CVE-2017-17697

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Dec 15, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-176986.1Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec.CVE-2017-176999.8K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025ac DeviceIoControl request.CVE-2017-177009.8K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025a4 DeviceIoControl request.CVE-2017-177019.8K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025c8 DeviceIoControl request.CVE-2017-177036.1Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Persistent XSS.CVE-2017-177047.4A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM EthCVE-2017-177078.1Due to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in PleasCVE-2017-177084.3Because of insufficient authorization checks it is possible for any authenticated user to change profile data of other users in Pleasant PasCVE-2017-177127.0The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet->hdrincl that leads to uninitiaCVE-2017-177139.8Trape before 2017-11-05 has SQL injection via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /regisCVE-2017-177146.1Trape before 2017-11-05 has XSS via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register countrCVE-2017-177158.8The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal v
CVE-2017-17697: High severity, CVSS 8.6 | Vulnix