting a legitimate website, due to the way that Internet Explorer handles specific HTML content, aka "Internet Explorer Spoofing Vulnerability".
Applies to:
Internet Explorer 10
Internet Explorer 11
Internet Explorer 9		 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3253		 Title:
Internet Explorer Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3253
CVE-2017-8749 		Severity:
High
Description:
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Internet Explorer accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8747.
Applies to:
Internet Explorer 10
Internet Explorer 11		 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3255		 Title:
Internet Explorer Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3255
CVE-2017-8747 		Severity:
High
Description:
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Internet Explorer accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8749.
Applies to:
Internet Explorer 10
Internet Explorer 11		 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3309		 Title:
IBM MQ Invalid channel protocol flows cause denial of service on HP-UX		 Type:
Software		 Bulletins:
CISEC:3309
CVE-2016-8915 		Severity:
Medium
Description:
IBM WebSphere MQ 8.0 could allow an authenticated user with access to the queue manager and queue, to deny service to other channels running under the same process. IBM Reference #: 1998649.
Applies to:
IBM WebSphere MQ		 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3307		 Title:
IBM MQ Channel data conversion denial of service		 Type:
Software		 Bulletins:
CISEC:3307
CVE-2016-3013 		Severity:
Medium
Description:
IBM WebSphere MQ 8.0 could allow an authenticated user to crash the MQ channel due to improper data conversion handling. IBM Reference #: 1998661.
Applies to:
IBM WebSphere MQ		 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3308		 Title:
IBM MQ and IBM WebSphere MQ invalid requests could cause denial of service to MQXR listener		 Type:
Software		 Bulletins:
CISEC:3308
CVE-2016-8986 		Severity:
Medium
Description:
IBM WebSphere MQ 8.0 could allow an authenticated user with access to the queue manager to bring down MQ channels using specially crafted HTTP requests. IBM Reference #: 1998648.
Applies to:
IBM WebSphere MQ		 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3266		 Title:
Device Guard Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:3266
CVE-2017-8746 		Severity:
Medium
Description:
Windows Device Guard in Windows 10 1607, 1703, and Windows Server 2016 allows A security feature bypass vulnerability due to how PowerShell exposes functions and processes user supplied code, aka "Device Guard Security Feature Bypass Vulnerability".
Applies to:
 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3276		 Title:
Denial of Service Vulnerability in IBM WebSphere MQ 9.0.1 and 9.0.2		 Type:
Software		 Bulletins:
CISEC:3276
CVE-2017-1285 		Severity:
Medium
Description:
IBM WebSphere MQ 9.0.1 and 9.0.2 could allow an authenticated user with authority to send a specially crafted message that would cause a channel to remain in a running state but not process messages. IBM X-Force ID: 125146.
Applies to:
IBM WebSphere MQ		 Created:
2017-10-27		 Updated:
2018-05-25
ID:
CISEC:3281		 Title:
Denial of Service Vulnerability in IBM WebSphere MQ 9.0.1 and 9.0.2		 Type:
Software		 Bulletins:
CISEC:3281
CVE-2017-1236 		Severity:
Medium
Description:
IBM WebSphere MQ 9.0.2 could allow an authenticated user to potentially cause a denial of service by saving an incorrect channel status inquiry. IBM X-Force ID: 124354
Applies to:
IBM WebSphere MQ		 Created:
2017-10-27		 Updated:
2018-05-25
ID:
CISEC:3271		 Title:
Cross Site Scripting (XSS) in IMG Tags in the ePO extension in McAfee Data Loss Prevention Endpoint (DLP Endpoint) 10.0.x		 Type:
Software		 Bulletins:
CISEC:3271
CVE-2017-3948 		Severity:
Low
Description:
Access control vulnerability in Intel Security Data Loss Prevention Endpoint (DLPe) 9.4.200 and 9.3.600 allows authenticated users with Read-Write-Execute permissions to inject hook DLLs into other processes via pages in the target process memory get.
Applies to:
McAfee DLP Endpoint Agent		 Created:
2017-10-27		 Updated:
2018-05-25
ID:
CISEC:3278		 Title:
Access control vulnerability in Intel Security Data Loss Prevention Endpoint (DLPe) 9.4.200 and 9.3.600		 Type:
Software		 Bulletins:
CISEC:3278
CVE-2016-8012 		Severity:
Medium
Description:
Access control vulnerability in Intel Security Data Loss Prevention Endpoint (DLPe) 9.4.200 and 9.3.600 allows authenticated users with Read-Write-Execute permissions to inject hook DLLs into other processes via pages in the target process memory get.
Applies to:
McAfee DLP Endpoint Agent		 Created:
2017-10-27		 Updated:
2018-05-25
ID:
CISEC:3265		 Title:
.NET Framework Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3265
CVE-2017-8759 		Severity:
High
Description:
Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework Remote Code Execution Vulnerability."
Applies to:
 Created:
2017-10-27		 Updated:
2023-01-26
ID:
CISEC:3221		 Title:
Windows GDI+ Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3221
CVE-2017-8676 		Severity:
Low
Description:
The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, 1607, 1703, and Server 2016; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an authenticated attacker to retrieve information from a targeted system via a specially crafted application, aka "Windows GDI+ Information Disclosure Vulnerability."
Applies to:
Microsoft Live Meeting 2007
Microsoft Lync 2010
Microsoft Lync 2013
Microsoft Office 2007
Microsoft Office 2010
Microsoft Office Word Viewer
Skype for Business 2016		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3236		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3236
CVE-2017-8741 		Severity:
High
Description:
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Internet Explorer and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3240		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3240
CVE-2017-8649 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
Applies to:
Microsoft Edge		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3241		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3241
CVE-2017-11764 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, and CVE-2017-8756.
Applies to:
Microsoft Edge		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3242		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3242
CVE-2017-8748 		Severity:
High
Description:
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 11		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3245		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3245
CVE-2017-8738 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
Applies to:
Microsoft Edge		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3247		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3247
CVE-2017-8752 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
Applies to:
Microsoft Edge		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3248		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3248
CVE-2017-8660 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
Applies to:
Microsoft Edge		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3246		 Title:
Scripting Engine Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3246
CVE-2017-8739 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability".
Applies to:
Microsoft Edge		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3222		 Title:
PowerPoint Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3222
CVE-2017-8743 		Severity:
High
Description:
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016, and Office Online Server when they fail to properly handle objects in memory, aka "PowerPoint Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8742.
Applies to:
Microsoft PowerPoint 2016
Microsoft SharePoint Server 2016		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3228		 Title:
PowerPoint Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3228
CVE-2017-8742 		Severity:
High
Description:
A remote code execution vulnerability exists in Microsoft PowerPoint 2007 Service Pack 3, Microsoft PowerPoint 2010 Service Pack 2, Microsoft PowerPoint 2013 Service Pack 1, Microsoft PowerPoint 2013 RT Service Pack 1, Microsoft PowerPoint 2016, Microsoft PowerPoint Viewer 2007, Microsoft SharePoint Server 2013 Service Pack 1, Microsoft SharePoint Enterprise Server 2016, Microsoft Office Web Apps 2010 Service Pack 2, and Microsoft Office Compatibility Pack Service Pack 3 when they fail to properly handle objects in memory, aka "PowerPoint Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8743.
Applies to:
Microsoft Office Compatibility Pack
Microsoft Office Web Apps 2010
Microsoft Office Web Apps Server 2013
Microsoft PowerPoint 2007
Microsoft PowerPoint 2010
Microsoft PowerPoint 2013
Microsoft PowerPoint 2016
PowerPoint Viewer 2010		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3237		 Title:
NetBIOS Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3237
CVE-2017-0161 		Severity:
Medium
Description:
The Windows NetBT Session Services component on Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability when it fails to maintain certain sequencing requirements, aka "NetBIOS Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3226		 Title:
Microsoft PDF Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3226
CVE-2017-8737 		Severity:
High
Description:
Microsoft Windows PDF Library in Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Windows PDF Library handles objects in memory, aka "Windows PDF Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8728.
Applies to:
Microsoft Edge		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3229		 Title:
Microsoft PDF Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3229
CVE-2017-8728 		Severity:
High
Description:
Microsoft Windows PDF Library in Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Windows PDF Library handles objects in memory, aka "Windows PDF Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8737.
Applies to:
Microsoft Edge		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3233		 Title:
Microsoft Office Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3233
CVE-2017-8632 		Severity:
High
Description:
A remote code execution vulnerability exists in Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1, Microsoft Excel 2016, Microsoft Office Web Apps 2013, Microsoft Excel for Mac 2011, Microsoft Excel 2016 for Mac, and Microsoft Office Compatibility Pack Service Pack 3, when they fail to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8630, CVE-2017-8631, and CVE-2017-8744.
Applies to:
Microsoft Excel 2010
Microsoft Excel 2013
Microsoft Excel 2016
Microsoft Office Compatibility Pack		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3234		 Title:
Microsoft Office Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3234
CVE-2017-8631 		Severity:
High
Description:
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1, Microsoft Excel 2016, Microsoft Office Web Apps 2013, Microsoft Office Compatibility Pack Service Pack 3, Microsoft Excel Web App 2013 Service Pack 1, Microsoft Excel Viewer 2007 Service Pack 3, and Office Online Server when they fail to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8630, CVE-2017-8632, and CVE-2017-8744.
Applies to:
Microsoft Excel 2007
Microsoft Excel 2010
Microsoft Excel 2013
Microsoft Excel 2016
Microsoft Excel Viewer
Microsoft Excel Web App
Microsoft Office Web Apps Server
Microsoft Sharepoint Server 2007
Microsoft Sharepoint Server 2010		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3235		 Title:
Microsoft Office Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3235
CVE-2017-8630 		Severity:
High
Description:
Microsoft Office 2016 allows a remote code execution vulnerability when it fails to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8631, CVE-2017-8632, and CVE-2017-8744.
Applies to:
Microsoft Office 2016		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3219		 Title:
Microsoft Graphics Component Remote Code Execution		 Type:
Software		 Bulletins:
CISEC:3219
CVE-2017-8696 		Severity:
High
Description:
Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an attacker to execute code remotely via a specially crafted website or a specially crafted document or email attachment, aka "Microsoft Graphics Component Remote Code Execution."
Applies to:
Microsoft Live Meeting 2007
Microsoft Lync 2010
Microsoft Lync 2013
Microsoft Office 2007
Microsoft Office 2010
Microsoft Office Word Viewer
Skype for Business 2016		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3216		 Title:
Microsoft Edge Spoofing Vulnerability		 Type:
Software		 Bulletins:
CISEC:3216
CVE-2017-8724 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 Version 1703 allows an attacker to trick a user by redirecting the user to a specially crafted website, due to the way that Microsoft Edge parses HTTP content, aka "Microsoft Edge Spoofing Vulnerability". This CVE ID is unique from CVE-2017-8735.
Applies to:
Microsoft Edge		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3215		 Title:
Microsoft Edge Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3215
CVE-2017-8751 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft Edge accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8731, CVE-2017-8734, and CVE-2017-11766.
Applies to:
Microsoft Edge		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3244		 Title:
Microsoft Edge Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3244
CVE-2017-8731 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1607 and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft Edge accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8734, CVE-2017-8751, and CVE-2017-11766.
Applies to:
Microsoft Edge		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3214		 Title:
Microsoft Edge Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3214
CVE-2017-8597 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 Version 1703 allows an attacker to obtain information to further compromise the user's system, due to the way that Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8643 and CVE-2017-8648.
Applies to:
Microsoft Edge		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3243		 Title:
Microsoft Browser Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3243
CVE-2017-8750 		Severity:
High
Description:
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerability".
Applies to:
Microsoft Edge
Microsoft Internet Explorer 11		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3213		 Title:
Microsoft Browser Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3213
CVE-2017-8736 		Severity:
Medium
Description:
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to obtain specific information used in the parent domain, due to Microsoft browser parent domain verification in certain functionality, aka "Microsoft Browser Information Disclosure Vulnerability".
Applies to:
Microsoft Edge
Microsoft Internet Explorer 11		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3223		 Title:
Hyper-V Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3223
CVE-2017-8713 		Severity:
Low
Description:
The Windows Hyper-V component on Microsoft Windows Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8707, CVE-2017-8711, CVE-2017-8712, and CVE-2017-8706.
Applies to:
 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3224		 Title:
Hyper-V Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3224
CVE-2017-8711 		Severity:
Low
Description:
The Windows Hyper-V component on Microsoft Windows 10 1607 and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8707, CVE-2017-8706, CVE-2017-8712, and CVE-2017-8713.
Applies to:
 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3230		 Title:
Hyper-V Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3230
CVE-2017-8712 		Severity:
Low
Description:
The Windows Hyper-V component on Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8707, CVE-2017-8711, CVE-2017-8706, and CVE-2017-8713.
Applies to:
 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3231		 Title:
Hyper-V Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3231
CVE-2017-8706 		Severity:
Low
Description:
The Windows Hyper-V component on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8707, CVE-2017-8711, CVE-2017-8712, and CVE-2017-8713.
Applies to:
 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3232		 Title:
Hyper-V Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3232
CVE-2017-8707 		Severity:
Low
Description:
The Windows Hyper-V component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly validate input from an authenticated user on a guest operating system, aka Hyper-V Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8706, CVE-2017-8711, CVE-2017-8712, and CVE-2017-8713.
Applies to:
 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3227		 Title:
Hyper-V Denial of Service Vulnerability		 Type:
Software		 Bulletins:
CISEC:3227
CVE-2017-8704 		Severity:
Medium
Description:
The Windows Hyper-V component on Microsoft Windows 10 1607 and Windows Server 2016 allows a denial of service vulnerability when it fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Denial of Service Vulnerability".
Applies to:
 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3220		 Title:
Graphics Component Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3220
CVE-2017-8695 		Severity:
Low
Description:
Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, 1607, 1703, and Server 2016; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an attacker to obtain information to further compromise a user's system via a specially crafted document or an untrusted webpage, aka "Graphics Component Information Disclosure Vulnerability."
Applies to:
Microsoft Live Meeting 2007
Microsoft Lync 2010
Microsoft Lync 2013
Microsoft Office 2007
Microsoft Office 2010
Microsoft Office Word Viewer
Skype for Business 2016		 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CISEC:3238		 Title:
Broadcom BCM43xx Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3238
CVE-2017-9417 		Severity:
High
Description:
Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn" issue.
Applies to:
 Created:
2017-10-20		 Updated:
2023-01-26
ID:
CVE-2014-3164		 Title:
cmds/servicemanager/service_manager.c in Android before commit 7d42a3c31ba78a418f9bdde0e0ab951469f321b5 allows attackers to cause a denial of service (NULL pointer dereference, or out-of-bounds write) via vectors related to binder...		 Type:
Mobile Devices		 Bulletins:
CVE-2014-3164
SFBID101506 		Severity:
Medium
Description:
cmds/servicemanager/service_manager.c in Android before commit 7d42a3c31ba78a418f9bdde0e0ab951469f321b5 allows attackers to cause a denial of service (NULL pointer dereference, or out-of-bounds write) via vectors related to binder passed lengths.
Applies to:
 Created:
2017-10-18		 Updated:
2023-01-26
ID:
CISEC:3197		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3197
CVE-2017-8708 		Severity:
Low
Description:
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8679, CVE-2017-8709, and CVE-2017-8719.
Applies to:
 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3200		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3200
CVE-2017-8679 		Severity:
Low
Description:
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8708, CVE-2017-8709, and CVE-2017-8719.
Applies to:
 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3203		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3203
CVE-2017-8709 		Severity:
Low
Description:
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8708, CVE-2017-8679, and CVE-2017-8719.
Applies to:
 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3205		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3205
CVE-2017-8719 		Severity:
Low
Description:
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8708, CVE-2017-8709, and CVE-2017-8679.
Applies to:
 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3210		 Title:
Windows GDI+ Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3210
CVE-2017-8685 		Severity:
Low
Description:
Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows information disclosure by the way it discloses kernel memory addresses, aka "Windows GDI+ Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8684 and CVE-2017-8688.
Applies to:
 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3211		 Title:
Windows GDI+ Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3211
CVE-2017-8688 		Severity:
Low
Description:
Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows information disclosure by the way it discloses kernel memory addresses, aka "Windows GDI+ Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8684 and CVE-2017-8685.
Applies to:
 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3212		 Title:
Windows GDI+ Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3212
CVE-2017-8684 		Severity:
Low
Description:
Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1, allows information disclosure by the way it discloses kernel memory addresses, aka "Windows GDI+ Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8685 and CVE-2017-8688.
Applies to:
 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3192		 Title:
Win32k Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3192
CVE-2017-8678 		Severity:
Low
Description:
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8677, CVE-2017-8680, CVE-2017-8681, and CVE-2017-8687.
Applies to:
 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3196		 Title:
Win32k Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3196
CVE-2017-8681 		Severity:
Low
Description:
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8678, CVE-2017-8680, CVE-2017-8677, and CVE-2017-8687.
Applies to:
 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3198		 Title:
Win32k Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3198
CVE-2017-8677 		Severity:
Low
Description:
The Windows GDI+ component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it improperly discloses kernel memory addresses, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8678, CVE-2017-8680, CVE-2017-8681, and CVE-2017-8687.
Applies to:
 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3199		 Title:
Win32k Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3199
CVE-2017-8687 		Severity:
Low
Description:
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8678, CVE-2017-8680, CVE-2017-8677, and CVE-2017-8681.
Applies to:
 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3204		 Title:
Win32k Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3204
CVE-2017-8680 		Severity:
Low
Description:
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8678, CVE-2017-8677, CVE-2017-8681, and CVE-2017-8687.
Applies to:
 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3191		 Title:
Win32k Graphics Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3191
CVE-2017-8682 		Severity:
High
Description:
Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, Windows Server 2016, Microsoft Office Word Viewer, Microsoft Office 2007 Service Pack 3 , and Microsoft Office 2010 Service Pack 2 allows an attacker to execute remote code by the way it handles embedded fonts, aka "Win32k Graphics Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8683.
Applies to:
Microsoft Office 2007
Microsoft Office 2010
Microsoft Office Word Viewer		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3194		 Title:
Win32k Graphics Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3194
CVE-2017-8683 		Severity:
Low
Description:
Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows an attacker to execute remote code by the way it handles embedded fonts, aka "Win32k Graphics Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8682.
Applies to:
 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3193		 Title:
Win32k Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:3193
CVE-2017-8675 		Severity:
Medium
Description:
The Windows Kernel-Mode Drivers component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability".. This CVE ID is unique from CVE-2017-8720.
Applies to:
 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3201		 Title:
Win32k Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:3201
CVE-2017-8720 		Severity:
High
Description:
The Microsoft Windows graphics component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8675.
Applies to:
 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3159		 Title:
Vulnerability in ImageMagick 7.0.5-8		 Type:
Software		 Bulletins:
CISEC:3159
CVE-2017-9500 		Severity:
Medium
Description:
In ImageMagick 7.0.5-8 Q16, an assertion failure was found in the function ResetImageProfileIterator, which allows attackers to cause a denial of service via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3169		 Title:
Vulnerability in ImageMagick 7.0.5-7		 Type:
Software		 Bulletins:
CISEC:3169
CVE-2017-9499 		Severity:
Medium
Description:
In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function SetPixelChannelAttributes, which allows attackers to cause a denial of service via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3175		 Title:
Vulnerability in ImageMagick 7.0.5-7		 Type:
Software		 Bulletins:
CISEC:3175
CVE-2017-9501 		Severity:
Medium
Description:
In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function LockSemaphoreInfo, which allows attackers to cause a denial of service via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3158		 Title:
Vulnerability in ImageMagick 7.0.5-5		 Type:
Software		 Bulletins:
CISEC:3158
CVE-2017-9407 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadPALMImage function in palm.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3160		 Title:
Vulnerability in ImageMagick 7.0.5-5		 Type:
Software		 Bulletins:
CISEC:3160
CVE-2017-9405 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadICONImage function in icon.c:452 allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3168		 Title:
Vulnerability in ImageMagick 7.0.5-5		 Type:
Software		 Bulletins:
CISEC:3168
CVE-2017-9440 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPSDChannel in coders/psd.c, which allows attackers to cause a denial of service via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3172		 Title:
Vulnerability in ImageMagick 7.0.5-5		 Type:
Software		 Bulletins:
CISEC:3172
CVE-2017-9409 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadMPCImage function in mpc.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3174		 Title:
Vulnerability in ImageMagick 7.0.5-5		 Type:
Software		 Bulletins:
CISEC:3174
CVE-2017-9439 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of service via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3163		 Title:
Use of uninitialized value in Skia		 Type:
Web		 Bulletins:
CISEC:3163
CVE-2017-5117 		Severity:
Medium
Description:
Use of uninitialized value in Skia
Applies to:
Google Chrome		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3171		 Title:
Use of uninitialized value in Skia		 Type:
Web		 Bulletins:
CISEC:3171
CVE-2017-5119 		Severity:
Medium
Description:
Use of uninitialized value in Skia
Applies to:
Google Chrome		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3162		 Title:
Use after free in PDFium		 Type:
Web		 Bulletins:
CISEC:3162
CVE-2017-5111 		Severity:
Medium
Description:
Use after free in PDFium
Applies to:
Google Chrome		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3166		 Title:
Type confusion in V8		 Type:
Web		 Bulletins:
CISEC:3166
CVE-2017-5116 		Severity:
Medium
Description:
Type confusion in V8
Applies to:
Google Chrome		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3167		 Title:
Type confusion in V8		 Type:
Web		 Bulletins:
CISEC:3167
CVE-2017-5115 		Severity:
Medium
Description:
Type confusion in V8
Applies to:
Google Chrome		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3181		 Title:
The ReadSVGImage function in svg.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file		 Type:
Software		 Bulletins:
CISEC:3181
CVE-2017-7943 		Severity:
Medium
Description:
The ReadSVGImage function in svg.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3186		 Title:
The ReadAVSImage function in avs.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file		 Type:
Software		 Bulletins:
CISEC:3186
CVE-2017-7942 		Severity:
Medium
Description:
The ReadAVSImage function in avs.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3161		 Title:
Potential HTTPS downgrade during redirect navigation		 Type:
Web		 Bulletins:
CISEC:3161
CVE-2017-5120 		Severity:
Medium
Description:
Potential HTTPS downgrade during redirect navigation
Applies to:
Google Chrome		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3202		 Title:
Microsoft SharePoint XSS Vulnerability		 Type:
Software		 Bulletins:
CISEC:3202
CVE-2017-8629 		Severity:
Low
Description:
Microsoft SharePoint Server 2013 Service Pack 1 allows an elevation of privilege vulnerability when it fails to properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint XSS Vulnerability".
Applies to:
Microsoft SharePoint Server 2013		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3195		 Title:
Microsoft SharePoint Cross Site Scripting Vulnerability		 Type:
Software		 Bulletins:
CISEC:3195
CVE-2017-8745 		Severity:
Low
Description:
An elevation of privilege vulnerability exists in Microsoft SharePoint Foundation 2013 Service Pack 1 when it does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Cross Site Scripting Vulnerability".
Applies to:
Microsoft SharePoint Foundation 2013		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3189		 Title:
Microsoft Exchange Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3189
CVE-2017-11761 		Severity:
Medium
Description:
Microsoft Exchange Server 2013 and Microsoft Exchange Server 2016 allow an input sanitization issue with Microsoft Exchange that could potentially result in unintended Information Disclosure, aka "Microsoft Exchange Information Disclosure Vulnerability".
Applies to:
Microsoft Exchange 2013
Microsoft Exchange 2016		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3187		 Title:
Microsoft Exchange Cross-Site Scripting Vulnerability		 Type:
Software		 Bulletins:
CISEC:3187
CVE-2017-8758 		Severity:
Medium
Description:
Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability."
Applies to:
Microsoft Exchange 2016		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3176		 Title:
Microsoft Edge Spoofing Vulnerability		 Type:
Software		 Bulletins:
CISEC:3176
CVE-2017-8735 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to trick a user by redirecting the user to a specially crafted website, due to the way that Microsoft Edge parses HTTP content, aka "Microsoft Edge Spoofing Vulnerability". This CVE ID is unique from CVE-2017-8724.
Applies to:
Microsoft Edge		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3179		 Title:
Microsoft Edge Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:3179
CVE-2017-8723 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page containing malicious content, due to the way that the Edge Content Security Policy (CSP) validates certain specially crafted documents, aka "Microsoft Edge Security Feature Bypass Vulnerability". This CVE ID is unique from CVE-2017-8754.
Applies to:
Microsoft Edge		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3208		 Title:
Microsoft Edge Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:3208
CVE-2017-8754 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page containing malicious content, due to the way that the Edge Content Security Policy (CSP) validates certain specially crafted documents, aka "Microsoft Edge Security Feature Bypass Vulnerability". This CVE ID is unique from CVE-2017-8723.
Applies to:
Microsoft Edge		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3207		 Title:
Microsoft Edge Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3207
CVE-2017-8757 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way Microsoft Edge handles objects in memory, aka "Microsoft Edge Remote Code Execution Vulnerability".
Applies to:
Microsoft Edge		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3178		 Title:
Microsoft Edge Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3178
CVE-2017-8734 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft Edge accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8731, CVE-2017-8751, and CVE-2017-11766.
Applies to:
Microsoft Edge		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3206		 Title:
Microsoft Edge Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3206
CVE-2017-11766 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft Edge accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8731, CVE-2017-8734, and CVE-2017-8751.
Applies to:
Microsoft Edge		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3177		 Title:
Microsoft Edge Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3177
CVE-2017-8643 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to leave a malicious website open during user clipboard activities, due to the way that Microsoft Edge handles clipboard events, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8597 and CVE-2017-8648.
Applies to:
Microsoft Edge		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3209		 Title:
Microsoft Edge Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3209
CVE-2017-8648 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows Version 1703 allows an attacker to obtain information to further compromise the user's system, due to the way that Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8597 and CVE-2017-8643.
Applies to:
Microsoft Edge		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3173		 Title:
Memory lifecycle issue in PDFium		 Type:
Web		 Bulletins:
CISEC:3173
CVE-2017-5114 		Severity:
Medium
Description:
Memory lifecycle issue in PDFium
Applies to:
Google Chrome		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3131		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3131
CVE-2017-11239 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to text strings. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3132		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3132
CVE-2017-11238 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to curve drawing. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3133		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3133
CVE-2017-11237 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the font parsing module. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3156		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3156
CVE-2017-11243 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the XSLT engine. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3157		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3157
CVE-2017-11242 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to line segments. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3129		 Title:
In ImageMagick 7.0.5-5, the ReadXWDImage function in xwd.c allows attackers to cause a denial of service (memory leak		 Type:
Software		 Bulletins:
CISEC:3129
CVE-2017-8352 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadXWDImage function in xwd.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3121		 Title:
In ImageMagick 7.0.5-5, the ReadSUNImage function in sun.c allows attackers to cause a denial of service (memory leak		 Type:
Software		 Bulletins:
CISEC:3121
CVE-2017-8356 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadSUNImage function in sun.c allows attackers to cause a denial of service (memory leak) via a crafted file..
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3122		 Title:
In ImageMagick 7.0.5-5, the ReadSFWImage function in sfw.c allows attackers to cause a denial of service (memory leak		 Type:
Software		 Bulletins:
CISEC:3122
CVE-2017-8349 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadSFWImage function in sfw.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3123		 Title:
In ImageMagick 7.0.5-5, the ReadPICTImage function in pict.c allows attackers to cause a denial of service (memory leak		 Type:
Software		 Bulletins:
CISEC:3123
CVE-2017-8353 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadPICTImage function in pict.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3183		 Title:
In ImageMagick 7.0.5-5, the ReadPCXImage function in pcx.c allows attackers to cause a denial of service (memory leak		 Type:
Software		 Bulletins:
CISEC:3183
CVE-2017-8344 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadPCXImage function in pcx.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3124		 Title:
In ImageMagick 7.0.5-5, the ReadPCDImage function in pcd.c allows attackers to cause a denial of service (memory leak		 Type:
Software		 Bulletins:
CISEC:3124
CVE-2017-8351 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadPCDImage function in pcd.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3127		 Title:
In ImageMagick 7.0.5-5, the ReadMTVImage function in mtv.c allows attackers to cause a denial of service (memory leak		 Type:
Software		 Bulletins:
CISEC:3127
CVE-2017-8355 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadMTVImage function in mtv.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3180		 Title:
In ImageMagick 7.0.5-5, the ReadMNGImage function in png.c allows attackers to cause a denial of service (memory leak		 Type:
Software		 Bulletins:
CISEC:3180
CVE-2017-8345 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadMNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3125		 Title:
In ImageMagick 7.0.5-5, the ReadMATImage function in mat.c allows attackers to cause a denial of service (memory leak		 Type:
Software		 Bulletins:
CISEC:3125
CVE-2017-8348 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadMATImage function in mat.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3128		 Title:
In ImageMagick 7.0.5-5, the ReadJNGImage function in png.c allows attackers to cause a denial of service (memory leak		 Type:
Software		 Bulletins:
CISEC:3128
CVE-2017-8350 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadJNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3184		 Title:
In ImageMagick 7.0.5-5, the ReadEXRImage function in exr.c allows attackers to cause a denial of service (memory leak		 Type:
Software		 Bulletins:
CISEC:3184
CVE-2017-8347 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadEXRImage function in exr.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3126		 Title:
In ImageMagick 7.0.5-5, the ReadEPTImage function in ept.c allows attackers to cause a denial of service (memory leak		 Type:
Software		 Bulletins:
CISEC:3126
CVE-2017-8357 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadEPTImage function in ept.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3185		 Title:
In ImageMagick 7.0.5-5, the ReadDCMImage function in dcm.c allows attackers to cause a denial of service (memory leak		 Type:
Software		 Bulletins:
CISEC:3185
CVE-2017-8346 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadDCMImage function in dcm.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3130		 Title:
In ImageMagick 7.0.5-5, the ReadBMPImage function in bmp.c allows attackers to cause a denial of service (memory leak		 Type:
Software		 Bulletins:
CISEC:3130
CVE-2017-8354 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadBMPImage function in bmp.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3182		 Title:
In ImageMagick 7.0.5-5, the ReadAAIImage function in aai.c allows attackers to cause a denial of service (memory leak		 Type:
Software		 Bulletins:
CISEC:3182
CVE-2017-8343 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadAAIImage function in aai.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3155		 Title:
Heap buffer overflow vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3155
CVE-2017-11241 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable heap overflow vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to polygons. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3170		 Title:
Heap buffer overflow in WebGL		 Type:
Web		 Bulletins:
CISEC:3170
CVE-2017-5112 		Severity:
Medium
Description:
Heap buffer overflow in WebGL
Applies to:
Google Chrome		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3165		 Title:
Heap buffer overflow in Skia		 Type:
Web		 Bulletins:
CISEC:3165
CVE-2017-5113 		Severity:
Medium
Description:
Heap buffer overflow in Skia
Applies to:
Google Chrome		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3164		 Title:
Bypass of Content Security Policy in Blink		 Type:
Web		 Bulletins:
CISEC:3164
CVE-2017-5118 		Severity:
Medium
Description:
Bypass of Content Security Policy in Blink
Applies to:
Google Chrome		 Created:
2017-10-13		 Updated:
2023-01-26
ID:
CISEC:3098		 Title:
Remote Code Execution vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier 		Type:
Software		 Bulletins:
CISEC:3098
CVE-2017-11223 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in the core of the XFA engine. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-06		 Updated:
2023-01-26
ID:
CISEC:3105		 Title:
Remote Code Execution vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier 		Type:
Software		 Bulletins:
CISEC:3105
CVE-2017-11224 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in the XFA layout engine. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-06		 Updated:
2023-01-26
ID:
CISEC:3113		 Title:
Remote code execution vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier 		Type:
Software		 Bulletins:
CISEC:3113
CVE-2017-11231 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in Acrobat/Reader rendering engine. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-06		 Updated:
2023-01-26
ID:
CISEC:3109		 Title:
Remote code execution vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3109
CVE-2017-11235 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in the image conversion engine when decompressing JPEG data. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-06		 Updated:
2023-01-26
ID:
CISEC:3107		 Title:
Office Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3107
CVE-2017-8509 		Severity:
High
Description:
A security feature bypass vulnerability exists in Microsoft Office software when it improperly handles the parsing of file formats, aka "Microsoft Office Security Feature Bypass Vulnerability".
Applies to:
Microsoft Office 2007
Microsoft Office 2010
Microsoft Office 2013
Microsoft Office 2016		 Created:
2017-10-06		 Updated:
2023-01-26
ID:
CISEC:3108		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier 		Type:
Software		 Bulletins:
CISEC:3108
CVE-2017-11228 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing JPEG 2000 (JP2) code stream data. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-06		 Updated:
2023-01-26
ID:
CISEC:3111		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier 		Type:
Software		 Bulletins:
CISEC:3111
CVE-2017-11229 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has a security bypass vulnerability when manipulating Forms Data Format (FDF).
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-06		 Updated:
2023-01-26
ID:
CISEC:3112		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier 		Type:
Software		 Bulletins:
CISEC:3112
CVE-2017-11230 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the JPEG 2000 engine. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-06		 Updated:
2023-01-26
ID:
CISEC:3099		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier 		Type:
Software		 Bulletins:
CISEC:3099
CVE-2017-11222 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the Product Representation Compact (PRC) engine. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-06		 Updated:
2023-01-26
ID:
CISEC:3106		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier 		Type:
Software		 Bulletins:
CISEC:3106
CVE-2017-11226 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image processing engine when processing JPEG 2000 (JP2) code stream data. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-06		 Updated:
2023-01-26
ID:
CISEC:3114		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier 		Type:
Software		 Bulletins:
CISEC:3114
CVE-2017-11227 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) private data. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-06		 Updated:
2023-01-26
ID:
CISEC:3110		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3110
CVE-2017-11233 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to block transfer of pixels. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-06		 Updated:
2023-01-26
ID:
CISEC:3116		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3116
CVE-2017-11234 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing TIFF data related to the way how the components of each pixel are stored. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-06		 Updated:
2023-01-26
ID:
CISEC:3117		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3117
CVE-2017-11236 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the internal handling of UTF-16 literal strings. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-06		 Updated:
2023-01-26
ID:
CISEC:3115		 Title:
Information disclosure vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier 		Type:
Software		 Bulletins:
CISEC:3115
CVE-2017-11232 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability when processing Enhanced Metafile Format (EMF) data related to brush manipulation. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-10-06		 Updated:
2023-01-26
ID:
CISEC:3081		 Title:
Vulnerability in Oracle Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14		 Type:
Software		 Bulletins:
CISEC:3081
CVE-2017-10176 		Severity:
Medium
Description:
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Applies to:
JRockit
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3079		 Title:
Vulnerability in Oracle Java SE: 7u141 and 8u131		 Type:
Software		 Bulletins:
CISEC:3079
CVE-2017-10125 		Severity:
Medium
Description:
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 7u141 and 8u131. Difficult to exploit vulnerability allows physical access to compromise Java SE. While the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to deployment of Java where the Java Auto Update is enabled. CVSS 3.0 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
Applies to:
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3080		 Title:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14		 Type:
Software		 Bulletins:
CISEC:3080
CVE-2017-10135 		Severity:
Medium
Description:
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Applies to:
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3083		 Title:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14		 Type:
Software		 Bulletins:
CISEC:3083
CVE-2017-10198 		Severity:
Medium
Description:
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).
Applies to:
JRockit
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3084		 Title:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14		 Type:
Software		 Bulletins:
CISEC:3084
CVE-2017-10243 		Severity:
Medium
Description:
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAX-WS). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded, JRockit accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).
Applies to:
JRockit
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3082		 Title:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131		 Type:
Software		 Bulletins:
CISEC:3082
CVE-2017-10193 		Severity:
Low
Description:
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
Applies to:
JRockit
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3054		 Title:
RPCoRDMA dissector infinite loop		 Type:
Software		 Bulletins:
CISEC:3054
CVE-2017-7705 		Severity:
High
Description:
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the RPC over RDMA dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-rpcrdma.c by correctly checking for going beyond the maximum offset.
Applies to:
Wireshark		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3075		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an information disclosure vulnerability		 Type:
Software		 Bulletins:
CISEC:3075
CVE-2017-3115 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an information disclosure vulnerability when handling links in a PDF document.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3055		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability		 Type:
Software		 Bulletins:
CISEC:3055
CVE-2017-11219 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in the XFA rendering engine. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3058		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability		 Type:
Software		 Bulletins:
CISEC:3058
CVE-2017-3120 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in the XFA parsing engine when handling certain types of internal instructions. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3068		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability		 Type:
Software		 Bulletins:
CISEC:3068
CVE-2017-11218 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in XFA event management. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3077		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability		 Type:
Software		 Bulletins:
CISEC:3077
CVE-2017-3113 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in JavaScript engine when creating large strings. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3057		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable type confusion vulnerability		 Type:
Software		 Bulletins:
CISEC:3057
CVE-2017-11221 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable type confusion vulnerability in the annotation functionality. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3056		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability		 Type:
Software		 Bulletins:
CISEC:3056
CVE-2017-3016 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3059		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability		 Type:
Software		 Bulletins:
CISEC:3059
CVE-2017-3123 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data drawing position definition. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3061		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability		 Type:
Software		 Bulletins:
CISEC:3061
CVE-2017-11214 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to rendering a path. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3064		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability		 Type:
Software		 Bulletins:
CISEC:3064
CVE-2017-11217 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to drawing of Unicode text strings. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3065		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability		 Type:
Software		 Bulletins:
CISEC:3065
CVE-2017-11209 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability that occurs when reading a JPEG file embedded within XML Paper Specification (XPS) file. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3066		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability		 Type:
Software		 Bulletins:
CISEC:3066
CVE-2017-11210 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the font parsing, where the font is embedded in the XML Paper Specification (XPS) file. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3067		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability		 Type:
Software		 Bulletins:
CISEC:3067
CVE-2017-3116 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the MakeAccessible plugin when parsing TrueType font data. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3069		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability		 Type:
Software		 Bulletins:
CISEC:3069
CVE-2017-3124 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the picture exchange (PCX) file format parsing module. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3070		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability		 Type:
Software		 Bulletins:
CISEC:3070
CVE-2017-3119 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in Acrobat/Reader 11.0.19 engine. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3071		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability		 Type:
Software		 Bulletins:
CISEC:3071
CVE-2017-11212 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to text output. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3073		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability		 Type:
Software		 Bulletins:
CISEC:3073
CVE-2017-3122 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to Bezier curves. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3074		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability		 Type:
Software		 Bulletins:
CISEC:3074
CVE-2017-11216 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to bitmap transformations. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3078		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability		 Type:
Software		 Bulletins:
CISEC:3078
CVE-2017-3121 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the Enhanced Metafile Format (EMF) parser. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3060		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable heap overflow vulnerability		 Type:
Software		 Bulletins:
CISEC:3060
CVE-2017-11220 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable heap overflow vulnerability in an internal data structure. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3062		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable heap overflow vulnerability		 Type:
Software		 Bulletins:
CISEC:3062
CVE-2017-11211 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable heap overflow vulnerability in the JPEG parser. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3063		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable heap overflow vulnerability		 Type:
Software		 Bulletins:
CISEC:3063
CVE-2017-3117 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable heap overflow vulnerability in the plugin that handles links within the PDF. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CISEC:3076		 Title:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has a security bypass vulnerability		 Type:
Software		 Bulletins:
CISEC:3076
CVE-2017-3118 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has a security bypass vulnerability related to execution of malicious attachments.
Applies to:
Adobe Acrobat
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Reader
Adobe Reader DC Classic
Adobe Reader DC Continuous		 Created:
2017-09-29		 Updated:
2023-01-26
ID:
CVE-2015-1526		 Title:
The media_server component in Android allows remote attackers to cause a denial of service via a crafted application.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-1526
SFBID76666 		Severity:
High
Description:
The media_server component in Android allows remote attackers to cause a denial of service via a crafted application.
Applies to:
 Created:
2017-09-27		 Updated:
2023-01-26
ID:
CVE-2015-1537		 Title:
Integer overflow in IHDCP.cpp in the media_server component in Android allows remote attackers to execute arbitrary code via a crafted application.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-1537
SFBID76670 		Severity:
High
Description:
Integer overflow in IHDCP.cpp in the media_server component in Android allows remote attackers to execute arbitrary code via a crafted application.
Applies to:
 Created:
2017-09-27		 Updated:
2023-01-26
ID:
CVE-2014-0997		 Title:
WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used in the Samsung SM-T310, Android 4.1.2 as used in the Motorola RAZR HD, and potentially other unspecified Android...		 Type:
Mobile Devices		 Bulletins:
CVE-2014-0997
SFBID72311 		Severity:
Medium
Description:
WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used in the Samsung SM-T310, Android 4.1.2 as used in the Motorola RAZR HD, and potentially other unspecified Android releases before 5.0.1 and 5.0.2 does not properly handle exceptions, which allows remote attackers to cause a denial of service (reboot) via a crafted 802.11 probe response frame.
Applies to:
 Created:
2017-09-25		 Updated:
2023-01-26
ID:
CVE-2011-4667		 Title:
The encryption library in Cisco IOS Software 15.2(1)T, 15.2(1)T1, and 15.2(2)T, Cisco NX-OS in Cisco MDS 9222i Multiservice Modular Switch, Cisco MDS 9000 18/4-Port Multiservice Module, and Cisco MDS 9000 Storage Services Node module before 5.2(6),...		 Type:
Hardware		 Bulletins:
CVE-2011-4667 		Severity:
Medium
Description:
The encryption library in Cisco IOS Software 15.2(1)T, 15.2(1)T1, and 15.2(2)T, Cisco NX-OS in Cisco MDS 9222i Multiservice Modular Switch, Cisco MDS 9000 18/4-Port Multiservice Module, and Cisco MDS 9000 Storage Services Node module before 5.2(6), and Cisco IOS in Cisco VPN Services Port Adaptor for Catalyst 6500 12.2(33)SXI, and 12.2(33)SXJ when IP Security (aka IPSec) is used, allows remote attackers to obtain unencrypted packets from encrypted sessions.
Applies to:
 Created:
2017-09-25		 Updated:
2023-01-26
ID:
CVE-2010-3050		 Title:
Cisco IOS before 12.2(33)SXI allows remote authenticated users to cause a denial of service (device reboot).		 Type:
Hardware		 Bulletins:
CVE-2010-3050 		Severity:
Medium
Description:
Cisco IOS before 12.2(33)SXI allows remote authenticated users to cause a denial of service (device reboot).
Applies to:
 Created:
2017-09-25		 Updated:
2023-01-26
ID:
CVE-2010-3049		 Title:
Cisco IOS before 12.2(33)SXI allows local users to cause a denial of service (device reboot).		 Type:
Hardware		 Bulletins:
CVE-2010-3049 		Severity:
Medium
Description:
Cisco IOS before 12.2(33)SXI allows local users to cause a denial of service (device reboot).
Applies to:
 Created:
2017-09-25		 Updated:
2023-01-26
ID:
CISEC:3008		 Title:
Windows NetBIOS Denial of Service Vulnerability		 Type:
Software		 Bulletins:
CISEC:3008
CVE-2017-0174 		Severity:
Medium
Description:
Windows NetBIOS in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a denial of service vulnerability when it improperly handles NetBIOS packets, aka "Windows NetBIOS Denial of Service Vulnerability".
Applies to:
 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3010		 Title:
Vulnerability in the MySQL Server		 Type:
Software		 Bulletins:
CISEC:3010
CVE-2017-3653 		Severity:
Low
Description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).
Applies to:
MySQL Server		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3047		 Title:
Vulnerability in Oracle Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14		 Type:
Software		 Bulletins:
CISEC:3047
CVE-2017-10118 		Severity:
Medium
Description:
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Applies to:
JRockit
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3025		 Title:
Use After Free vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3025
CVE-2017-11256 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability when generating content using XFA layout engine. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3037		 Title:
Use After Free vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3037
CVE-2017-11254 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in the Acrobat/Reader's JavaScript engine. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3026		 Title:
Type Confusion vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3026
CVE-2017-11257 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable type confusion vulnerability in the XFA layout engine. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3000		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3000
CVE-2017-8657 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
Applies to:
Microsoft Edge		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3001		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3001
CVE-2017-8671 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8672, and CVE-2017-8674.
Applies to:
Microsoft Edge		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3002		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3002
CVE-2017-8656 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
Applies to:
Microsoft Edge		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3009		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3009
CVE-2017-8635 		Severity:
High
Description:
Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to the way that JavaScript engines render when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3013		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3013
CVE-2017-8674 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, and CVE-2017-8672.
Applies to:
Microsoft Edge		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3019		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3019
CVE-2017-8641 		Severity:
High
Description:
Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Window Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3046		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3046
CVE-2017-8670 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
Applies to:
Microsoft Edge		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3048		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3048
CVE-2017-8647 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, and CVE-2017-8672.
Applies to:
Microsoft Edge		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3018		 Title:
Microsoft SQL Server Analysis Services Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3018
CVE-2017-8516 		Severity:
Medium
Description:
Microsoft SQL Server Analysis Services in Microsoft SQL Server 2012, Microsoft SQL Server 2014, and Microsoft SQL Server 2016 allows an information disclosure vulnerability when it improperly enforces permissions, aka "Microsoft SQL Server Analysis Services Information Disclosure Vulnerability".
Applies to:
Microsoft SQL Server 2012
Microsoft SQL Server 2014
Microsoft SQL Server 2016		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3007		 Title:
Microsoft JET Database Engine Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:3007
CVE-2017-0250 		Severity:
High
Description:
Microsoft JET Database Engine in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability due to buffer overflow, aka "Microsoft JET Database Engine Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3016		 Title:
Microsoft Edge Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:3016
CVE-2017-8650 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to exploit a security feature bypass due to Microsoft Edge not properly enforcing same-origin policies, aka "Microsoft Edge Security Feature Bypass Vulnerability".
Applies to:
Microsoft Edge		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3011		 Title:
Microsoft Edge Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3011
CVE-2017-8661 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way affected Microsoft scripting engines render when handling objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability".
Applies to:
Microsoft Edge		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3012		 Title:
Microsoft Edge Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3012
CVE-2017-8652 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the way that Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8644 and CVE-2017-8662.
Applies to:
Microsoft Edge		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3014		 Title:
Microsoft Edge Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3014
CVE-2017-8644 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the way that Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8652 and CVE-2017-8662.
Applies to:
Microsoft Edge		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3015		 Title:
Microsoft Edge Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:3015
CVE-2017-8662 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to elevate privileges due to the way that Microsoft Edge validates JavaScript under specific conditions, aka "Microsoft Edge Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8503.
Applies to:
Microsoft Edge		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3003		 Title:
Microsoft Browser Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3003
CVE-2017-8669 		Severity:
High
Description:
Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to Microsoft browsers improperly handling objects in memory while rendering content, aka "Microsoft Browser Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8653.
Applies to:
Internet Explorer 11
Microsoft Edge		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3004		 Title:
Microsoft Browser Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3004
CVE-2017-8653 		Severity:
High
Description:
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to execute arbitrary code in the context of the current user when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8519.
Applies to:
Internet Explorer 10
Internet Explorer 11
Internet Explorer 9
Microsoft Edge		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3021		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3021
CVE-2017-11246 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when parsing JPEG data. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3022		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3022
CVE-2017-11249 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when parsing an invalid Enhanced Metafile Format (EMF) record. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3023		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3023
CVE-2017-11251 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the JPEG 2000 parsing module. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3024		 Title:
Memory Corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3024
CVE-2017-11270 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) private data representing icons. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3020		 Title:
Memory Corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3020
CVE-2017-11258 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) private data and the embedded GIF image. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3027		 Title:
Memory Corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3027
CVE-2017-11263 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the internal data structure manipulation related to document encoding. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3028		 Title:
Memory Corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3028
CVE-2017-11271 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to transfer of pixel blocks. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3029		 Title:
Memory Corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3029
CVE-2017-11268 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) private JPEG data. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3030		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3030
CVE-2017-11252 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the Adobe Graphics Manager (AGM) module. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3032		 Title:
Memory Corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3032
CVE-2017-11267 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) private data interpreted as JPEG data. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3033		 Title:
Memory Corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3033
CVE-2017-11260 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) private data interpreted as a GIF image. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3034		 Title:
Memory Corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3034
CVE-2017-11255 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing TIFF color map data. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3035		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3035
CVE-2017-11245 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) private data. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3036		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3036
CVE-2017-11248 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to pixel block transfer. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3038		 Title:
Memory Corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3038
CVE-2017-11269 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) image stream data. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3039		 Title:
Memory Corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3039
CVE-2017-11259 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) private data. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3040		 Title:
Memory Corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3040
CVE-2017-11262 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to drawing ASCII text string. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3042		 Title:
Memory Corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3042
CVE-2017-11265 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the Adobe Graphics Manager module. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3043		 Title:
Memory Corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3043
CVE-2017-11261 		Severity:
High
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) private data and the embedded TIF image. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3044		 Title:
Memory corruption vulnerability in Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier		 Type:
Software		 Bulletins:
CISEC:3044
CVE-2017-11244 		Severity:
Medium
Description:
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to transformation of blocks of pixels. Successful exploitation could lead to arbitrary code execution.
Applies to:
Adobe Acrobat 2017
Adobe Acrobat DC Classic
Adobe Acrobat DC Continuous
Adobe Acrobat Reader 2017
Adobe Acrobat Reader DC Classic
Adobe Acrobat Reader DC Continuous
Adobe Acrobat Reader XI
Adobe Acrobat XI		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3005		 Title:
Internet Explorer Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:3005
CVE-2017-8625 		Severity:
Medium
Description:
Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to bypass Device Guard User Mode Code Integrity (UMCI) policies due to Internet Explorer failing to validate UMCI policies, aka "Internet Explorer Security Feature Bypass Vulnerability".
Applies to:
Internet Explorer 11		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3006		 Title:
Internet Explorer Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:3006
CVE-2017-8651 		Severity:
High
Description:
Internet Explorer in Microsoft Windows Server 2008 SP2 and Windows Server 2012 allows an attacker to execute arbitrary code in the context of the current user due to Internet Explorer improperly accessing objects in memory, aka "Internet Explorer Memory Corruption Vulnerability".
Applies to:
Internet Explorer 10
Internet Explorer 9		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3052		 Title:
IMAP dissector crash		 Type:
Software		 Bulletins:
CISEC:3052
CVE-2017-7703 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the IMAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-imap.c by calculating a line's end correctly.
Applies to:
Wireshark		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:3053		 Title:
DOF dissector infinite loop		 Type:
Software		 Bulletins:
CISEC:3053
CVE-2017-7704 		Severity:
High
Description:
In Wireshark 2.2.0 to 2.2.5, the DOF dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-dof.c by using a different integer data type and adjusting a return value.
Applies to:
Wireshark		 Created:
2017-09-22		 Updated:
2023-01-26
ID:
CISEC:2987		 Title:
Windows Subsystem for Linux Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2987
CVE-2017-8622 		Severity:
High
Description:
Windows Subsystem for Linux in Windows 10 1703 allows an elevation of privilege vulnerability when it fails to properly handle handles NT pipes, aka "Windows Subsystem for Linux Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2988		 Title:
Windows Subsystem for Linux Denial of Service Vulnerability		 Type:
Software		 Bulletins:
CISEC:2988
CVE-2017-8627 		Severity:
Medium
Description:
Windows Subsystem for Linux in Windows 10 1703, allows a denial of service vulnerability due to the way it handles objects in memory, aka "Windows Subsystem for Linux Denial of Service Vulnerability".
Applies to:
 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2959		 Title:
Windows Search Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2959
CVE-2017-8620 		Severity:
High
Description:
Windows Search Remote Code Execution Vulnerability - CVE-2017-8620 Windows Search in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability when it improperly handles objects in memory, aka "Windows Search Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2968		 Title:
Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability		 Type:
Software		 Bulletins:
CISEC:2968
CVE-2017-8673 		Severity:
Medium
Description:
The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 10 1703 allows an attacker to connect to a target system using RDP and send specially crafted requests, aka "Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability."
Applies to:
 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2980		 Title:
Windows PDF Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2980
CVE-2017-0293 		Severity:
High
Description:
Microsoft Windows PDF Library in Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability when it improperly handles objects in memory, aka "Windows PDF Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2985		 Title:
Windows IME Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2985
CVE-2017-8591 		Severity:
High
Description:
Windows Input Method Editor (IME) in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an remote code execution vulnerability when it fails to properly handle objects in memory, aka "Windows IME Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2958		 Title:
Windows Hyper-V Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2958
CVE-2017-8664 		Severity:
High
Description:
Windows Hyper-V in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly validate input from a privileged user on a guest operating system, aka "Windows Hyper-V Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2956		 Title:
Windows Hyper-V Denial of Service Vulnerability		 Type:
Software		 Bulletins:
CISEC:2956
CVE-2017-8623 		Severity:
Medium
Description:
Windows Hyper-V in Windows 10 1607, 1703, and Windows Server 2016 allows a denial of service vulnerability when it fails to properly validate input from a privileged user on a guest operating system, aka "Windows Hyper-V Denial of Service Vulnerability".
Applies to:
 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2974		 Title:
Windows Error Reporting Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2974
CVE-2017-8633 		Severity:
High
Description:
Windows Error Reporting (WER) in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability, aka "Windows Error Reporting Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2986		 Title:
Windows CLFS Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2986
CVE-2017-8624 		Severity:
High
Description:
CLFS in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to the way it handles objects in memory, aka "Windows CLFS Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2957		 Title:
Win32k Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2957
CVE-2017-8666 		Severity:
Low
Description:
Microsoft Win32k in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly handle objects in memory, aka "Win32k Information Disclosure Vulnerability".
Applies to:
 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2955		 Title:
Win32k Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2955
CVE-2017-8593 		Severity:
Medium
Description:
Microsoft Win32k in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2983		 Title:
Vulnerability in the MySQL Server		 Type:
Software		 Bulletins:
CISEC:2983
CVE-2017-3652 		Severity:
Medium
Description:
Vulnerability in the MySQL Server. Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier, 5.7.18 and earlier.
Applies to:
MySQL Server		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2972		 Title:
Volume Manager Extension Driver Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2972
CVE-2017-8668 		Severity:
Low
Description:
The Volume Manager Extension Driver in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2 allows an attacker to run a specially crafted application and obtain kernel information, aka "Volume Manager Extension Driver Information Disclosure Vulnerability".
Applies to:
 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2964		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2964
CVE-2017-8634 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
Applies to:
Microsoft Edge		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2960		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2960
CVE-2017-8518 		Severity:
High
Description:
Microsoft Edge allows a remote code execution vulnerability due to the way it accesses objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".
Applies to:
Microsoft Edge		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2961		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2961
CVE-2017-8639 		Severity:
High
Description:
Microsoft Edge in Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
Applies to:
Microsoft Edge		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2962		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2962
CVE-2017-8637 		Severity:
Low
Description:
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to bypass Arbitrary Code Guard (ACG) due to how Microsoft Edge accesses memory in code compiled by the Edge Just-In-Time (JIT) compiler, aka "Scripting Engine Security Feature Bypass Vulnerability".
Applies to:
Microsoft Edge		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2963		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2963
CVE-2017-8640 		Severity:
High
Description:
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
Applies to:
Microsoft Edge		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2975		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2975
CVE-2017-8636 		Severity:
High
Description:
Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2978		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2978
CVE-2017-8638 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
Applies to:
Microsoft Edge		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2979		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2979
CVE-2017-8655 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
Applies to:
Microsoft Edge		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2982		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2982
CVE-2017-8672 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, and CVE-2017-8674.
Applies to:
Microsoft Edge		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2984		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2984
CVE-2017-8645 		Severity:
High
Description:
Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
Applies to:
Microsoft Edge		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2989		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2989
CVE-2017-8646 		Severity:
High
Description:
Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
Applies to:
Microsoft Edge		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2981		 Title:
Scripting Engine Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2981
CVE-2017-8659 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the Chakra scripting engine not properly handling objects in memory, aka "Scripting Engine Information Disclosure Vulnerability".
Applies to:
Microsoft Edge		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2971		 Title:
Microsoft Office SharePoint XSS Vulnerability		 Type:
Software		 Bulletins:
CISEC:2971
CVE-2017-8654 		Severity:
Low
Description:
Microsoft SharePoint Server 2010 Service Pack 2 allows a cross-site scripting (XSS) vulnerability when it does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability".
Applies to:
Microsoft Office SharePoint Server 2010		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2969		 Title:
Microsoft Office Outlook Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:2969
CVE-2017-8571 		Severity:
Medium
Description:
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a security feature bypass vulnerability due to the way that it handles input, aka "Microsoft Office Outlook Security Feature Bypass Vulnerability".
Applies to:
Microsoft Outlook 2007
Microsoft Outlook 2010
Microsoft Outlook 2013
Microsoft Outlook 2016		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2967		 Title:
Microsoft Office Outlook Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2967
CVE-2017-8663 		Severity:
High
Description:
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a remote code execution vulnerability due to the way Microsoft Outlook parses specially crafted email messages, aka "Microsoft Office Outlook Memory Corruption Vulnerability"
Applies to:
Microsoft Outlook 2007
Microsoft Outlook 2010
Microsoft Outlook 2013
Microsoft Outlook 2016		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2973		 Title:
Microsoft Office Outlook Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2973
CVE-2017-8572 		Severity:
Medium
Description:
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows an information disclosure vulnerability due to the way that it discloses the contents of its memory, aka "Microsoft Office Outlook Information Disclosure Vulnerability".
Applies to:
Microsoft Outlook 2007
Microsoft Outlook 2010
Microsoft Outlook 2013
Microsoft Outlook 2016		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2976		 Title:
Microsoft Edge Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2976
CVE-2017-8642 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to elevate privileges due to the way that Microsoft Edge validates JavaScript under specific conditions, aka "Microsoft Edge Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8503.
Applies to:
Microsoft Edge		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2977		 Title:
Microsoft Edge Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2977
CVE-2017-8503 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to escape from the AppContainer sandbox, aka "Microsoft Edge Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8642.
Applies to:
Microsoft Edge		 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CVE-2015-1527		 Title:
Integer overflow in IAudioPolicyService.cpp in Android allows local users to gain privileges via a crafted application, aka Android Bug ID 19261727.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-1527
SFBID76665 		Severity:
Medium
Description:
Integer overflow in IAudioPolicyService.cpp in Android allows local users to gain privileges via a crafted application, aka Android Bug ID 19261727.
Applies to:
 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2970		 Title:
Express Compressed Fonts Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2970
CVE-2017-8691 		Severity:
High
Description:
Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow an attacker to execute code remotely on a target system when the Windows font library fails to properly handle specially crafted embedded fonts, aka "Express Compressed Fonts Remote Code Execution Vulnerability."
Applies to:
 Created:
2017-09-15		 Updated:
2023-01-26
ID:
CISEC:2923		 Title:
Vulnerability in MySQL Server 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2923
CVE-2017-3638 		Severity:
Medium
Description:
Vulnerability in MySQL Server 5.7.18 and earlier.
Applies to:
MySQL Server 5.7		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2924		 Title:
Vulnerability in MySQL Server 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2924
CVE-2017-3637 		Severity:
Low
Description:
Vulnerability in MySQL Server 5.7.18 and earlier.
Applies to:
MySQL Server 5.7		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2926		 Title:
Vulnerability in MySQL Server 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2926
CVE-2017-3529 		Severity:
Low
Description:
Vulnerability in MySQL Server 5.7.18 and earlier.
Applies to:
MySQL Server 5.7		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2927		 Title:
Vulnerability in MySQL Server 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2927
CVE-2017-3640 		Severity:
Medium
Description:
Vulnerability in MySQL Server 5.7.18 and earlier.
Applies to:
MySQL Server 5.7		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2932		 Title:
Vulnerability in MySQL Server 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2932
CVE-2017-3639 		Severity:
Medium
Description:
Vulnerability in MySQL Server 5.7.18 and earlier.
Applies to:
MySQL Server 5.7		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2925		 Title:
Vulnerability in MySQL Server 5.6.36 and earlier, 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2925
CVE-2017-3633 		Severity:
Medium
Description:
Vulnerability in MySQL Server 5.6.36 and earlier, 5.7.18 and earlier.
Applies to:
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2928		 Title:
Vulnerability in MySQL Server 5.6.36 and earlier, 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2928
CVE-2017-3634 		Severity:
Medium
Description:
Vulnerability in MySQL Server 5.6.36 and earlier, 5.7.18 and earlier.
Applies to:
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2929		 Title:
Vulnerability in MySQL Server 5.5.56 and earlier, 5.6.36 and earlier, 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2929
CVE-2017-3635 		Severity:
Low
Description:
Vulnerability in MySQL Server 5.5.56 and earlier, 5.6.36 and earlier, 5.7.18 and earlier.
Applies to:
MySQL Server 5.5
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2931		 Title:
Vulnerability in MySQL Server 5.5.56 and earlier, 5.6.36 and earlier		 Type:
Software		 Bulletins:
CISEC:2931
CVE-2017-3636 		Severity:
Medium
Description:
Vulnerability in MySQL Server 5.5.56 and earlier, 5.6.36 and earlier.
Applies to:
MySQL Server 5.5
MySQL Server 5.6		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2930		 Title:
Vulnerability in MySQL Cluster 7.3.5 and earlier		 Type:
Software		 Bulletins:
CISEC:2930
CVE-2014-1912 		Severity:
High
Description:
Vulnerability in MySQL Cluster 7.3.5 and earlier.
Applies to:
MySQL Cluster 7.3		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2938		 Title:
Vulnerability in Java SE: 8u131; Java SE Embedded: 8u131		 Type:
Software		 Bulletins:
CISEC:2938
CVE-2017-10111 		Severity:
Medium
Description:
Vulnerability in Java SE: 8u131; Java SE Embedded: 8u131
Applies to:
Java Development Kit 1.8
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2935		 Title:
Vulnerability in Java SE: 7u141, 8u131		 Type:
Software		 Bulletins:
CISEC:2935
CVE-2017-10114 		Severity:
Medium
Description:
Vulnerability in Java SE: 7u141, 8u131
Applies to:
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2933		 Title:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14		 Type:
Software		 Bulletins:
CISEC:2933
CVE-2017-10108 		Severity:
Medium
Description:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14
Applies to:
JRockit R28
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2934		 Title:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14		 Type:
Software		 Bulletins:
CISEC:2934
CVE-2017-10115 		Severity:
Medium
Description:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14
Applies to:
JRockit R28
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2936		 Title:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14		 Type:
Software		 Bulletins:
CISEC:2936
CVE-2017-10109 		Severity:
Medium
Description:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14
Applies to:
JRockit R28
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2937		 Title:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131		 Type:
Software		 Bulletins:
CISEC:2937
CVE-2017-10101 		Severity:
Medium
Description:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131
Applies to:
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2940		 Title:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131		 Type:
Software		 Bulletins:
CISEC:2940
CVE-2017-10107 		Severity:
Medium
Description:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131
Applies to:
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2941		 Title:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131		 Type:
Software		 Bulletins:
CISEC:2941
CVE-2017-10102 		Severity:
Medium
Description:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131
Applies to:
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2939		 Title:
Vulnerability in Java SE: 6u151, 7u141, 8u131		 Type:
Software		 Bulletins:
CISEC:2939
CVE-2017-10110 		Severity:
Medium
Description:
Vulnerability in Java SE: 6u151, 7u141, 8u131
Applies to:
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2942		 Title:
Vulnerability in Java SE: 6u151, 7u141, 8u131		 Type:
Software		 Bulletins:
CISEC:2942
CVE-2017-10105 		Severity:
Medium
Description:
Vulnerability in Java SE: 6u151, 7u141, 8u131
Applies to:
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2843		 Title:
Unspecified vulnerability in Oracle Java SE 8u131		 Type:
Software		 Bulletins:
CISEC:2843
CVE-2017-10078 		Severity:
Medium
Description:
Unspecified vulnerability in Oracle Java SE 8u131.
Applies to:
Java Development Kit 1.8
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2847		 Title:
Unspecified vulnerability in Oracle Java SE 7u141, and 8u131; Java SE Embedded 8u131		 Type:
Software		 Bulletins:
CISEC:2847
CVE-2017-10090 		Severity:
Medium
Description:
Unspecified vulnerability in Oracle Java SE 7u141, and 8u131; Java SE Embedded 8u131.
Applies to:
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2838		 Title:
Unspecified vulnerability in Oracle Java SE 7u141, and 8u131		 Type:
Software		 Bulletins:
CISEC:2838
CVE-2017-10086 		Severity:
Medium
Description:
Unspecified vulnerability in Oracle Java SE 7u141, and 8u131.
Applies to:
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2839		 Title:
Unspecified vulnerability in Oracle Java SE 6u151, 7u141, and 8u131; Java SE Embedded 8u131; and JRockit R28.3.14		 Type:
Software		 Bulletins:
CISEC:2839
CVE-2017-10053 		Severity:
Medium
Description:
Unspecified vulnerability in Oracle Java SE 6u151, 7u141, and 8u131; Java SE Embedded 8u131; and JRockit R28.3.14.
Applies to:
JRockit
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2841		 Title:
Unspecified vulnerability in Oracle Java SE 6u151, 7u141, and 8u131; Java SE Embedded 8u131		 Type:
Software		 Bulletins:
CISEC:2841
CVE-2017-10096 		Severity:
Medium
Description:
Unspecified vulnerability in Oracle Java SE 6u151, 7u141, and 8u131; Java SE Embedded 8u131.
Applies to:
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2842		 Title:
Unspecified vulnerability in Oracle Java SE 6u151, 7u141, and 8u131; Java SE Embedded 8u131		 Type:
Software		 Bulletins:
CISEC:2842
CVE-2017-10081 		Severity:
Medium
Description:
Unspecified vulnerability in Oracle Java SE 6u151, 7u141, and 8u131; Java SE Embedded 8u131.
Applies to:
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2845		 Title:
Unspecified vulnerability in Oracle Java SE 6u151, 7u141, and 8u131; Java SE Embedded 8u131		 Type:
Software		 Bulletins:
CISEC:2845
CVE-2017-10087 		Severity:
Medium
Description:
Unspecified vulnerability in Oracle Java SE 6u151, 7u141, and 8u131; Java SE Embedded 8u131.
Applies to:
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2846		 Title:
Unspecified vulnerability in Oracle Java SE 6u151, 7u141, and 8u131; Java SE Embedded 8u131		 Type:
Software		 Bulletins:
CISEC:2846
CVE-2017-10074 		Severity:
Medium
Description:
Unspecified vulnerability in Oracle Java SE 6u151, 7u141, and 8u131; Java SE Embedded 8u131.
Applies to:
JRockit
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2840		 Title:
Unspecified vulnerability in Oracle Java SE 6u151, 7u141, and 8u131		 Type:
Software		 Bulletins:
CISEC:2840
CVE-2017-10089 		Severity:
Medium
Description:
Unspecified vulnerability in Oracle Java SE 6u151, 7u141, and 8u131.
Applies to:
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2844		 Title:
Unspecified vulnerability in Oracle Java SE 6u151, 7u141, and 8u131		 Type:
Software		 Bulletins:
CISEC:2844
CVE-2017-10067 		Severity:
Medium
Description:
Unspecified vulnerability in Oracle Java SE 6u151, 7u141, and 8u131.
Applies to:
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-08		 Updated:
2023-01-26
ID:
CISEC:2867		 Title:
WBXML dissector infinite loop		 Type:
Software		 Bulletins:
CISEC:2867
CVE-2017-7702 		Severity:
High
Description:
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding length validation.
Applies to:
Wireshark		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2850		 Title:
Vulnerability in the MySQL Server		 Type:
Software		 Bulletins:
CISEC:2850
CVE-2017-3651 		Severity:
Medium
Description:
Vulnerability in the MySQL Server. Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier, 5.7.18 and earlier.
Applies to:
MySQL Server		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2853		 Title:
Vulnerability in Oracle MySQL 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2853
CVE-2017-3645 		Severity:
Medium
Description:
Vulnerability in Oracle MySQL 5.7.18 and earlier
Applies to:
MySQL Server 5.7		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2857		 Title:
Vulnerability in Oracle MySQL 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2857
CVE-2017-3650 		Severity:
Medium
Description:
Vulnerability in Oracle MySQL 5.7.18 and earlier
Applies to:
MySQL Server 5.7		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2859		 Title:
Vulnerability in Oracle MySQL 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2859
CVE-2017-3643 		Severity:
Medium
Description:
Vulnerability in Oracle MySQL 5.7.18 and earlier
Applies to:
MySQL Server 5.7		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2861		 Title:
Vulnerability in Oracle MySQL 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2861
CVE-2017-3642 		Severity:
Medium
Description:
Vulnerability in Oracle MySQL 5.7.18 and earlier
Applies to:
MySQL Server 5.7		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2862		 Title:
Vulnerability in Oracle MySQL 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2862
CVE-2017-3644 		Severity:
Medium
Description:
Vulnerability in Oracle MySQL 5.7.18 and earlier
Applies to:
MySQL Server 5.7		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2858		 Title:
Vulnerability in Oracle MySQL 5.7.16 and earlier		 Type:
Software		 Bulletins:
CISEC:2858
CVE-2017-3646 		Severity:
Medium
Description:
Vulnerability in Oracle MySQL 5.7.16 and earlier
Applies to:
MySQL Server 5.7		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2854		 Title:
Vulnerability in Oracle MySQL 5.6.36 and earlier, 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2854
CVE-2017-3647 		Severity:
Medium
Description:
Vulnerability in Oracle MySQL 5.6.36 and earlier, 5.7.18 and earlier
Applies to:
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2860		 Title:
Vulnerability in Oracle MySQL 5.6.36 and earlier, 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2860
CVE-2017-3649 		Severity:
Medium
Description:
Vulnerability in Oracle MySQL 5.6.36 and earlier, 5.7.18 and earlier
Applies to:
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2855		 Title:
Vulnerability in Oracle MySQL 5.5.56 and earlier, 5.6.36 and earlier, 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2855
CVE-2017-3648 		Severity:
Medium
Description:
Vulnerability in Oracle MySQL 5.5.56 and earlier, 5.6.36 and earlier, 5.7.18 and earlier
Applies to:
MySQL Server 5.5
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2856		 Title:
Vulnerability in Oracle MySQL 5.5.56 and earlier, 5.6.36 and earlier, 5.7.18 and earlier		 Type:
Software		 Bulletins:
CISEC:2856
CVE-2017-3641 		Severity:
Medium
Description:
Vulnerability in Oracle MySQL 5.5.56 and earlier, 5.6.36 and earlier, 5.7.18 and earlier
Applies to:
MySQL Server 5.5
MySQL Server 5.6
MySQL Server 5.7		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2852		 Title:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14		 Type:
Software		 Bulletins:
CISEC:2852
CVE-2017-10116 		Severity:
Medium
Description:
Vulnerability in Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 - CVE-2017-10116
Applies to:
JRockit
Java Development Kit 1.6
Java Development Kit 1.7
Java Development Kit 1.8
Java Runtime Environment 1.6
Java Runtime Environment 1.7
Java Runtime Environment 1.8		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2848		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2848
CVE-2017-8618 		Severity:
High
Description:
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 Internet Explorer in the way affected Microsoft scripting engines render when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-8596, CVE-2017-8610, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, CVE-2017-8619, CVE-2017-9598 and CVE-2017-8609.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2849		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2849
CVE-2017-8619 		Severity:
High
Description:
Microsoft Edge on Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability in the way affected Microsoft scripting engines render when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-8596, CVE-2017-8610, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, CVE-2017-8618, CVE-2017-9598 and CVE-2017-8609.
Applies to:
Microsoft Edge		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2864		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2864
CVE-2017-8608 		Severity:
High
Description:
Microsoft browsers in Microsoft Windows Server 2008 and R2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engines fail to render when handling objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8598, CVE-2017-8596, CVE-2017-8610, CVE-2017-8601, CVE-2017-8618, CVE-2017-8619, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8595, CVE-2017-8606, CVE-2017-8607, and CVE-2017-8609.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2865		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2865
CVE-2017-8609 		Severity:
High
Description:
Microsoft Internet Explorer in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8596, CVE-2017-8610, CVE-2017-8618, CVE-2017-8619, CVE-2017-8595, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, and CVE-2017-8609.
Applies to:
Microsoft Edge		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2866		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2866
CVE-2017-8610 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8598, CVE-2017-8596, CVE-2017-8595, CVE-2017-8618, CVE-2017-8619, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, and CVE-2017-8609.
Applies to:
Microsoft Edge		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2863		 Title:
NetScaler file parser infinite loop		 Type:
Software		 Bulletins:
CISEC:2863
CVE-2017-7700 		Severity:
High
Description:
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the NetScaler file parser could go into an infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by ensuring a nonzero record size.
Applies to:
Wireshark		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2851		 Title:
Microsoft Browser Security Feature Bypass		 Type:
Software		 Bulletins:
CISEC:2851
CVE-2017-8592 		Severity:
Medium
Description:
Microsoft browsers on when Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows RT 8.1, and Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow a security feature bypass vulnerability when they improperly handle redirect requests, aka "Microsoft Browser Security Feature Bypass".
Applies to:
Microsoft Edge
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-09-01		 Updated:
2023-01-26
ID:
CISEC:2816		 Title:
Windows PowerShell Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2816
CVE-2017-8565 		Severity:
High
Description:
Windows PowerShell in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability when PSObject wraps a CIM Instance, aka "Windows PowerShell Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2802		 Title:
Windows IME Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2802
CVE-2017-8566 		Severity:
Medium
Description:
Microsoft Windows 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to Windows Input Method Editor (IME) improperly handling parameters in a method of a DCOM class, aka "Windows IME Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2795		 Title:
Windows Explorer Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2795
CVE-2017-8463 		Severity:
High
Description:
Windows Shell in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability due to the way it improperly handles executable files and shares during rename operations, aka "Windows Explorer Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2796		 Title:
Windows Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2796
CVE-2017-8563 		Severity:
Medium
Description:
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to Kerberos falling back to NT LAN Manager (NTLM) Authentication Protocol as the default authentication protocol, aka "Windows Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2803		 Title:
Windows CLFS Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2803
CVE-2017-8590 		Severity:
Medium
Description:
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to the way that the Windows Common Log File System (CLFS) driver handles objects in memory, aka "Windows CLFS Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2799		 Title:
Windows ALPC Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2799
CVE-2017-8562 		Severity:
Medium
Description:
Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to Windows improperly handling calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2827		 Title:
Use after free in Blink		 Type:
Web		 Bulletins:
CISEC:2827
CVE-2017-5064 		Severity:
Medium
Description:
Use after free in Blink.
Applies to:
Google Chrome		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2798		 Title:
SharePoint Server XSS Vulnerability		 Type:
Software		 Bulletins:
CISEC:2798
CVE-2017-8569 		Severity:
Medium
Description:
Microsoft SharePoint Server allows an elevation of privilege vulnerability due to the way that it sanitizes a specially crafted web request to an affected SharePoint server, aka "SharePoint Server XSS Vulnerability".
Applies to:
Microsoft Sharepoint Server 2016		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2837		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2837
CVE-2017-8607 		Severity:
High
Description:
Microsoft browsers in Microsoft Windows 7, Windows Server 2008 and R2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engines fail to render when handling objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8598, CVE-2017-8596, CVE-2017-8618, CVE-2017-8619, CVE-2017-8610, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8595, CVE-2017-8606, CVE-2017-8608, and CVE-2017-8609.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2805		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2805
CVE-2017-8598 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8596, CVE-2017-8610, CVE-2017-8618, CVE-2017-8619, CVE-2017-8595, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, and CVE-2017-8609.
Applies to:
Microsoft Edge		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2806		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2806
CVE-2017-8606 		Severity:
High
Description:
Microsoft browsers in Microsoft Windows 7, Windows Server 2008 and R2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engines fail to render when handling objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8598, CVE-2017-8596, CVE-2017-8618, CVE-2017-8619, CVE-2017-8610, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8595, CVE-2017-8607, CVE-2017-8608, and CVE-2017-8609.
Applies to:
Microsoft Edge
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2817		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2817
CVE-2017-8601 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8596, CVE-2017-8610, CVE-2017-8618, CVE-2017-8619, CVE-2017-8595, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, and CVE-2017-8609.
Applies to:
Microsoft Edge		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2818		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2818
CVE-2017-8604 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8596, CVE-2017-8618, CVE-2017-8619, CVE-2017-8601, CVE-2017-8610, CVE-2017-8603, CVE-2017-8598, CVE-2017-8601, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, and CVE-2017-8609.
Applies to:
Microsoft Edge		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2819		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2819
CVE-2017-8603 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8596, CVE-2017-8610, CVE-2017-8598, CVE-2017-8618, CVE-2017-8619, CVE-2017-8595, CVE-2017-8601, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, and CVE-2017-8609.
Applies to:
Microsoft Edge		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2820		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2820
CVE-2017-8605 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8596, CVE-2017-8601, CVE-2017-8618, CVE-2017-8619, CVE-2017-8610, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8598, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, and CVE-2017-8609.
Applies to:
Microsoft Edge		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2801		 Title:
Microsoft Malware Protection Engine Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2801
CVE-2017-8558 		Severity:
High
Description:
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on 32-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703 does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2813		 Title:
Local Information Disclosure Vulnerability in ImageMagick before 7.0.5-2		 Type:
Software		 Bulletins:
CISEC:2813
CVE-2017-9098 		Severity:
Medium
Description:
ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users. This is caused by a missing initialization step in the ReadRLEImage function in coders/rle.c.
Applies to:
ImageMagick		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2809		 Title:
Local Denial of Service Vulnerability in ImageMagick 7.0.5-7		 Type:
Software		 Bulletins:
CISEC:2809
CVE-2017-9142 		Severity:
Medium
Description:
In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the ReadOneJNGImage function in coders/png.c.
Applies to:
ImageMagick		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2825		 Title:
Incorrect UI in Blink		 Type:
Web		 Bulletins:
CISEC:2825
CVE-2017-5065 		Severity:
Medium
Description:
Incorrect UI in Blink.
Applies to:
Google Chrome		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2824		 Title:
Incorrect signature handing in Networking		 Type:
Web		 Bulletins:
CISEC:2824
CVE-2017-5066 		Severity:
Medium
Description:
Incorrect signature handing in Networking.
Applies to:
Google Chrome		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2797		 Title:
Https.sys Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2797
CVE-2017-8582 		Severity:
Medium
Description:
HTTP.sys in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when the component improperly handles objects in memory, aka "Https.sys Information Disclosure Vulnerability".
Applies to:
 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2804		 Title:
HoloLens Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2804
CVE-2017-8584 		Severity:
High
Description:
Windows 10 1607 and Windows Server 2016 allow an attacker to execute code remotely via a specially crafted WiFi packet aka "HoloLens Remote Code Execution Vulnerability."
Applies to:
 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2828		 Title:
Heap overflow in Skia		 Type:
Web		 Bulletins:
CISEC:2828
CVE-2017-5063 		Severity:
Medium
Description:
Heap overflow in Skia.
Applies to:
Google Chrome		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2800		 Title:
DirectX Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2800
CVE-2017-8579 		Severity:
Medium
Description:
The DirectX component in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to run arbitrary code in kernel mode via a specially crafted application, aka "DirectX Elevation of Privilege Vulnerability."
Applies to:
 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2812		 Title:
Denial of Service Vulnerability in ImageMagick 7.0.5-7		 Type:
Software		 Bulletins:
CISEC:2812
CVE-2017-9141 		Severity:
Medium
Description:
In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the ResetImageProfileIterator function in MagickCore/profile.c because of missing checks in the ReadDDSImage function in coders/dds.c.
Applies to:
ImageMagick		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2808		 Title:
Denial of Service Vulnerability in ImageMagick 7.0.5-6		 Type:
Software		 Bulletins:
CISEC:2808
CVE-2017-9261 		Severity:
Medium
Description:
In ImageMagick 7.0.5-6 Q16, the ReadMNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2811		 Title:
Denial of Service Vulnerability in ImageMagick 7.0.5-6		 Type:
Software		 Bulletins:
CISEC:2811
CVE-2017-9262 		Severity:
Medium
Description:
In ImageMagick 7.0.5-6 Q16, the ReadJNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2815		 Title:
Denial of Service Vulnerability in ImageMagick 7.0.5-6		 Type:
Software		 Bulletins:
CISEC:2815
CVE-2017-8830 		Severity:
Medium
Description:
In ImageMagick 7.0.5-6, the ReadBMPImage function in bmp.c:1379 allows attackers to cause a denial of service (memory leak) via a crafted file.
Applies to:
ImageMagick		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2807		 Title:
Denial of Service Vulnerability in ImageMagick 7.0.5-5		 Type:
Software		 Bulletins:
CISEC:2807
CVE-2017-9143 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, the ReadARTImage function in coders/art.c allows attackers to cause a denial of service (memory leak) via a crafted .art file.
Applies to:
ImageMagick		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2810		 Title:
Denial of Service Vulnerability in ImageMagick 7.0.5-5		 Type:
Software		 Bulletins:
CISEC:2810
CVE-2017-8765 		Severity:
High
Description:
The function named ReadICONImage in coders\icon.c in ImageMagick 7.0.5-5 has a memory leak vulnerability which can cause memory exhaustion via a crafted ICON file.
Applies to:
ImageMagick		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2814		 Title:
Denial of Service Vulnerability in ImageMagick 7.0.5-5		 Type:
Software		 Bulletins:
CISEC:2814
CVE-2017-9144 		Severity:
Medium
Description:
In ImageMagick 7.0.5-5, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c.
Applies to:
ImageMagick		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2826		 Title:
Cross-origin bypass in Blink		 Type:
Web		 Bulletins:
CISEC:2826
CVE-2017-5069 		Severity:
Medium
Description:
Cross-origin bypass in Blink.
Applies to:
Google Chrome		 Created:
2017-08-25		 Updated:
2023-01-26
ID:
CISEC:2781		 Title:
WordPad Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2781
CVE-2017-8588 		Severity:
High
Description:
Microsoft WordPad in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability due to the way it parses specially crafted files, aka "WordPad Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2757		 Title:
Windows System Information Console Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2757
CVE-2017-8557 		Severity:
Low
Description:
Windows System Information Console in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a information disclosure vulnerability improperly parses XML input containing a reference to an external entity, aka "Windows System Information Console Information Disclosure Vulnerability".
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2782		 Title:
Windows Search Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2782
CVE-2017-8589 		Severity:
High
Description:
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability due to the way that Windows Search handles objects in memory, aka "Windows Search Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2756		 Title:
Windows Performance Monitor Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2756
CVE-2017-0170 		Severity:
Medium
Description:
Windows Performance Monitor in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a information disclosure vulnerability due to the way it parses XML input, aka "Windows Performance Monitor Information Disclosure Vulnerability".
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2751		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2751
CVE-2017-8564 		Severity:
Low
Description:
Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly initialize a memory address, aka "Windows Kernel Information Disclosure Vulnerability".
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2749		 Title:
Windows Kernel Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2749
CVE-2017-8561 		Severity:
Medium
Description:
Windows kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to the way it handles objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2742		 Title:
Windows Explorer Denial of Service Vulnerability		 Type:
Software		 Bulletins:
CISEC:2742
CVE-2017-8587 		Severity:
Medium
Description:
Windows Explorer in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511 allows a denial of service vulnerability when it attempts to open a non-existent file, aka "Windows Explorer Denial of Service Vulnerability".
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2745		 Title:
Win32k Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2745
CVE-2017-8486 		Severity:
Low
Description:
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure due to the way it handles objects in memory, aka "Win32k Information Disclosure Vulnerability".
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2747		 Title:
Win32k Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2747
CVE-2017-8554 		Severity:
Low
Description:
The kernel in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an authenticated attacker to obtain memory contents via a specially crafted application.
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2743		 Title:
Win32k Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2743
CVE-2017-8581 		Severity:
Low
Description:
Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8578, CVE-2017-8580, CVE-2017-8577, and CVE-2017-8467.
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2744		 Title:
Win32k Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2744
CVE-2017-8580 		Severity:
Medium
Description:
Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8577, CVE-2017-8578, CVE-2017-8581, and CVE-2017-8467.
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2746		 Title:
Win32k Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2746
CVE-2017-8577 		Severity:
Medium
Description:
Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8578, CVE-2017-8580, CVE-2017-8581, and CVE-2017-8467.
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2748		 Title:
Win32k Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2748
CVE-2017-8578 		Severity:
High
Description:
Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8577, CVE-2017-8580, CVE-2017-8581, and CVE-2017-8467.
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2750		 Title:
Win32k Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2750
CVE-2017-8467 		Severity:
Medium
Description:
Graphics in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to the way it handles objects in memory, aka "Win32k Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2775		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2775
CVE-2017-8595 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8596, CVE-2017-8601,CVE-2017-8618, CVE-2017-8619, CVE-2017-8610, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, and CVE-2017-8609.
Applies to:
Microsoft Edge		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2779		 Title:
Scripting Engine Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2779
CVE-2017-8596 		Severity:
High
Description:
Microsoft Edge in Microsoft Windows 10 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8598, CVE-2017-8610, CVE-2017-8595, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, and CVE-2017-8609.
Applies to:
Microsoft Edge		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2729		 Title:
Office Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2729
CVE-2017-8510 		Severity:
High
Description:
A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8509, CVE-2017-8511, CVE-2017-8512, CVE-2017-0260, and CVE-2017-8506.
Applies to:
Microsoft Office 2007
Microsoft Office 2010
Microsoft Office 2013
Microsoft Office 2016		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2730		 Title:
Office Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2730
CVE-2017-8506 		Severity:
High
Description:
A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8509, CVE-2017-8510, CVE-2017-8511, CVE-2017-8512, and CVE-2017-0260.
Applies to:
Microsoft Office 2010
Microsoft Office 2013
Microsoft Office 2016		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2731		 Title:
Office Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2731
CVE-2017-8507 		Severity:
High
Description:
A remote code execution vulnerability exists in the way Microsoft Office software parses specially crafted email messages, aka "Microsoft Office Memory Corruption Vulnerability".
Applies to:
Microsoft Office 2007
Microsoft Office 2010
Microsoft Office 2013
Microsoft Office 2016		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2732		 Title:
Office Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2732
CVE-2017-8508 		Severity:
Medium
Description:
A security feature bypass vulnerability exists in Microsoft Office software when it improperly handles the parsing of file formats, aka "Microsoft Office Security Feature Bypass Vulnerability".
Applies to:
Microsoft Office 2007
Microsoft Office 2010
Microsoft Office 2013
Microsoft Office 2016		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2738		 Title:
Microsoft Office Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2738
CVE-2017-8570 		Severity:
High
Description:
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0243.
Applies to:
Microsoft Office 2007
Microsoft Office 2010
Microsoft Office 2013
Microsoft Office 2016		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2739		 Title:
Microsoft Office Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2739
CVE-2017-0243 		Severity:
High
Description:
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8570.
Applies to:
Microsoft Office 2007
Microsoft Office 2010
Microsoft Office 2013
Microsoft Office 2016		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2740		 Title:
Microsoft Office Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2740
CVE-2017-8501 		Severity:
High
Description:
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8502.
Applies to:
Microsoft Excel 2007
Microsoft Excel 2010
Microsoft Excel 2013
Microsoft Excel 2016
Microsoft Excel Viewer
Microsoft Office Compatibility Pack
Microsoft Office Online Server 2016
Microsoft SharePoint Server 2010		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2741		 Title:
Microsoft Office Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2741
CVE-2017-8502 		Severity:
High
Description:
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8501.
Applies to:
Microsoft Excel 2010
Microsoft Excel 2013
Microsoft Excel 2016		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2761		 Title:
Microsoft Graphics Component Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2761
CVE-2017-8575 		Severity:
Low
Description:
The kernel in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application, aka "Microsoft Graphics Component Information Disclosure Vulnerability."
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2758		 Title:
Microsoft Graphics Component Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2758
CVE-2017-8574 		Severity:
Medium
Description:
Graphics in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Microsoft Graphics Component Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8573 and CVE-2017-8556.
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2759		 Title:
Microsoft Graphics Component Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2759
CVE-2017-8573 		Severity:
Medium
Description:
Graphics in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Microsoft Graphics Component Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8574 and CVE-2017-8556.
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2760		 Title:
Microsoft Graphics Component Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2760
CVE-2017-8556 		Severity:
Medium
Description:
Graphics in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Microsoft Graphics Component Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8573 and CVE-2017-8574.
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2762		 Title:
Microsoft Graphics Component Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2762
CVE-2017-8576 		Severity:
Medium
Description:
The graphics component in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to run arbitrary code in kernel mode via a specially crafted application, aka "Microsoft Graphics Component Elevation of Privilege Vulnerability."
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2733		 Title:
Microsoft Exchange Open Redirect Vulnerability		 Type:
Software		 Bulletins:
CISEC:2733
CVE-2017-8621 		Severity:
Medium
Description:
Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an open redirect vulnerability that could lead to spoofing, aka "Microsoft Exchange Open Redirect Vulnerability".
Applies to:
Microsoft Exchange 2010
Microsoft Exchange 2013
Microsoft Exchange 2016		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2734		 Title:
Microsoft Exchange Cross-Site Scripting Vulnerability		 Type:
Software		 Bulletins:
CISEC:2734
CVE-2017-8559 		Severity:
Medium
Description:
Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability". This CVE ID is unique from CVE-2017-8560.
Applies to:
Microsoft Exchange 2013
Microsoft Exchange 2016		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2736		 Title:
Microsoft Exchange Cross-Site Scripting Vulnerability		 Type:
Software		 Bulletins:
CISEC:2736
CVE-2017-8560 		Severity:
Medium
Description:
Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability". This CVE ID is unique from CVE-2017-8559.
Applies to:
Microsoft Exchange 2013
Microsoft Exchange 2016		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2776		 Title:
Microsoft Edge Spoofing Vulnerability		 Type:
Software		 Bulletins:
CISEC:2776
CVE-2017-8611 		Severity:
Medium
Description:
Microsoft Edge on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows remote attackers to spoof web content via a crafted web site, aka "Microsoft Edge Spoofing Vulnerability."
Applies to:
Microsoft Edge		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2777		 Title:
Microsoft Edge Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:2777
CVE-2017-8599 		Severity:
Medium
Description:
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with malicious content when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted documents, aka "Microsoft Edge Security Feature Bypass Vulnerability".
Applies to:
Microsoft Edge		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2778		 Title:
Microsoft Edge Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2778
CVE-2017-8617 		Severity:
High
Description:
Microsoft Edge in Windows 10 1703 Microsoft Edge allows a remote code execution vulnerability in the way affected Microsoft scripting engines render when handling objects in memory, aka "Microsoft Edge Remote Code Execution Vulnerability."
Applies to:
Microsoft Edge		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2752		 Title:
Microsoft Browser Security Feature Bypass		 Type:
Software		 Bulletins:
CISEC:2752
CVE-2017-8602 		Severity:
Medium
Description:
Microsoft browsers on Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow a spoofing vulnerability in the way they parse HTTP content, aka "Microsoft Browser Spoofing Vulnerability."
Applies to:
Microsoft Edge
Microsoft Internet Explorer 11		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2755		 Title:
Kerberos SNAME Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:2755
CVE-2017-8495 		Severity:
Medium
Description:
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to bypass Extended Protection for Authentication when Kerberos fails to prevent tampering with the SNAME field during ticket exchange, aka "Kerberos SNAME Security Feature Bypass Vulnerability" or Orpheus' Lyre.
Applies to:
 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2780		 Title:
Internet Explorer Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:2780
CVE-2017-8594 		Severity:
High
Description:
Internet Explorer on Microsoft Windows 8.1 and Windows RT 8.1, and Windows Server 2012 R2 allows an attacker to execute arbitrary code in the context of the current user when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability".
Applies to:
Microsoft Internet Explorer 11		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2763		 Title:
In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference		 Type:
Software		 Bulletins:
CISEC:2763
CVE-2017-9347 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/asn1/ros/packet-ros-template.c by validating an OID.
Applies to:
Wireshark		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2772		 Title:
In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash		 Type:
Software		 Bulletins:
CISEC:2772
CVE-2017-9353 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed in epan/dissectors/packet-ipv6.c by validating an IPv6 address.
Applies to:
Wireshark		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2768		 Title:
In Wireshark 2.2.0 to 2.2.6, the DOF dissector could read past the end of a buffer		 Type:
Software		 Bulletins:
CISEC:2768
CVE-2017-9348 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.6, the DOF dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-dof.c by validating a size value.
Applies to:
Wireshark		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2769		 Title:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the SoulSeek dissector could go into an infinite loop		 Type:
Software		 Bulletins:
CISEC:2769
CVE-2017-9346 		Severity:
High
Description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the SoulSeek dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-slsk.c by making loop bounds more explicit.
Applies to:
Wireshark		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2773		 Title:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the RGMP dissector could crash		 Type:
Software		 Bulletins:
CISEC:2773
CVE-2017-9354 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the RGMP dissector could crash. This was addressed in epan/dissectors/packet-rgmp.c by validating an IPv4 address.
Applies to:
Wireshark		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2764		 Title:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory		 Type:
Software		 Bulletins:
CISEC:2764
CVE-2017-9350 		Severity:
High
Description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-opensafety.c by checking for a negative length.
Applies to:
Wireshark		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2765		 Title:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the MSNIP dissector misuses a NULL pointer		 Type:
Software		 Bulletins:
CISEC:2765
CVE-2017-9343 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the MSNIP dissector misuses a NULL pointer. This was addressed in epan/dissectors/packet-msnip.c by validating an IPv4 address.
Applies to:
Wireshark		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2774		 Title:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DNS dissector could go into an infinite loop		 Type:
Software		 Bulletins:
CISEC:2774
CVE-2017-9345 		Severity:
High
Description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DNS dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-dns.c by trying to detect self-referencing pointers.
Applies to:
Wireshark		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2767		 Title:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DICOM dissector has an infinite loop		 Type:
Software		 Bulletins:
CISEC:2767
CVE-2017-9349 		Severity:
High
Description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DICOM dissector has an infinite loop. This was addressed in epan/dissectors/packet-dcm.c by validating a length value.
Applies to:
Wireshark		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2766		 Title:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer		 Type:
Software		 Bulletins:
CISEC:2766
CVE-2017-9351 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-bootp.c by extracting the Vendor Class Identifier more carefully.
Applies to:
Wireshark		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2771		 Title:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bluetooth L2CAP dissector could divide by zero		 Type:
Software		 Bulletins:
CISEC:2771
CVE-2017-9344 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bluetooth L2CAP dissector could divide by zero. This was addressed in epan/dissectors/packet-btl2cap.c by validating an interval value.
Applies to:
Wireshark		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2770		 Title:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bazaar dissector could go into an infinite loop		 Type:
Software		 Bulletins:
CISEC:2770
CVE-2017-9352 		Severity:
High
Description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bazaar dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-bzr.c by ensuring that backwards parsing cannot occur.
Applies to:
Wireshark		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2754		 Title:
.NET Denial of Service Vulnerability		 Type:
Software		 Bulletins:
CISEC:2754
CVE-2017-8585 		Severity:
Medium
Description:
Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service, aka .NET Denial of Service Vulnerability.
Applies to:
Microsoft .NET Framework 4.6
Microsoft .NET Framework 4.6.1
Microsoft .NET Framework 4.6.2
Microsoft .NET Framework 4.7		 Created:
2017-08-18		 Updated:
2023-01-26
ID:
CISEC:2719		 Title:
WSP infinite loop in Wireshark		 Type:
Software		 Bulletins:
CISEC:2719
CVE-2017-6471 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a WSP infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wsp.c by validating the capability length.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2718		 Title:
RTMPT dissector infinite loop in Wireshark		 Type:
Software		 Bulletins:
CISEC:2718
CVE-2017-6472 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an RTMPT dissector infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-rtmpt.c by properly incrementing a certain sequence value.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2722		 Title:
NetScaler file parser infinite loop in Wireshark		 Type:
Software		 Bulletins:
CISEC:2722
CVE-2017-6474 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by validating record sizes.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2727		 Title:
Netscaler file parser infinite loop in Wireshark		 Type:
Software		 Bulletins:
CISEC:2727
CVE-2017-6467 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a Netscaler file parser infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by changing the restrictions on file size.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2723		 Title:
NetScaler file parser crash in Wireshark		 Type:
Software		 Bulletins:
CISEC:2723
CVE-2017-6468 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser crash, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by validating the relationship between pages and records.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2713		 Title:
NCP dissector crash in Wireshark		 Type:
Software		 Bulletins:
CISEC:2713
CVE-2016-7958 		Severity:
Medium
Description:
In Wireshark 2.2.0, the NCP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/CMakeLists.txt by registering this dissector.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2725		 Title:
LDSS dissector crash in Wireshark		 Type:
Software		 Bulletins:
CISEC:2725
CVE-2017-6469 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-ldss.c by ensuring that memory is allocated for a certain data structure.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2716		 Title:
K12 file parser crash in Wireshark		 Type:
Software		 Bulletins:
CISEC:2716
CVE-2017-6473 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a K12 file parser crash, triggered by a malformed capture file. This was addressed in wiretap/k12.c by validating the relationships between lengths and offsets.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2720		 Title:
IAX2 infinite loop in Wireshark		 Type:
Software		 Bulletins:
CISEC:2720
CVE-2017-6470 		Severity:
High
Description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an IAX2 infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-iax2.c by constraining packet lateness.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2726		 Title:
DHCPv6 large loop in Wireshark		 Type:
Software		 Bulletins:
CISEC:2726
CVE-2017-5597 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the DHCPv6 dissector could go into a large loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-dhcpv6.c by changing a data type to avoid an integer overflow.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2715		 Title:
Denial of Service Vulnerability in Wireshark 2.2.7		 Type:
Software		 Bulletins:
CISEC:2715
CVE-2017-9766 		Severity:
Medium
Description:
In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWriteReq function in plugins/profinet/packet-dcerpc-pn-io.c.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2721		 Title:
Denial of Service Vulnerability in Wireshark 2.2.7		 Type:
Software		 Bulletins:
CISEC:2721
CVE-2017-9617 		Severity:
Medium
Description:
In Wireshark 2.2.7, deeply nested DAAP data may cause stack exhaustion (uncontrolled recursion) in the dissect_daap_one_tag function in epan/dissectors/packet-daap.c in the DAAP dissector.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2724		 Title:
Denial of Service Vulnerability in Wireshark 2.2.7		 Type:
Software		 Bulletins:
CISEC:2724
CVE-2017-9616 		Severity:
Medium
Description:
In Wireshark 2.2.7, overly deep mp4 chunks may cause stack exhaustion (uncontrolled recursion) in the dissect_mp4_box function in epan/dissectors/file-mp4.c.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2714		 Title:
Denial of Service Vulnerability in Wireshark		 Type:
Software		 Bulletins:
CISEC:2714
CVE-2017-6014 		Severity:
High
Description:
In Wireshark 2.2.4 and earlier, a crafted or malformed STANAG 4607 capture file will cause an infinite loop and memory exhaustion. If the packet size field in a packet header is null, the offset to read from will not advance, causing continuous attempts to read the same zero length packet. This will quickly exhaust all system memory.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2728		 Title:
Bluetooth L2CAP dissector crash in Wireshark		 Type:
Software		 Bulletins:
CISEC:2728
CVE-2016-7957 		Severity:
Medium
Description:
In Wireshark 2.2.0, the Bluetooth L2CAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-btl2cap.c by avoiding use of a seven-byte memcmp for potentially shorter strings.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2717		 Title:
ASTERIX infinite loop in Wireshark		 Type:
Software		 Bulletins:
CISEC:2717
CVE-2017-5596 		Severity:
Medium
Description:
In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the ASTERIX dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-asterix.c by changing a data type to avoid an integer overflow.
Applies to:
Wireshark		 Created:
2017-08-11		 Updated:
2018-05-25
ID:
CISEC:2697		 Title:
Windows VAD Cloning Denial of Service Vulnerability		 Type:
Software		 Bulletins:
CISEC:2697
CVE-2017-8515 		Severity:
Medium
Description:
Microsoft Windows 10 1511, 1607, and 1703, and Windows Server 2016 allow an unauthenticated attacker to send a specially crafted kernel mode request to cause a denial of service on the target system, aka "Windows VAD Cloning Denial of Service Vulnerability".
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2687		 Title:
Windows Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:2687
CVE-2017-8493 		Severity:
Low
Description:
Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to set variables that are either read-only or require authentication when Windows fails to enforce case sensitivity for certain variable checks, aka "Windows Security Feature Bypass Vulnerability".
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2677		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2677
CVE-2017-8488 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8492, CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8480, CVE-2017-8479, CVE-2017-8478, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2678		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2678
CVE-2017-8483 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8492, CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8482, CVE-2017-8480, CVE-2017-8479, CVE-2017-8478, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2684		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2684
CVE-2017-8469 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8481, CVE-2017-8480, CVE-2017-8478, CVE-2017-8479, CVE-2017-8476, CVE-2017-8474, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2690		 Title:
Windows Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2690
CVE-2017-8494 		Severity:
Medium
Description:
Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow a locally-authenticated attacker to run a specially crafted application on a targeted system when Windows Secure Kernel Mode fails to properly handle objects in memory, aka "Windows Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2694		 Title:
Windows Default Folder Tampering Vulnerability		 Type:
Software		 Bulletins:
CISEC:2694
CVE-2017-0295 		Severity:
Low
Description:
Microsoft Windows 10 1607 and 1703, and Windows Server 2016 allow an authenticated attacker to modify the C:\Users\DEFAULT folder structure, aka "Windows Default Folder Tampering Vulnerability".
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2691		 Title:
Windows Cursor Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2691
CVE-2017-8466 		Severity:
High
Description:
Microsoft Windows 10 1511, 1607, and 1703, and Windows Server 2016 allow an unauthenticated attacker to send a specially crafted kernel mode request to cause a denial of service on the target system, aka "Windows VAD Cloning Denial of Service Vulnerability".
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2692		 Title:
Windows COM Session Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2692
CVE-2017-0298 		Severity:
Medium
Description:
A DCOM object in Helppane.exe in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016, when configured to run as the interactive user, allows an authenticated attacker to run arbitrary code in another user's session, aka "Windows COM Session Elevation of Privilege Vulnerability."
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CVE-2015-3839		 Title:
The updateMessageStatus function in Android 5.1.1 and earlier allows local users to cause a denial of service (NULL pointer exception and process crash).		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3839
SFBID100158 		Severity:
Low
Description:
The updateMessageStatus function in Android 5.1.1 and earlier allows local users to cause a denial of service (NULL pointer exception and process crash).
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2686		 Title:
Sandbox Escape in IndexedDB vulnerability in Google Chrome versions		 Type:
Web		 Bulletins:
CISEC:2686
CVE-2017-5087 		Severity:
Medium
Description:
Sandbox Escape in IndexedDB vulnerability in Google Chrome versions prior to 59.0.3071.104 could allow an unauthenticated, remote attacker to execute arbitrary code, bypass security restrictions, access sensitive information, or conduct domain spoofing attacks on a targeted system
Applies to:
Google Chrome		 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2698		 Title:
Microsoft SharePoint Reflective XSS Vulnerability		 Type:
Software		 Bulletins:
CISEC:2698
CVE-2017-8514 		Severity:
Low
Description:
An information disclosure vulnerability exists when Microsoft SharePoint software fails to properly sanitize a specially crafted requests, aka "Microsoft SharePoint Reflective XSS Vulnerability".
Applies to:
Microsoft SharePoint Server 2016		 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2683		 Title:
Hypervisor Code Integrity Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2683
CVE-2017-0193 		Severity:
Medium
Description:
Windows Hyper-V in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to gain elevated privileges on a target guest operating system when Windows Hyper-V instruction emulation fails to properly enforce privilege levels, aka "Hypervisor Code Integrity Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2685		 Title:
GDI Information Disclosure Vulnerablity		 Type:
Software		 Bulletins:
CISEC:2685
CVE-2017-8553 		Severity:
Low
Description:
An information disclosure vulnerability exists in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows Server 2016 when the Windows kernel improperly handles objects in memory, aka "GDI Information Disclosure Vulnerability".
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2688		 Title:
Device Guard Code Integrity Policy Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:2688
CVE-2017-0218 		Severity:
Medium
Description:
Microsoft Windows 10 Gold, Windows 10 1511, Windows 10 1607, and Windows Server 2016 allow an attacker to exploit a security feature bypass vulnerability in Device Guard that could allow the attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This CVE ID is unique from CVE-2017-0173, CVE-2017-0215, CVE-2017-0216, and CVE-2017-0219.
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2689		 Title:
Device Guard Code Integrity Policy Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:2689
CVE-2017-0173 		Severity:
Medium
Description:
Microsoft Windows 10 1607 and Windows Server 2016 allow an attacker to exploit a security feature bypass vulnerability in Device Guard that could allow the attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This CVE ID is unique from CVE-2017-0215, CVE-2017-0216, CVE-2017-0218, and CVE-2017-0219.
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2693		 Title:
Device Guard Code Integrity Policy Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:2693
CVE-2017-0219 		Severity:
Medium
Description:
Microsoft Windows 10 Gold, Windows 10 1511, Windows 10 1607, and Windows Server 2016 allow an attacker to exploit a security feature bypass vulnerability in Device Guard that could allow the attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This CVE ID is unique from CVE-2017-0173, CVE-2017-0215, CVE-2017-0216, and CVE-2017-0218.
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2695		 Title:
Device Guard Code Integrity Policy Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:2695
CVE-2017-0215 		Severity:
Medium
Description:
Microsoft Windows 10 1607 and Windows Server 2016 allow an attacker to exploit a security feature bypass vulnerability in Device Guard that could allow the attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This CVE ID is unique from CVE-2017-0173, CVE-2017-0216, CVE-2017-0218, and CVE-2017-0219.
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CISEC:2696		 Title:
Device Guard Code Integrity Policy Security Feature Bypass Vulnerability		 Type:
Software		 Bulletins:
CISEC:2696
CVE-2017-0216 		Severity:
Medium
Description:
Microsoft Windows 10 1511, Windows 10 1607, and Windows Server 2016 allow an attacker to exploit a security feature bypass vulnerability in Device Guard that could allow the attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This CVE ID is unique from CVE-2017-0173, CVE-2017-0215, CVE-2017-0218, and CVE-2017-0219.
Applies to:
 Created:
2017-08-07		 Updated:
2023-01-26
ID:
CVE-2012-5030		 Title:
Cisco IOS before 15.2(4)S6 does not initialize an unspecified variable, which might allow remote authenticated users to cause a denial of service (CPU consumption, watchdog timeout, crash) by walking specific SNMP objects.		 Type:
Hardware		 Bulletins:
CVE-2012-5030 		Severity:
Medium
Description:
Cisco IOS before 15.2(4)S6 does not initialize an unspecified variable, which might allow remote authenticated users to cause a denial of service (CPU consumption, watchdog timeout, crash) by walking specific SNMP objects.
Applies to:
 Created:
2017-08-02		 Updated:
2023-01-26
ID:
CISEC:2665		 Title:
Windows Uniscribe Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2665
CVE-2017-0283 		Severity:
High
Description:
Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office Word Viewer, Microsoft Lync 2013 SP1, Skype for Business 2016, Microsoft Silverlight 5 Developer Runtime when installed on Microsoft Windows, and Microsoft Silverlight 5 when installed on Microsoft Windows allows a remote code execution vulnerability due to the way it handles objects in memory, aka "Windows Uniscribe Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8528.
Applies to:
Microsoft Live Meeting 2007
Microsoft Lync 2010
Microsoft Lync 2013
Microsoft Office 2007
Microsoft Office 2010
Microsoft Office Word Viewer
Microsoft Silverlight 5
Skype for Business 2016		 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2667		 Title:
Windows Uniscribe Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2667
CVE-2017-8528 		Severity:
High
Description:
Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Microsoft Office 2007 SP3, and Microsoft Office 2010 SP2 allows a remote code execution vulnerability due to the way it handles objects in memory, aka "Windows Uniscribe Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0283.
Applies to:
Microsoft Office 2007
Microsoft Office 2010		 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2662		 Title:
Windows Uniscribe Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2662
CVE-2017-0282 		Severity:
Low
Description:
Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, Windows Server 2016, Microsoft Office 2007 SP3, and Microsoft Office 2010 SP2 allows improper disclosure of memory contents, aka "Windows Uniscribe Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-0284, CVE-2017-0285, and CVE-2017-8534.
Applies to:
Microsoft Office 2007
Microsoft Office 2010		 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2666		 Title:
Windows Uniscribe Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2666
CVE-2017-8534 		Severity:
Medium
Description:
Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Microsoft Office 2007 SP3, and Microsoft Office 2010 SP2 allows improper disclosure of memory contents, aka "Windows Uniscribe Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-0282, CVE-2017-0284, and CVE-2017-0285.
Applies to:
Microsoft Office 2007
Microsoft Office 2010		 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2668		 Title:
Windows Uniscribe Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2668
CVE-2017-0284 		Severity:
Low
Description:
Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007 SP3, and Microsoft Office 2010 SP2 allows improper disclosure of memory contents, aka "Windows Uniscribe Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-0282, CVE-2017-0285, and CVE-2017-8534.
Applies to:
Microsoft Office 2007
Microsoft Office 2010		 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2670		 Title:
Windows Uniscribe Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2670
CVE-2017-0285 		Severity:
Low
Description:
Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, Windows Server 2016, Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, and Microsoft Office Word Viewer allows improper disclosure of memory contents, aka "Windows Uniscribe Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-0282, CVE-2017-0284, and CVE-2017-8534.
Applies to:
Microsoft Office 2007
Microsoft Office 2010
Microsoft Office Word Viewer		 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2671		 Title:
Windows TDX Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2671
CVE-2017-0296 		Severity:
High
Description:
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to elevate privilege when tdx.sys fails to check the length of a buffer prior to copying memory to it, aka "Windows TDX Elevation of Privilege Vulnerability".
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2674		 Title:
Windows Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2674
CVE-2017-0294 		Severity:
High
Description:
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute remote code when Windows fails to properly handle cabinet files, aka "Windows Remote Code Execution Vulnerability".
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2669		 Title:
Windows PDF Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2669
CVE-2017-0291 		Severity:
High
Description:
Windows PDF in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows remote code execution if a user opens a specially crafted PDF file, aka "Windows PDF Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0292.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2672		 Title:
Windows PDF Remote Code Execution Vulnerability		 Type:
Software		 Bulletins:
CISEC:2672
CVE-2017-0292 		Severity:
High
Description:
Windows PDF in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows remote code execution if a user opens a specially crafted PDF file, aka "Windows PDF Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0291.
Applies to:
Microsoft Word 2013
Microsoft Word 2016		 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2664		 Title:
Windows PDF Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2664
CVE-2017-8460 		Severity:
Medium
Description:
Windows PDF in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows information disclosure when a user opens a specially crafted PDF file, aka "Windows PDF Information Disclosure Vulnerability".
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2629		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2629
CVE-2017-8491 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8492, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8480, CVE-2017-8479, CVE-2017-8478, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2631		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2631
CVE-2017-8476 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8481, CVE-2017-8480, CVE-2017-8478, CVE-2017-8479, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2632		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2632
CVE-2017-8482 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8492, CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8480, CVE-2017-8479, CVE-2017-8478, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2633		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2633
CVE-2017-8481 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8480, CVE-2017-8479, CVE-2017-8478, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2634		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2634
CVE-2017-8492 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8480, CVE-2017-8479, CVE-2017-8478, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2635		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2635
CVE-2017-8489 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8492, CVE-2017-8491, CVE-2017-8490, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8480, CVE-2017-8479, CVE-2017-8478, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2636		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2636
CVE-2017-8490 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8492, CVE-2017-8491, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8480, CVE-2017-8479, CVE-2017-8478, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2637		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2637
CVE-2017-8480 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8492, CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8479, CVE-2017-8478, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2638		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2638
CVE-2017-8478 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8481, CVE-2017-8480, CVE-2017-8479, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2639		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2639
CVE-2017-8479 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8492, CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8481, CVE-2017-8478, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2640		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2640
CVE-2017-8462 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8481, CVE-2017-8480, CVE-2017-8478, CVE-2017-8479, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2641		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2641
CVE-2017-8485 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8492, CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8483, CVE-2017-8482, CVE-2017-8480, CVE-2017-8479, CVE-2017-8478, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2642		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2642
CVE-2017-0300 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8481, CVE-2017-8480, CVE-2017-8478, CVE-2017-8479, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2643		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2643
CVE-2017-0299 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8481, CVE-2017-8480, CVE-2017-8478, CVE-2017-8479, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, and CVE-2017-0297.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2644		 Title:
Windows Kernel Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2644
CVE-2017-8474 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8481, CVE-2017-8480, CVE-2017-8478, CVE-2017-8479, CVE-2017-8476, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2630		 Title:
Windows Kernel Elevation of Privilege Vulnerability		 Type:
Software		 Bulletins:
CISEC:2630
CVE-2017-0297 		Severity:
Low
Description:
The kernel in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8481, CVE-2017-8480, CVE-2017-8478, CVE-2017-8479, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0299, CVE-2017-0300.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2604		 Title:
Win32k Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2604
CVE-2017-8475 		Severity:
Low
Description:
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8470, CVE-2017-8471, CVE-2017-8472, CVE-2017-8473, CVE-2017-8477, and CVE-2017-8484.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2605		 Title:
Win32k Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2605
CVE-2017-8473 		Severity:
Low
Description:
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and Windows Server 2016 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8470, CVE-2017-8471, CVE-2017-8472, CVE-2017-8475, CVE-2017-8477, and CVE-2017-8484.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2606		 Title:
Win32k Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2606
CVE-2017-8470 		Severity:
Low
Description:
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8471, CVE-2017-8472, CVE-2017-8473, CVE-2017-8475, CVE-2017-8477, and CVE-2017-8484.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2608		 Title:
Win32k Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2608
CVE-2017-8484 		Severity:
Low
Description:
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8470, CVE-2017-8471, CVE-2017-8472, CVE-2017-8473, CVE-2017-8475, and CVE-2017-8477.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2609		 Title:
Win32k Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2609
CVE-2017-8471 		Severity:
Low
Description:
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8470, CVE-2017-8472, CVE-2017-8473, CVE-2017-8475, CVE-2017-8477, and CVE-2017-8484.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2610		 Title:
Win32k Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2610
CVE-2017-8472 		Severity:
Low
Description:
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8470, CVE-2017-8471, CVE-2017-8473, CVE-2017-8475, CVE-2017-8477, and CVE-2017-8484.
Applies to:
 Created:
2017-07-28		 Updated:
2023-01-26
ID:
CISEC:2611		 Title:
Win32k Information Disclosure Vulnerability		 Type:
Software		 Bulletins:
CISEC:2611
CVE-2017-8477 		Severity:
Low
Description:
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8470, CVE-2017-8471, CVE-2017-8472, CVE-2017-8473, CVE-20