# CVEs published 2017-03-17 180 CVEs were published on March 17, 2017: 1 critical, 10 high. 13 are now in CISA KEV. Days are UTC. - [CVE-2017-7174](https://cve.now/CVE-2017-7174.md): The user-account creation feature in Chef Manage 2.1.0 through 2.4.4 allows remote attackers to execute arbitrary code. (no CVSS) - [CVE-2017-3811](https://cve.now/CVE-2017-3811.md): An XML External Entity vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to have read access to par (no CVSS, Cisco WebEx Meetings Server) - [CVE-2017-3815](https://cve.now/CVE-2017-3815.md): An API Privilege vulnerability in Cisco TelePresence Server Software could allow an unauthenticated, remote attacker to emulate Cisco TelePr (no CVSS, Cisco TelePresence Server) - [CVE-2017-3866](https://cve.now/CVE-2017-3866.md): A vulnerability in the web framework code of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a cross- (no CVSS, Cisco Prime Service Catalog) - [CVE-2017-3867](https://cve.now/CVE-2017-3867.md): A vulnerability in the Border Gateway Protocol (BGP) Bidirectional Forwarding Detection (BFD) implementation of Cisco Adaptive Security Appl (no CVSS, Cisco Adaptive Security Appliance) - [CVE-2017-3868](https://cve.now/CVE-2017-3868.md): A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to conduct a cro (no CVSS, Cisco UCS Director) - [CVE-2017-3869](https://cve.now/CVE-2017-3869.md): An API Credentials Management vulnerability in the APIs for Cisco Prime Infrastructure could allow an authenticated, remote attacker to acce (no CVSS, Cisco Prime Infrastructure) - [CVE-2017-3870](https://cve.now/CVE-2017-3870.md): A vulnerability in the URL filtering feature of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an unauthenticated (no CVSS, Cisco Web Security Appliance) - [CVE-2017-3871](https://cve.now/CVE-2017-3871.md): A RADIUS Secret Disclosure vulnerability in the web network management interface of Cisco Prime Optical for Service Providers could allow an (no CVSS, Cisco Prime Optical for Service Providers) - [CVE-2017-3872](https://cve.now/CVE-2017-3872.md): A cross-site scripting (XSS) filter bypass vulnerability in the web-based management interface of Cisco Unified Communications Manager could (no CVSS, Cisco Unified Communications Manager) - [CVE-2017-3874](https://cve.now/CVE-2017-3874.md): A vulnerability in the web framework of Cisco Unified Communications Manager (CallManager) could allow an authenticated, remote attacker to (no CVSS, Cisco Unified Communications Manager) - [CVE-2017-3875](https://cve.now/CVE-2017-3875.md): An Access-Control Filtering Mechanisms Bypass vulnerability in certain access-control filtering mechanisms on Cisco Nexus 7000 Series Switch (no CVSS, Cisco Nexus 7000 Series Switches) - [CVE-2017-3877](https://cve.now/CVE-2017-3877.md): A vulnerability in the web framework of Cisco Unified Communications Manager (CallManager) could allow an unauthenticated, remote attacker t (no CVSS, Cisco Unified Communications Manager) - [CVE-2017-3878](https://cve.now/CVE-2017-3878.md): A Denial of Service vulnerability in the Telnet remote login functionality of Cisco NX-OS Software running on Cisco Nexus 9000 Series Switch (no CVSS, Cisco Nexus 9000 Series Switches) - [CVE-2017-3879](https://cve.now/CVE-2017-3879.md): A Denial of Service vulnerability in the remote login functionality for Cisco NX-OS Software running on Cisco Nexus 9000 Series Switches cou (no CVSS, Cisco Nexus 9000 Series Switches) - [CVE-2017-3880](https://cve.now/CVE-2017-3880.md): An Authentication Bypass vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access limited meet (no CVSS, Cisco WebEx Meetings Server) - [CVE-2017-3881](https://cve.now/CVE-2017-3881.md): A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthe (CVSS 9.8, KEV, Cisco IOS and IOS XE Software) - [CVE-2017-6370](https://cve.now/CVE-2017-6370.md): TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain (no CVSS, typo3/cms) - [CVE-2017-6880](https://cve.now/CVE-2017-6880.md): Buffer overflow in Cerberus FTP Server 8.0.10.3 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspeci (no CVSS) - [CVE-2014-8701](https://cve.now/CVE-2014-8701.md): Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed pa (no CVSS) - [CVE-2014-8702](https://cve.now/CVE-2014-8702.md): Wonder CMS 2014 allows remote attackers to obtain sensitive information by logging into the application with an array for the password, whic (no CVSS) - [CVE-2014-8703](https://cve.now/CVE-2014-8703.md): Cross-site scripting (XSS) vulnerability in Wonder CMS 2014 allows remote attackers to inject arbitrary web script or HTML. (no CVSS) - [CVE-2014-8704](https://cve.now/CVE-2014-8704.md): Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a (no CVSS) - [CVE-2014-8705](https://cve.now/CVE-2014-8705.md): PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a UR (no CVSS) - [CVE-2014-8706](https://cve.now/CVE-2014-8706.md): Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by (1) changing "PHPSESSID" to an array; (2) adding non-alphanumeric (no CVSS) - [CVE-2014-8707](https://cve.now/CVE-2014-8707.md): Cross-site scripting (XSS) vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or H (no CVSS) - [CVE-2014-8708](https://cve.now/CVE-2014-8708.md): Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature. (no CVSS) - [CVE-2014-8722](https://cve.now/CVE-2014-8722.md): GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/\.xml, (2) backu (no CVSS) - [CVE-2014-8723](https://cve.now/CVE-2014-8723.md): GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) plugins/anonymous\_data.php or (2) pl (no CVSS) - [CVE-2014-9852](https://cve.now/CVE-2014-9852.md): distribute-cache.c in ImageMagick re-uses objects after they have been destroyed, which allows remote attackers to have unspecified impact v (no CVSS) - [CVE-2014-9853](https://cve.now/CVE-2014-9853.md): Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file. (no CVSS) - [CVE-2014-9854](https://cve.now/CVE-2014-9854.md): coders/tiff.c in ImageMagick allows remote attackers to cause a denial of service (application crash) via vectors related to the "identifica (no CVSS) - [CVE-2015-3881](https://cve.now/CVE-2015-3881.md): Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/dat (no CVSS) - [CVE-2015-3882](https://cve.now/CVE-2015-3882.md): qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/\[ID\], which reveals the ins (no CVSS) - [CVE-2015-3883](https://cve.now/CVE-2015-3883.md): Multiple cross-site scripting (XSS) vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) se (no CVSS) - [CVE-2015-3884](https://cve.now/CVE-2015-3884.md): Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) sch (no CVSS) - [CVE-2015-4645](https://cve.now/CVE-2015-4645.md): Integer overflow in the read\_fragment\_table\_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial o (no CVSS) - [CVE-2015-7313](https://cve.now/CVE-2015-7313.md): LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted tiff file. (no CVSS) - [CVE-2017-6954](https://cve.now/CVE-2017-6954.md): An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. (no CVSS, buddypress/buddypress) - [CVE-2017-6955](https://cve.now/CVE-2017-6955.md): An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. (no CVSS) - [CVE-2017-6958](https://cve.now/CVE-2017-6958.md): An XSS vulnerability in the MantisBT Source Integration Plugin (before 2.0.2) search result page allows an attacker to inject arbitrary HTML (no CVSS) - [CVE-2017-6960](https://cve.now/CVE-2017-6960.md): An issue was discovered in apng2gif 1.7. (no CVSS) - [CVE-2017-6961](https://cve.now/CVE-2017-6961.md): An issue was discovered in apng2gif 1.7. (no CVSS) - [CVE-2017-6962](https://cve.now/CVE-2017-6962.md): An issue was discovered in apng2gif 1.7. (no CVSS) - [CVE-2017-6965](https://cve.now/CVE-2017-6965.md): readelf in GNU Binutils 2.28 writes to illegal addresses while processing corrupt input files containing symbol-difference relocations, lead (no CVSS) - [CVE-2017-6966](https://cve.now/CVE-2017-6966.md): readelf in GNU Binutils 2.28 has a use-after-free (specifically read-after-free) error while processing multiple, relocated sections in an M (no CVSS) - [CVE-2017-6967](https://cve.now/CVE-2017-6967.md): xrdp 0.9.1 calls the PAM function auth\_start\_session() in an incorrect location, leading to PAM session modules not being properly initializ (no CVSS) - [CVE-2017-6969](https://cve.now/CVE-2017-6969.md): readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. (no CVSS) - [CVE-2017-0001](https://cve.now/CVE-2017-0001.md): The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows (CVSS 7.8, KEV, Microsoft Windows GDI) - [CVE-2017-0005](https://cve.now/CVE-2017-0005.md): The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows (CVSS 7.8, KEV, Microsoft Windows GDI) - [CVE-2017-0006](https://cve.now/CVE-2017-0006.md): Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3 allow remote attacke (no CVSS, Microsoft Office) - [CVE-2017-0007](https://cve.now/CVE-2017-0007.md): Device Guard in Microsoft Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows remote attackers to modify PowerShell script without i (no CVSS, Microsoft Device Guard) - [CVE-2017-0008](https://cve.now/CVE-2017-0008.md): Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, (no CVSS, Microsoft Internet Explorer) - [CVE-2017-0009](https://cve.now/CVE-2017-0009.md): Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, (no CVSS, Microsoft Browser) - [CVE-2017-0010](https://cve.now/CVE-2017-0010.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0011](https://cve.now/CVE-2017-0011.md): Microsoft Edge allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Edge Information Disclosure Vu (no CVSS, Microsoft Edge) - [CVE-2017-0012](https://cve.now/CVE-2017-0012.md): Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a crafted web site, aka "Microsoft Browser (no CVSS, Microsoft Browsers) - [CVE-2017-0014](https://cve.now/CVE-2017-0014.md): The Windows Graphics Component in Microsoft Office 2010 SP2; Windows Server 2008 R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gol (no CVSS, Microsoft Windows Graphics Component) - [CVE-2017-0015](https://cve.now/CVE-2017-0015.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0016](https://cve.now/CVE-2017-0016.md): Microsoft Windows 10 Gold, 1511, and 1607; Windows 8.1; Windows RT 8.1; Windows Server 2012 R2, and Windows Server 2016 do not properly hand (no CVSS, Microsoft SMBv2/SMBv3) - [CVE-2017-0017](https://cve.now/CVE-2017-0017.md): The RegEx class in the XSS filter in Microsoft Edge allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensiti (no CVSS, Microsoft Edge) - [CVE-2017-0018](https://cve.now/CVE-2017-0018.md): Microsoft Internet Explorer 10 and 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS, Microsoft Internet Explorer) - [CVE-2017-0019](https://cve.now/CVE-2017-0019.md): Microsoft Word 2016 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted documen (no CVSS, Microsoft Office) - [CVE-2017-0020](https://cve.now/CVE-2017-0020.md): Microsoft Excel 2016, Excel 2010 SP2, Excel 2013 RT SP1, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary cod (no CVSS, Microsoft Office) - [CVE-2017-0021](https://cve.now/CVE-2017-0021.md): Hyper-V in Microsoft Windows 10 1607 and Windows Server 2016 does not properly validate vSMB packet data, which allows attackers to execute (no CVSS, Microsoft Hyper-V vSMB) - [CVE-2017-0022](https://cve.now/CVE-2017-0022.md): Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 (CVSS 6.5, KEV, Microsoft XML Core Services) - [CVE-2017-0023](https://cve.now/CVE-2017-0023.md): The PDF library in Microsoft Edge; Windows 8.1; Windows Server 2012 and R2; Windows RT 8.1; and Windows 10, 1511, and 1607 allows remote att (no CVSS, Microsoft PDF) - [CVE-2017-0024](https://cve.now/CVE-2017-0024.md): The kernel-mode drivers in Microsoft Windows 10 1607 and Windows Server 2016 allow local users to gain privileges via a crafted application, (no CVSS, Microsoft Win32k) - [CVE-2017-0025](https://cve.now/CVE-2017-0025.md): The kernel-mode drivers in Microsoft Windows Vista; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold (no CVSS, Microsoft Windows GDI) - [CVE-2017-0026](https://cve.now/CVE-2017-0026.md): The kernel-mode drivers in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allow local users to gain privileges via a craf (no CVSS, Microsoft Win32k) - [CVE-2017-0027](https://cve.now/CVE-2017-0027.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Services on SharePoint Ser (no CVSS, Microsoft Office) - [CVE-2017-0029](https://cve.now/CVE-2017-0029.md): Microsoft Office 2010 SP2, Word 2010 SP2, Word 2013 RT SP1, and Word 2016 allow remote attackers to cause a denial of service (application h (no CVSS, Microsoft Office) - [CVE-2017-0030](https://cve.now/CVE-2017-0030.md): Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Office Web Apps Server 2010 SP2, Word 2007 SP3, Word 2010 SP2, and Word Automation (no CVSS, Microsoft Office) - [CVE-2017-0031](https://cve.now/CVE-2017-0031.md): Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Word 2007 SP3, and Word 2010 SP2 allow remote attackers to execute arbitrary code (no CVSS, Microsoft Office) - [CVE-2017-0032](https://cve.now/CVE-2017-0032.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0033](https://cve.now/CVE-2017-0033.md): Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a crafted web site, aka "Microsoft Browser (no CVSS, Microsoft Browser) - [CVE-2017-0034](https://cve.now/CVE-2017-0034.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. (no CVSS, Microsoft Edge) - [CVE-2017-0035](https://cve.now/CVE-2017-0035.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0039](https://cve.now/CVE-2017-0039.md): Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle dynamic link library (DLL) loading, which allows local users to gain privileges vi (no CVSS, Microsoft Windows DLL) - [CVE-2017-0040](https://cve.now/CVE-2017-0040.md): The scripting engine in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS, Microsoft Internet Explorer) - [CVE-2017-0042](https://cve.now/CVE-2017-0042.md): Windows Media Player in Microsoft Windows 8.1; Windows Server 2012 R2; Windows RT 8.1; Windows 7 SP1; Windows 2008 SP2 and R2 SP1, Windows S (no CVSS, Microsoft Windows DirectShow) - [CVE-2017-0043](https://cve.now/CVE-2017-0043.md): Active Directory Federation Services in Microsoft Windows 10 1607, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and (no CVSS, Microsoft Active Directory Federation Services) - [CVE-2017-0045](https://cve.now/CVE-2017-0045.md): Windows DVD Maker in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows Vista SP2 does not properly parse crafted .msdvd files, (no CVSS, Microsoft Windows DVD Maker) - [CVE-2017-0047](https://cve.now/CVE-2017-0047.md): The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows (no CVSS, Microsoft Windows GDI) - [CVE-2017-0049](https://cve.now/CVE-2017-0049.md): The VBScript engine in Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a craf (no CVSS, Microsoft Internet Explorer) - [CVE-2017-0050](https://cve.now/CVE-2017-0050.md): The kernel API in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7; Windows 8; Windows 10 Gold, 1511, and 1607; Wi (no CVSS, Microsoft Windows Kernel) - [CVE-2017-0051](https://cve.now/CVE-2017-0051.md): Microsoft Windows 10 1607 and Windows Server 2016 allow remote attackers to cause a denial of service (application hang) via a crafted Offic (no CVSS, Microsoft Hyper-V Network Switch) - [CVE-2017-0052](https://cve.now/CVE-2017-0052.md): Microsoft Office Compatibility Pack SP3, Excel 2007 SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3 allow remote attacke (no CVSS, Microsoft Office) - [CVE-2017-0053](https://cve.now/CVE-2017-0053.md): Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Word 2007 SP3, Word 2010 SP2, Word 2013 SP1, Word 2013 R2 SP1, Word 2016, and Word (no CVSS, Microsoft Office) - [CVE-2017-0055](https://cve.now/CVE-2017-0055.md): Microsoft Internet Information Server (IIS) in Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server (no CVSS, Microsoft IIS Server) - [CVE-2017-0056](https://cve.now/CVE-2017-0056.md): The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 (no CVSS, Microsoft Win32k) - [CVE-2017-0057](https://cve.now/CVE-2017-0057.md): DNS client in Microsoft Windows 8.1; Windows Server 2012 R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 fails (no CVSS, Microsoft Windows dnsclient) - [CVE-2017-0059](https://cve.now/CVE-2017-0059.md): Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, (CVSS 4.3, KEV, Microsoft Internet Explorer) - [CVE-2017-0060](https://cve.now/CVE-2017-0060.md): The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows (no CVSS, Microsoft Windows GDI+) - [CVE-2017-0061](https://cve.now/CVE-2017-0061.md): The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2, Windows Server 2008 SP2 and R2, and Windows 7 SP (no CVSS, Microsoft Color Management) - [CVE-2017-0062](https://cve.now/CVE-2017-0062.md): The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows (no CVSS, Microsoft Windows GDI+) - [CVE-2017-0063](https://cve.now/CVE-2017-0063.md): The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2; Windows Server 2008 SP2 and R2; and Windows 7 SP (no CVSS, Microsoft Color Management) - [CVE-2017-0065](https://cve.now/CVE-2017-0065.md): Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Browser In (no CVSS, Microsoft Edge) - [CVE-2017-0066](https://cve.now/CVE-2017-0066.md): Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka "Microsoft Edge Secu (no CVSS, Microsoft Edge) - [CVE-2017-0067](https://cve.now/CVE-2017-0067.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0068](https://cve.now/CVE-2017-0068.md): Browsers in Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft (no CVSS, Microsoft Edge) - [CVE-2017-0069](https://cve.now/CVE-2017-0069.md): Microsoft Edge allows remote attackers to spoof web content via a crafted web site, aka "Microsoft Edge Spoofing Vulnerability." This vulner (no CVSS, Microsoft Edge) - [CVE-2017-0070](https://cve.now/CVE-2017-0070.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0071](https://cve.now/CVE-2017-0071.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0072](https://cve.now/CVE-2017-0072.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0073](https://cve.now/CVE-2017-0073.md): The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows (no CVSS, Microsoft Windows GDI+) - [CVE-2017-0074](https://cve.now/CVE-2017-0074.md): Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 and R2; Windows (no CVSS, Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008…) - [CVE-2017-0075](https://cve.now/CVE-2017-0075.md): Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows (no CVSS, Microsoft Hyper-V) - [CVE-2017-0076](https://cve.now/CVE-2017-0076.md): Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 and R2; Windows (no CVSS, Microsoft Hyper-V) - [CVE-2017-0078](https://cve.now/CVE-2017-0078.md): The kernel-mode drivers in Microsoft Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Wind (no CVSS, Microsoft Win32k) - [CVE-2017-0079](https://cve.now/CVE-2017-0079.md): The kernel-mode drivers in Windows 8.1; Windows Server 2012 R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gai (no CVSS, Microsoft Win32k) - [CVE-2017-0080](https://cve.now/CVE-2017-0080.md): The kernel-mode drivers in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allow local users to gain privileges via a craf (no CVSS, Microsoft Win32k) - [CVE-2017-0081](https://cve.now/CVE-2017-0081.md): The kernel-mode drivers in Microsoft Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Wind (no CVSS, Microsoft Win32k) - [CVE-2017-0082](https://cve.now/CVE-2017-0082.md): The kernel-mode drivers in Microsoft Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k El (no CVSS, Microsoft Win32k) - [CVE-2017-0083](https://cve.now/CVE-2017-0083.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0084](https://cve.now/CVE-2017-0084.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, W (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0085](https://cve.now/CVE-2017-0085.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0086](https://cve.now/CVE-2017-0086.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0087](https://cve.now/CVE-2017-0087.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0088](https://cve.now/CVE-2017-0088.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0089](https://cve.now/CVE-2017-0089.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0090](https://cve.now/CVE-2017-0090.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0091](https://cve.now/CVE-2017-0091.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0092](https://cve.now/CVE-2017-0092.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0094](https://cve.now/CVE-2017-0094.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0095](https://cve.now/CVE-2017-0095.md): Hyper-V in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly validate vSMB packet data, which allows attac (no CVSS, vSMB Hyper-V in Microsoft Windows 10 Gold, 1511, and 1607 a…) - [CVE-2017-0096](https://cve.now/CVE-2017-0096.md): Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2; Windows (no CVSS, Microsoft Hyper-V) - [CVE-2017-0097](https://cve.now/CVE-2017-0097.md): Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 and R2; Windows (no CVSS, Microsoft Hyper-V) - [CVE-2017-0098](https://cve.now/CVE-2017-0098.md): Hyper-V in Microsoft Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows guest OS users, running as virtual machines, to cause a (no CVSS, Microsoft Hyper-V) - [CVE-2017-0099](https://cve.now/CVE-2017-0099.md): Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Wi (no CVSS, Microsoft Hyper-V) - [CVE-2017-0100](https://cve.now/CVE-2017-0100.md): A DCOM object in Helppane.exe in Microsoft Windows 7 SP1; Windows Server 2008 R2; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8 (no CVSS, Microsoft Windows HelpPane) - [CVE-2017-0101](https://cve.now/CVE-2017-0101.md): The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, W (CVSS 7.8, KEV, Microsoft Windows) - [CVE-2017-0102](https://cve.now/CVE-2017-0102.md): Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Wi (no CVSS, Microsoft Windows) - [CVE-2017-0103](https://cve.now/CVE-2017-0103.md): The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows Server 2012 mishandles registr (no CVSS, Microsoft Windows Registry) - [CVE-2017-0104](https://cve.now/CVE-2017-0104.md): The iSNS Server service in Microsoft Windows Server 2008 SP2 and R2, Windows Server 2012 Gold and R2, and Windows Server 2016 allows remote (no CVSS, Microsoft iSNS Server) - [CVE-2017-0105](https://cve.now/CVE-2017-0105.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on Share (no CVSS, Microsoft Office) - [CVE-2017-0107](https://cve.now/CVE-2017-0107.md): Microsoft SharePoint Server fails to sanitize crafted web requests, allowing remote attackers to run cross-script in local security context, (no CVSS, Microsoft SharePoint) - [CVE-2017-0108](https://cve.now/CVE-2017-0108.md): The Windows Graphics Component in Microsoft Office 2007 SP3; 2010 SP2; and Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; L (no CVSS, Microsoft Windows Graphics Component) - [CVE-2017-0109](https://cve.now/CVE-2017-0109.md): Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows (no CVSS, Microsoft Hyper-V) - [CVE-2017-0110](https://cve.now/CVE-2017-0110.md): Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web scri (no CVSS, Microsoft Exchange Server) - [CVE-2017-0111](https://cve.now/CVE-2017-0111.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0112](https://cve.now/CVE-2017-0112.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0113](https://cve.now/CVE-2017-0113.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0114](https://cve.now/CVE-2017-0114.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0115](https://cve.now/CVE-2017-0115.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0116](https://cve.now/CVE-2017-0116.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0117](https://cve.now/CVE-2017-0117.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0118](https://cve.now/CVE-2017-0118.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, W (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0119](https://cve.now/CVE-2017-0119.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0120](https://cve.now/CVE-2017-0120.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Uniscribe in Microsoft Windows Vista SP2, Windows Server 20…) - [CVE-2017-0121](https://cve.now/CVE-2017-0121.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, W (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0122](https://cve.now/CVE-2017-0122.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0123](https://cve.now/CVE-2017-0123.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0124](https://cve.now/CVE-2017-0124.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0125](https://cve.now/CVE-2017-0125.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0126](https://cve.now/CVE-2017-0126.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0127](https://cve.now/CVE-2017-0127.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0128](https://cve.now/CVE-2017-0128.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive (no CVSS, Microsoft Windows Uniscribe) - [CVE-2017-0129](https://cve.now/CVE-2017-0129.md): Microsoft Lync for Mac 2011 fails to properly validate certificates, allowing remote attackers to alter server-client communications, aka "M (no CVSS, Microsoft Lync for Mac) - [CVE-2017-0130](https://cve.now/CVE-2017-0130.md): The scripting engine in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS, Microsoft Internet Explorer) - [CVE-2017-0131](https://cve.now/CVE-2017-0131.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0132](https://cve.now/CVE-2017-0132.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0133](https://cve.now/CVE-2017-0133.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0134](https://cve.now/CVE-2017-0134.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0135](https://cve.now/CVE-2017-0135.md): Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka "Microsoft Edge Secu (no CVSS, Microsoft Edge) - [CVE-2017-0136](https://cve.now/CVE-2017-0136.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0137](https://cve.now/CVE-2017-0137.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0138](https://cve.now/CVE-2017-0138.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0140](https://cve.now/CVE-2017-0140.md): Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka "Microsoft Edge Secu (no CVSS, Microsoft Edge) - [CVE-2017-0141](https://cve.now/CVE-2017-0141.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0143](https://cve.now/CVE-2017-0143.md): The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an (CVSS 8.8, KEV, Microsoft Windows SMB) - [CVE-2017-0144](https://cve.now/CVE-2017-0144.md): The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an (CVSS 8.8, KEV, Microsoft Windows SMB) - [CVE-2017-0145](https://cve.now/CVE-2017-0145.md): The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an (CVSS 8.8, KEV, Microsoft Windows SMB) - [CVE-2017-0146](https://cve.now/CVE-2017-0146.md): The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an (CVSS 8.8, KEV, Microsoft Windows SMB) - [CVE-2017-0147](https://cve.now/CVE-2017-0147.md): The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an (CVSS 7.5, KEV, Microsoft Windows SMB) - [CVE-2017-0148](https://cve.now/CVE-2017-0148.md): The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an (CVSS 8.1, KEV, Microsoft Windows SMB) - [CVE-2017-0149](https://cve.now/CVE-2017-0149.md): Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v (CVSS 8.8, KEV, Microsoft Internet Explorer) - [CVE-2017-0150](https://cve.now/CVE-2017-0150.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0151](https://cve.now/CVE-2017-0151.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro (no CVSS, Microsoft Browser) - [CVE-2017-0154](https://cve.now/CVE-2017-0154.md): Microsoft Internet Explorer 11 on Windows 10, 1511, and 1606 and Windows Server 2016 does not enforce cross-domain policies, allowing attack (no CVSS, Microsoft Internet Explorer) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-03-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.