CVE-2017-16900

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Incorrect Access Control in Hunesion i-oneNet 3.0.6042.1200 allows the local user to access other user's information which is unauthorized via brute force.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://hunesion.comVendor Advisory
http://i-onenet.comBroken Link, URL Repurposed
https://github.com/summtime/CVE/tree/master/CVE-2017-16900Third Party Advisory
http://hunesion.comVendor Advisory
http://i-onenet.comBroken Link, URL Repurposed
https://github.com/summtime/CVE/tree/master/CVE-2017-16900Third Party Advisory

Timeline

Published: Feb 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-169027.5On the Vonage VDV-23 115 3.2.11-0.9.40 home router, sending a long string of characters in the loginPassword and/or loginUsername field to g CVE-2017-169039.8LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal sequences in the dir parameter,CVE-2017-169046.1The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is mishandled during later log viewing CVE-2017-169058.1The DuoLingo TinyCards application before 1.0 for Android has one use of unencrypted HTTP, which allows remote attackers to spoof content, a CVE-2017-169065.4In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar -> New Event" action.CVE-2017-169075.4In Horde Groupware 5.2.19 and 5.2.21, there is XSS via the Color field in a Create Task List action.CVE-2017-169085.4In Horde Groupware 5.2.19, there is XSS via the Name field during creation of a new Resource. This can be leveraged for remote code executio CVE-2017-169098.8An error related to the "LibRaw::panasonic_load_raw()" function (dcraw_common.cpp) in LibRaw versions prior to 0.18.6 can be exploited to ca CVE-2017-16915.4IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c CVE-2017-169106.5An error within the "LibRaw::xtrans_interpolate()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.6 can be exploited CVE-2017-169114.7The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to disclose kernel memory addresses.CVE-2017-169125.9The "get_pipe()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 allows attackers to c