# CVEs published 2017-05-01 31 CVEs were published on May 1, 2017: 1 critical, 0 high. Days are UTC. - [CVE-2017-8403](https://cve.now/CVE-2017-8403.md): 360fly 4K cameras allow unauthenticated Wi-Fi password changes and complete access with REST by using the Bluetooth Low Energy pairing… (no CVSS) - [CVE-2017-6564](https://cve.now/CVE-2017-6564.md): On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the Guest user, which contains the lowest privileges, can post to the… (no CVSS) - [CVE-2017-6565](https://cve.now/CVE-2017-6565.md): On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the roleDiag user, which can be obtained by exploiting CVE-2013-7247, has the… (no CVSS) - [CVE-2017-8400](https://cve.now/CVE-2017-8400.md): In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the function png\_load() in lib/png.c:755. (no CVSS) - [CVE-2017-8401](https://cve.now/CVE-2017-8401.md): In SWFTools 0.9.2, an out-of-bounds read of heap data can occur in the function png\_load() in lib/png.c:724. (no CVSS) - [CVE-2017-8392](https://cve.now/CVE-2017-8392.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 8… (no CVSS) - [CVE-2017-8393](https://cve.now/CVE-2017-8393.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read… (no CVSS) - [CVE-2017-8394](https://cve.now/CVE-2017-8394.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 4 due… (no CVSS) - [CVE-2017-8395](https://cve.now/CVE-2017-8395.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid write of size 8… (no CVSS) - [CVE-2017-8396](https://cve.now/CVE-2017-8396.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1… (no CVSS) - [CVE-2017-8397](https://cve.now/CVE-2017-8397.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 and… (no CVSS) - [CVE-2017-8398](https://cve.now/CVE-2017-8398.md): dwarf.c in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. (no CVSS) - [CVE-2017-8399](https://cve.now/CVE-2017-8399.md): PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2\_match.c, related to a "pattern with very… (no CVSS) - [CVE-2017-8376](https://cve.now/CVE-2017-8376.md): GeniXCMS 1.0.2 has XSS triggered by an authenticated comment that is mishandled during a mouse operation by an administrator. (no CVSS, genix/cms) - [CVE-2017-8377](https://cve.now/CVE-2017-8377.md): GeniXCMS 1.0.2 has SQL Injection in inc/lib/Control/Backend/menus.control.php via the menuid parameter. (no CVSS, genix/cms) - [CVE-2017-8388](https://cve.now/CVE-2017-8388.md): GeniXCMS 1.0.2 allows remote attackers to bypass the alertDanger MSG\_USER\_EMAIL\_EXIST protection mechanism via a… (no CVSS, genix/cms) - [CVE-2017-6128](https://cve.now/CVE-2017-6128.md): An attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 BIG-IP, Enterprise Manager, BIG-IQ, and… (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, E… +2) - [CVE-2017-5631](https://cve.now/CVE-2017-5631.md): An issue was discovered in KMCIS CaseAware. (no CVSS) - [CVE-2016-8649](https://cve.now/CVE-2016-8649.md): lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file… (no CVSS, LXC before 1.0.9 and 2.x before) - [CVE-2017-8383](https://cve.now/CVE-2017-8383.md): Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder. (no CVSS, craftcms/cms) - [CVE-2017-8384](https://cve.now/CVE-2017-8384.md): Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need… (no CVSS, craftcms/cms) - [CVE-2017-8385](https://cve.now/CVE-2017-8385.md): Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message. (no CVSS, craftcms/cms) - [CVE-2016-10349](https://cve.now/CVE-2016-10349.md): The archive\_le32dec function in archive\_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based… (no CVSS) - [CVE-2016-10350](https://cve.now/CVE-2016-10350.md): The archive\_read\_format\_cab\_read\_header function in archive\_read\_support\_format\_cab.c in libarchive 3.2.2 allows remote attackers to cause… (no CVSS) - [CVE-2016-10351](https://cve.now/CVE-2016-10351.md): Telegram Desktop 0.10.19 uses 0755 permissions for $HOME/.TelegramDesktop, which allows local users to obtain sensitive authentication… (no CVSS) - [CVE-2017-6519](https://cve.now/CVE-2017-6519.md): avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link… (CVSS 9.1) - [CVE-2017-6520](https://cve.now/CVE-2017-6520.md): The Multicast DNS (mDNS) responder used in BOSE Soundtouch 30 inadvertently responds to IPv4 unicast queries with source addresses that… (no CVSS) - [CVE-2017-8372](https://cve.now/CVE-2017-8372.md): The mad\_layer\_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of… (no CVSS) - [CVE-2017-8373](https://cve.now/CVE-2017-8373.md): The mad\_layer\_III function in layer3.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based… (no CVSS) - [CVE-2017-8374](https://cve.now/CVE-2017-8374.md): The mad\_bit\_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer… (no CVSS) - [CVE-2017-8378](https://cve.now/CVE-2017-8378.md): Heap-based buffer overflow in the PdfParser::ReadObjects function in base/PdfParser.cpp in PoDoFo 0.9.5 allows remote attackers to cause a… (no CVSS) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2017-05-01 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.