CVE-2017-1000486

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-326

Affected software

No affected versions have been published.

Timeline

Published
Jan 3, 2018
Last modified
Jun 17, 2026
Added to CISA KEV
Jan 10, 2022
NVD status
Analyzed

Related CVEs from 2017

CVE-2017-10004879.8Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.CVE-2017-10004886.1Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parametersCVE-2017-10004898.1Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email addressCVE-2017-10004906.5Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the FilemanCVE-2017-10004916.1Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.CVE-2017-10004926.1Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integrationCVE-2017-10004939.8Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeoverCVE-2017-10004947.8Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd < 2.0 allows an attacker to cause DenialCVE-2017-10004955.4QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and peCVE-2017-10004968.8Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality resulting in denial of service and possibly remoCVE-2017-10004979.8Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting in denial of service and possibly remote codCVE-2017-10004987.8AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code e
CVE-2017-1000486: Critical severity, CVSS 9.8 | Vulnix