# CVEs published 2017-05-12

174 CVEs were published on May 12, 2017: 0 critical, 6 high. 5 are now in CISA KEV. Days are UTC.

- [CVE-2017-5654](https://cve.now/CVE-2017-5654.md): In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthorized read access… (no CVSS, Apache Software Foundation Apache Ambari)
- [CVE-2017-8924](https://cve.now/CVE-2017-8924.md): The edge\_bulk\_in\_callback function in drivers/usb/serial/io\_ti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive… (no CVSS)
- [CVE-2017-8925](https://cve.now/CVE-2017-8925.md): The omninet\_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of… (no CVSS)
- [CVE-2016-10329](https://cve.now/CVE-2016-10329.md): Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code… (no CVSS, Synology Photo Station)
- [CVE-2016-10330](https://cve.now/CVE-2016-10330.md): Directory traversal vulnerability in synophoto\_dsm\_user, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local… (no CVSS, Synology Photo Station)
- [CVE-2016-10331](https://cve.now/CVE-2016-10331.md): Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary… (no CVSS, Synology Photo Station)
- [CVE-2017-8244](https://cve.now/CVE-2017-8244.md): In core\_info\_read and inst\_info\_read in all Android releases from CAF using the Linux kernel, variable "dbg\_buf", "dbg\_buf-\>curr" and… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-8245](https://cve.now/CVE-2017-8245.md): In all Android releases from CAF using the Linux kernel, while processing a voice SVC request which is nonstandard by specifying a payload… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-8246](https://cve.now/CVE-2017-8246.md): In function msm\_pcm\_playback\_close() in all Android releases from CAF using the Linux kernel, prtd is assigned… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-8923](https://cve.now/CVE-2017-8923.md): The zend\_string\_extend function in Zend/zend\_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a… (no CVSS)
- [CVE-2017-7474](https://cve.now/CVE-2017-7474.md): It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. (no CVSS, Red Hat Keycloak Node.js adapter · keycloak-connect +1)
- [CVE-2017-7484](https://cve.now/CVE-2017-7484.md): It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x… (no CVSS, The PostgreSQL Global Development Group PostgreSQL)
- [CVE-2017-7485](https://cve.now/CVE-2017-7485.md): In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL… (no CVSS, The PostgreSQL Global Development Group PostgreSQL)
- [CVE-2017-7486](https://cve.now/CVE-2017-7486.md): PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg\_user\_mappings view which discloses foreign server passwords to any… (no CVSS, The PostgreSQL Global Development Group PostgreSQL)
- [CVE-2017-8921](https://cve.now/CVE-2017-8921.md): In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary… (no CVSS)
- [CVE-2016-4838](https://cve.now/CVE-2016-4838.md): The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior… (no CVSS, Money Foward Money Forward · SOURCENEXT Money Forward fo… +2)
- [CVE-2016-4839](https://cve.now/CVE-2016-4839.md): The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior… (no CVSS, Money Foward Money Forward · SOURCENEXT Money Forward fo… +2)
- [CVE-2016-4855](https://cve.now/CVE-2016-4855.md): Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via… (no CVSS, ADOdb · adodb/adodb-php)
- [CVE-2016-4856](https://cve.now/CVE-2016-4856.md): Cross-site scripting vulnerability in Splunk Enterprise 6.3.x prior to 6.3.5 and Splunk Light 6.3.x prior to 6.3.5 allows attacker with… (no CVSS, Splunk Enterprise · Splunk Light)
- [CVE-2016-4857](https://cve.now/CVE-2016-4857.md): Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x… (no CVSS, Splunk Enterprise · Splunk Light)
- [CVE-2016-4858](https://cve.now/CVE-2016-4858.md): Cross-site scripting vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise… (no CVSS, Splunk Enterprise · Splunk Light)
- [CVE-2016-4859](https://cve.now/CVE-2016-4859.md): Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x… (no CVSS, Splunk Enterprise · Splunk Light)
- [CVE-2016-4864](https://cve.now/CVE-2016-4864.md): H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string… (no CVSS, Kazuho Oku H2O)
- [CVE-2016-4876](https://cve.now/CVE-2016-4876.md): Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the… (no CVSS, baserCMS Users Community baserCMS)
- [CVE-2016-4877](https://cve.now/CVE-2016-4877.md): Cross-site scripting vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote authenticated attackers to inject… (no CVSS, baserCMS Users Community baserCMS plugin Mail)
- [CVE-2016-4878](https://cve.now/CVE-2016-4878.md): Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the… (no CVSS, baserCMS Users Community baserCMS · baserproject/basercms)
- [CVE-2016-4879](https://cve.now/CVE-2016-4879.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the… (no CVSS, baserCMS Users Community baserCMS plugin Mail · baserprojec…)
- [CVE-2016-4880](https://cve.now/CVE-2016-4880.md): Cross-site scripting vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote authenticated attackers to inject… (no CVSS, baserCMS Users Community baserCMS plugin Blog · baserprojec…)
- [CVE-2016-4881](https://cve.now/CVE-2016-4881.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the… (no CVSS, baserCMS Users Community baserCMS plugin Blog · baserprojec…)
- [CVE-2016-4882](https://cve.now/CVE-2016-4882.md): Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the… (no CVSS, baserCMS Users Community baserCMS)
- [CVE-2016-4883](https://cve.now/CVE-2016-4883.md): Cross-site scripting vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to inject arbitrary web script or HTML… (no CVSS, baserCMS Users Community baserCMS)
- [CVE-2016-4884](https://cve.now/CVE-2016-4884.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the… (no CVSS, baserCMS Users Community baserCMS plugin Blog)
- [CVE-2016-4885](https://cve.now/CVE-2016-4885.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Feed version 3.0.10 and earlier allows remote attackers to hijack the… (no CVSS, baserCMS Users Community baserCMS plugin Feed)
- [CVE-2016-4886](https://cve.now/CVE-2016-4886.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the… (no CVSS, baserCMS Users Community baserCMS plugin Mail)
- [CVE-2016-4887](https://cve.now/CVE-2016-4887.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Uploader version 3.0.10 and earlier allows remote attackers to hijack… (no CVSS, baserCMS Users Community baserCMS plugin Uploader)
- [CVE-2017-2122](https://cve.now/CVE-2017-2122.md): Cross-site scripting vulnerability in Nessus versions 6.8.0, 6.8.1, 6.9.0, 6.9.1 and 6.9.2 allows remote authenticated attackers to inject… (no CVSS, Tenable Network Security Nessus)
- [CVE-2017-2157](https://cve.now/CVE-2017-2157.md): Untrusted search path vulnerability in installers for The Public Certification Service for Individuals "The JPKI user's software (for… (no CVSS, Japan Agency for Local Authority Information Systems Ins… +1)
- [CVE-2017-2163](https://cve.now/CVE-2017-2163.md): Directory traversal vulnerability in SOY CMS Ver.1.8.1 to Ver.1.8.12 allows authenticated attackers to read arbitrary files via shop\_id. (no CVSS, Nippon Institute of Agroinformatics SOY CMS)
- [CVE-2017-2164](https://cve.now/CVE-2017-2164.md): Cross-site scripting vulnerability in SOY CMS with installer 1.8.12 and earlier allows remote attackers to inject arbitrary web script or… (no CVSS, Nippon Institute of Agroinformatics SOY CMS with installer)
- [CVE-2017-2167](https://cve.now/CVE-2017-2167.md): Untrusted search path vulnerability in Installer for PrimeDrive Desktop Application version 1.4.4 and earlier allows remote attackers to… (no CVSS, SoftBank Installer for PrimeDrive Desktop Application)
- [CVE-2016-10274](https://cve.now/CVE-2016-10274.md): An elevation of privilege vulnerability in the MediaTek touchscreen driver could enable a local malicious application to execute arbitrary… (no CVSS, Google Android)
- [CVE-2016-10275](https://cve.now/CVE-2016-10275.md): An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2016-10276](https://cve.now/CVE-2016-10276.md): An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2016-10277](https://cve.now/CVE-2016-10277.md): An elevation of privilege vulnerability in the Motorola bootloader could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2016-10280](https://cve.now/CVE-2016-10280.md): An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary… (no CVSS, Google Android)
- [CVE-2016-10281](https://cve.now/CVE-2016-10281.md): An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary… (no CVSS, Google Android)
- [CVE-2016-10282](https://cve.now/CVE-2016-10282.md): An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary… (no CVSS, Google Android)
- [CVE-2016-10283](https://cve.now/CVE-2016-10283.md): An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2016-10284](https://cve.now/CVE-2016-10284.md): An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2016-10285](https://cve.now/CVE-2016-10285.md): An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2016-10286](https://cve.now/CVE-2016-10286.md): An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2016-10287](https://cve.now/CVE-2016-10287.md): An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2016-10288](https://cve.now/CVE-2016-10288.md): An elevation of privilege vulnerability in the Qualcomm LED driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2016-10289](https://cve.now/CVE-2016-10289.md): An elevation of privilege vulnerability in the Qualcomm crypto driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2016-10290](https://cve.now/CVE-2016-10290.md): An elevation of privilege vulnerability in the Qualcomm shared memory driver could enable a local malicious application to execute… (no CVSS, Google Android)
- [CVE-2016-10291](https://cve.now/CVE-2016-10291.md): An elevation of privilege vulnerability in the Qualcomm Slimbus driver could enable a local malicious application to execute arbitrary… (no CVSS, Google Android)
- [CVE-2016-10292](https://cve.now/CVE-2016-10292.md): A denial of service vulnerability in the Qualcomm Wi-Fi driver could enable a proximate attacker to cause a denial of service in the Wi-Fi… (no CVSS, Google Android)
- [CVE-2016-10293](https://cve.now/CVE-2016-10293.md): An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of… (no CVSS, Google Android)
- [CVE-2016-10294](https://cve.now/CVE-2016-10294.md): An information disclosure vulnerability in the Qualcomm power driver could enable a local malicious application to access data outside of… (no CVSS, Google Android)
- [CVE-2016-10295](https://cve.now/CVE-2016-10295.md): An information disclosure vulnerability in the Qualcomm LED driver could enable a local malicious application to access data outside of… (no CVSS, Google Android)
- [CVE-2016-10296](https://cve.now/CVE-2016-10296.md): An information disclosure vulnerability in the Qualcomm shared memory driver could enable a local malicious application to access data… (no CVSS, Google Android)
- [CVE-2017-0465](https://cve.now/CVE-2017-0465.md): An elevation of privilege vulnerability in the Qualcomm ADSPRPC driver could enable a local malicious application to execute arbitrary… (no CVSS, Google Android)
- [CVE-2017-0493](https://cve.now/CVE-2017-0493.md): An information disclosure vulnerability in File-Based Encryption could enable a local malicious attacker to bypass operating system… (no CVSS, Google Android)
- [CVE-2017-0587](https://cve.now/CVE-2017-0587.md): A remote code execution vulnerability in libmpeg2 in Mediaserver could enable an attacker using a specially crafted file to cause memory… (no CVSS, Google Android)
- [CVE-2017-0588](https://cve.now/CVE-2017-0588.md): A remote code execution vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable an attacker using a specially crafted… (no CVSS, Google Android)
- [CVE-2017-0589](https://cve.now/CVE-2017-0589.md): A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory… (no CVSS, Google Android)
- [CVE-2017-0590](https://cve.now/CVE-2017-0590.md): A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory… (no CVSS, Google Android)
- [CVE-2017-0591](https://cve.now/CVE-2017-0591.md): A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory… (no CVSS, Google Android)
- [CVE-2017-0592](https://cve.now/CVE-2017-0592.md): A remote code execution vulnerability in FLACExtractor.cpp in libstagefright in Mediaserver could enable an attacker using a specially… (no CVSS, Google Android)
- [CVE-2017-0593](https://cve.now/CVE-2017-0593.md): An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to obtain access to custom… (no CVSS, Google Android)
- [CVE-2017-0594](https://cve.now/CVE-2017-0594.md): An elevation of privilege vulnerability in codecs/aacenc/SoftAACEncoder2.cpp in libstagefright in Mediaserver could enable a local… (no CVSS, Google Android)
- [CVE-2017-0595](https://cve.now/CVE-2017-0595.md): An elevation of privilege vulnerability in libstagefright in Mediaserver could enable a local malicious application to execute arbitrary… (no CVSS, Google Android)
- [CVE-2017-0596](https://cve.now/CVE-2017-0596.md): An elevation of privilege vulnerability in libstagefright in Mediaserver could enable a local malicious application to execute arbitrary… (no CVSS, Google Android)
- [CVE-2017-0597](https://cve.now/CVE-2017-0597.md): An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the… (no CVSS, Google Android)
- [CVE-2017-0598](https://cve.now/CVE-2017-0598.md): An information disclosure vulnerability in the Framework APIs could enable a local malicious application to bypass operating system… (no CVSS, Google Android)
- [CVE-2017-0599](https://cve.now/CVE-2017-0599.md): A remote denial of service vulnerability in libhevc in Mediaserver could enable an attacker to use a specially crafted file to cause a… (no CVSS, Google Android)
- [CVE-2017-0600](https://cve.now/CVE-2017-0600.md): A remote denial of service vulnerability in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to… (no CVSS, Google Android)
- [CVE-2017-0601](https://cve.now/CVE-2017-0601.md): An Elevation of Privilege vulnerability in Bluetooth could potentially enable a local malicious application to accept harmful files shared… (no CVSS, Google Android)
- [CVE-2017-0602](https://cve.now/CVE-2017-0602.md): An information disclosure vulnerability in Bluetooth could allow a local malicious application to bypass operating system protections that… (no CVSS, Google Android)
- [CVE-2017-0603](https://cve.now/CVE-2017-0603.md): A denial of service vulnerability in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a… (no CVSS, Google Android)
- [CVE-2017-0604](https://cve.now/CVE-2017-0604.md): An elevation of privilege vulnerability in the kernel Qualcomm power driver could enable a local malicious application to execute… (no CVSS, Google Android)
- [CVE-2017-0606](https://cve.now/CVE-2017-0606.md): An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2017-0607](https://cve.now/CVE-2017-0607.md): An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2017-0608](https://cve.now/CVE-2017-0608.md): An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2017-0609](https://cve.now/CVE-2017-0609.md): An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2017-0610](https://cve.now/CVE-2017-0610.md): An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2017-0611](https://cve.now/CVE-2017-0611.md): An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2017-0612](https://cve.now/CVE-2017-0612.md): An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious… (no CVSS, Google Android)
- [CVE-2017-0613](https://cve.now/CVE-2017-0613.md): An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious… (no CVSS, Google Android)
- [CVE-2017-0614](https://cve.now/CVE-2017-0614.md): An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious… (no CVSS, Google Android)
- [CVE-2017-0615](https://cve.now/CVE-2017-0615.md): An elevation of privilege vulnerability in the MediaTek power driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2017-0616](https://cve.now/CVE-2017-0616.md): An elevation of privilege vulnerability in the MediaTek system management interrupt driver could enable a local malicious application to… (no CVSS, Google Android)
- [CVE-2017-0617](https://cve.now/CVE-2017-0617.md): An elevation of privilege vulnerability in the MediaTek video driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2017-0618](https://cve.now/CVE-2017-0618.md): An elevation of privilege vulnerability in the MediaTek command queue driver could enable a local malicious application to execute… (no CVSS, Google Android)
- [CVE-2017-0619](https://cve.now/CVE-2017-0619.md): An elevation of privilege vulnerability in the Qualcomm pin controller driver could enable a local malicious application to execute… (no CVSS, Google Android)
- [CVE-2017-0620](https://cve.now/CVE-2017-0620.md): An elevation of privilege vulnerability in the Qualcomm Secure Channel Manager driver could enable a local malicious application to… (no CVSS, Google Android)
- [CVE-2017-0621](https://cve.now/CVE-2017-0621.md): An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code… (no CVSS, Google Android)
- [CVE-2017-0622](https://cve.now/CVE-2017-0622.md): An elevation of privilege vulnerability in the Goodix touchscreen driver could enable a local malicious application to execute arbitrary… (no CVSS, Google Android)
- [CVE-2017-0623](https://cve.now/CVE-2017-0623.md): An elevation of privilege vulnerability in the HTC bootloader could enable a local malicious application to execute arbitrary code within… (no CVSS, Google Android)
- [CVE-2017-0624](https://cve.now/CVE-2017-0624.md): An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of… (no CVSS, Google Android)
- [CVE-2017-0625](https://cve.now/CVE-2017-0625.md): An information disclosure vulnerability in the MediaTek command queue driver could enable a local malicious application to access data… (no CVSS, Google Android)
- [CVE-2017-0626](https://cve.now/CVE-2017-0626.md): An information disclosure vulnerability in the Qualcomm crypto engine driver could enable a local malicious application to access data… (no CVSS, Google Android)
- [CVE-2017-0627](https://cve.now/CVE-2017-0627.md): An information disclosure vulnerability in the kernel UVC driver could enable a local malicious application to access data outside of its… (no CVSS, Google Android)
- [CVE-2017-0628](https://cve.now/CVE-2017-0628.md): An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of… (no CVSS, Google Android)
- [CVE-2017-0629](https://cve.now/CVE-2017-0629.md): An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of… (no CVSS, Google Android)
- [CVE-2017-0630](https://cve.now/CVE-2017-0630.md): An information disclosure vulnerability in the kernel trace subsystem could enable a local malicious application to access data outside of… (no CVSS, Google Android)
- [CVE-2017-0631](https://cve.now/CVE-2017-0631.md): An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of… (no CVSS, Google Android)
- [CVE-2017-0632](https://cve.now/CVE-2017-0632.md): An information disclosure vulnerability in the Qualcomm sound codec driver could enable a local malicious application to access data… (no CVSS, Google Android)
- [CVE-2017-0633](https://cve.now/CVE-2017-0633.md): An information disclosure vulnerability in the Broadcom Wi-Fi driver could enable a local malicious component to access data outside of… (no CVSS, Google Android)
- [CVE-2017-0634](https://cve.now/CVE-2017-0634.md): An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data… (no CVSS)
- [CVE-2017-0635](https://cve.now/CVE-2017-0635.md): A remote denial of service vulnerability in HevcUtils.cpp in libstagefright in Mediaserver could enable an attacker to use a specially… (no CVSS, Google Android)
- [CVE-2017-0064](https://cve.now/CVE-2017-0064.md): A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mixed Content warnings, aka "Internet… (no CVSS, Microsoft Internet Explorer)
- [CVE-2017-0077](https://cve.now/CVE-2017-0077.md): The kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… (no CVSS, Microsoft Windows)
- [CVE-2017-0171](https://cve.now/CVE-2017-0171.md): Windows DNS Server allows a denial of service vulnerability when Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold… (no CVSS, Microsoft Windows DNS Server)
- [CVE-2017-0175](https://cve.now/CVE-2017-0175.md): The Windows kernel in Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows authenticated attackers to obtain sensitive information… (no CVSS, Microsoft Windows)
- [CVE-2017-0190](https://cve.now/CVE-2017-0190.md): The GDI component in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… (no CVSS, Microsoft Windows)
- [CVE-2017-0212](https://cve.now/CVE-2017-0212.md): Windows Hyper-V allows an elevation of privilege vulnerability when Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server… (no CVSS, Microsoft Hyper-V)
- [CVE-2017-0213](https://cve.now/CVE-2017-0213.md): Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2 (CVSS 7.3, KEV, Microsoft Windows COM)
- [CVE-2017-0214](https://cve.now/CVE-2017-0214.md): Windows COM in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1… (no CVSS, Microsoft Windows COM)
- [CVE-2017-0220](https://cve.now/CVE-2017-0220.md): The Windows kernel in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows Server 2012 Gold allows authenticated attackers to… (no CVSS, Microsoft Windows)
- [CVE-2017-0221](https://cve.now/CVE-2017-0221.md): A vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability."… (no CVSS, Microsoft Edge)
- [CVE-2017-0222](https://cve.now/CVE-2017-0222.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor (CVSS 8.8, KEV, Microsoft Internet Explorer)
- [CVE-2017-0224](https://cve.now/CVE-2017-0224.md): A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft Edge, aka… (no CVSS, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2017-0226](https://cve.now/CVE-2017-0226.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory… (no CVSS, Microsoft Internet Explorer)
- [CVE-2017-0227](https://cve.now/CVE-2017-0227.md): A remote code execution vulnerability exists in Microsoft Edge in the way affected Microsoft scripting engines render when handling… (no CVSS, Microsoft Edge)
- [CVE-2017-0228](https://cve.now/CVE-2017-0228.md): A remote code execution vulnerability exists in Microsoft browsers in the way JavaScript engines render when handling objects in memory… (no CVSS, Microsoft browsers)
- [CVE-2017-0229](https://cve.now/CVE-2017-0229.md): A remote code execution vulnerability exists in Microsoft Edge in the way JavaScript engines render when handling objects in memory, aka… (no CVSS, Microsoft Edge)
- [CVE-2017-0230](https://cve.now/CVE-2017-0230.md): A remote code execution vulnerability exists in Microsoft Edge in the way JavaScript engines render when handling objects in memory, aka… (no CVSS, Microsoft Edge)
- [CVE-2017-0231](https://cve.now/CVE-2017-0231.md): A spoofing vulnerability exists when Microsoft browsers render SmartScreen Filter, aka "Microsoft Browser Spoofing Vulnerability." (no CVSS, Microsoft browsers)
- [CVE-2017-0233](https://cve.now/CVE-2017-0233.md): An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in… (no CVSS, Microsoft Edge)
- [CVE-2017-0234](https://cve.now/CVE-2017-0234.md): A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects… (no CVSS, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2017-0235](https://cve.now/CVE-2017-0235.md): A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects… (no CVSS, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2017-0236](https://cve.now/CVE-2017-0236.md): A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects… (no CVSS, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2017-0238](https://cve.now/CVE-2017-0238.md): A remote code execution vulnerability exists in Microsoft browsers in the way JavaScript scripting engines handle objects in memory, aka… (no CVSS, Microsoft browsers)
- [CVE-2017-0240](https://cve.now/CVE-2017-0240.md): A remote code execution vulnerability exists in Microsoft Edge in the way affected Microsoft scripting engines render when handling… (no CVSS, Microsoft Edge)
- [CVE-2017-0241](https://cve.now/CVE-2017-0241.md): An elevation of privilege vulnerability exists when Microsoft Edge renders a domain-less page in the URL, which could allow Microsoft Edge… (no CVSS, Microsoft Edge)
- [CVE-2017-0242](https://cve.now/CVE-2017-0242.md): An information disclosure vulnerability exists in the way some ActiveX objects are instantiated, aka "Microsoft ActiveX Information… (no CVSS, Microsoft Windows)
- [CVE-2017-0244](https://cve.now/CVE-2017-0244.md): The kernel in Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows locally authenticated attackers to gain privileges via a… (no CVSS, Microsoft Windows)
- [CVE-2017-0245](https://cve.now/CVE-2017-0245.md): The kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1 and Windows Server 2012 Gold allow a local authenticated… (no CVSS, Microsoft Windows)
- [CVE-2017-0246](https://cve.now/CVE-2017-0246.md): The Graphics Component in the kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012… (no CVSS, Microsoft Windows)
- [CVE-2017-0247](https://cve.now/CVE-2017-0247.md): A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.Mvc +18)
- [CVE-2017-0248](https://cve.now/CVE-2017-0248.md): Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings… (no CVSS, Microsoft .NET Framework · Microsoft.AspNetCore.Mvc +18)
- [CVE-2017-0249](https://cve.now/CVE-2017-0249.md): An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests. (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.Mvc +19)
- [CVE-2017-0254](https://cve.now/CVE-2017-0254.md): Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Office for Mac 2011, Office for Mac 2016, Microsoft… (no CVSS, Microsoft Office)
- [CVE-2017-0255](https://cve.now/CVE-2017-0255.md): Microsoft SharePoint Foundation 2013 SP1 allows an elevation of privilege vulnerability when it does not properly sanitize a specially… (no CVSS, Microsoft Office)
- [CVE-2017-0256](https://cve.now/CVE-2017-0256.md): A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests. (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.Mvc +18)
- [CVE-2017-0258](https://cve.now/CVE-2017-0258.md): The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows… (no CVSS, Microsoft Windows)
- [CVE-2017-0259](https://cve.now/CVE-2017-0259.md): The Windows kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server… (no CVSS, Microsoft Windows)
- [CVE-2017-0261](https://cve.now/CVE-2017-0261.md): Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly (CVSS 7.8, KEV, Microsoft Office)
- [CVE-2017-0262](https://cve.now/CVE-2017-0262.md): Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly (CVSS 7.8, KEV, Microsoft Office)
- [CVE-2017-0263](https://cve.now/CVE-2017-0263.md): The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Window (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2017-0264](https://cve.now/CVE-2017-0264.md): Microsoft PowerPoint for Mac 2011 allows a remote code execution vulnerability when the software fails to properly handle objects in… (no CVSS, Microsoft Office)
- [CVE-2017-0265](https://cve.now/CVE-2017-0265.md): Microsoft PowerPoint for Mac 2011 allows a remote code execution vulnerability when the software fails to properly handle objects in… (no CVSS, Microsoft Office)
- [CVE-2017-0266](https://cve.now/CVE-2017-0266.md): A remote code execution vulnerability exists in Microsoft Edge in the way affected Microsoft scripting engines render when handling… (no CVSS, Microsoft Edge)
- [CVE-2017-0267](https://cve.now/CVE-2017-0267.md): Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008… (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0268](https://cve.now/CVE-2017-0268.md): Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008… (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0269](https://cve.now/CVE-2017-0269.md): The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server… (no CVSS, Microsoft Server Block Message)
- [CVE-2017-0270](https://cve.now/CVE-2017-0270.md): Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008… (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0271](https://cve.now/CVE-2017-0271.md): Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008… (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0272](https://cve.now/CVE-2017-0272.md): The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows… (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0273](https://cve.now/CVE-2017-0273.md): The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server… (no CVSS, Microsoft Server Block Message)
- [CVE-2017-0274](https://cve.now/CVE-2017-0274.md): Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008… (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0275](https://cve.now/CVE-2017-0275.md): Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008… (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0276](https://cve.now/CVE-2017-0276.md): Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008… (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0277](https://cve.now/CVE-2017-0277.md): The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows… (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0278](https://cve.now/CVE-2017-0278.md): The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows… (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0279](https://cve.now/CVE-2017-0279.md): The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows… (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0280](https://cve.now/CVE-2017-0280.md): The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server… (no CVSS, Microsoft Server Block Message)
- [CVE-2017-0281](https://cve.now/CVE-2017-0281.md): Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web App (no CVSS, Microsoft Office)
- [CVE-2017-8360](https://cve.now/CVE-2017-8360.md): Conexant Systems mictray64 task, as used on HP Elite, EliteBook, ProBook, and ZBook systems, leaks sensitive data (keystrokes) to any… (no CVSS)
- [CVE-2017-8900](https://cve.now/CVE-2017-8900.md): LightDM through 1.22.0, when systemd is used in Ubuntu 16.10 and 17.x, allows physically proximate attackers to bypass intended AppArmor… (no CVSS)
- [CVE-2017-8908](https://cve.now/CVE-2017-8908.md): The mark\_line\_tr function in gxscanc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds… (no CVSS)
- [CVE-2017-8911](https://cve.now/CVE-2017-8911.md): An integer underflow has been identified in the unicode\_to\_utf8() function in tnef 1.4.14. (no CVSS)
- [CVE-2017-8912](https://cve.now/CVE-2017-8912.md): CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to… (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-05-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.