# CVEs published 2017-06-05

29 CVEs were published on June 5, 2017: 0 critical, 1 high. Days are UTC.

- [CVE-2017-9420](https://cve.now/CVE-2017-9420.md): Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject… (no CVSS)
- [CVE-2017-9441](https://cve.now/CVE-2017-9441.md): Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web… (CVSS 2.7)
- [CVE-2017-9442](https://cve.now/CVE-2017-9442.md): BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web… (no CVSS)
- [CVE-2017-9443](https://cve.now/CVE-2017-9443.md): BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json… (CVSS 8.8)
- [CVE-2017-9444](https://cve.now/CVE-2017-9444.md): BigTree CMS through 4.2.18 has CSRF related to the core\\admin\\modules\\users\\profile\\update.php script (modify user information), the… (no CVSS)
- [CVE-2017-9439](https://cve.now/CVE-2017-9439.md): In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of… (no CVSS)
- [CVE-2017-9440](https://cve.now/CVE-2017-9440.md): In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPSDChannel in coders/psd.c, which allows attackers to cause a denial… (no CVSS)
- [CVE-2017-9438](https://cve.now/CVE-2017-9438.md): libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted… (no CVSS)
- [CVE-2017-1000368](https://cve.now/CVE-2017-1000368.md): Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get\_process\_ttyname()… (no CVSS)
- [CVE-2017-8438](https://cve.now/CVE-2017-8438.md): Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run\_as functionality. (no CVSS, Elastic X-Pack Security)
- [CVE-2017-8439](https://cve.now/CVE-2017-8439.md): Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. (no CVSS, Elastic Kibana)
- [CVE-2017-8440](https://cve.now/CVE-2017-8440.md): Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to… (no CVSS, Elastic Kibana)
- [CVE-2017-8441](https://cve.now/CVE-2017-8441.md): Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. (no CVSS, Elastic X-Pack Security)
- [CVE-2017-8835](https://cve.now/CVE-2017-8835.md): SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before… (no CVSS)
- [CVE-2017-8836](https://cve.now/CVE-2017-8836.md): CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before… (no CVSS)
- [CVE-2017-8837](https://cve.now/CVE-2017-8837.md): Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before… (no CVSS)
- [CVE-2017-8838](https://cve.now/CVE-2017-8838.md): XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before… (no CVSS)
- [CVE-2017-8839](https://cve.now/CVE-2017-8839.md): XSS via orig\_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before… (no CVSS)
- [CVE-2017-8840](https://cve.now/CVE-2017-8840.md): Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before… (no CVSS)
- [CVE-2017-8841](https://cve.now/CVE-2017-8841.md): Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before… (no CVSS)
- [CVE-2017-9434](https://cve.now/CVE-2017-9434.md): Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter. (no CVSS)
- [CVE-2017-9435](https://cve.now/CVE-2017-9435.md): Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search\_supervisor and search\_statut parameters). (no CVSS, dolibarr/dolibarr)
- [CVE-2017-9436](https://cve.now/CVE-2017-9436.md): TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php. (no CVSS, nilsteampassnet/teampass)
- [CVE-2017-9437](https://cve.now/CVE-2017-9437.md): Openbravo Business Suite 3.0 is affected by SQL injection. (no CVSS)
- [CVE-2017-9430](https://cve.now/CVE-2017-9430.md): Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service (application crash) or possibly have… (no CVSS)
- [CVE-2017-9431](https://cve.now/CVE-2017-9431.md): Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomgr/error.c. (no CVSS)
- [CVE-2017-9432](https://cve.now/CVE-2017-9432.md): Document Liberation Project libstaroffice before 2017-04-07 has an out-of-bounds write caused by a stack-based buffer overflow related to… (no CVSS)
- [CVE-2017-9433](https://cve.now/CVE-2017-9433.md): Document Liberation Project libmwaw before 2017-04-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the… (no CVSS)
- [CVE-2017-1000367](https://cve.now/CVE-2017-1000367.md): Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get\_process\_ttyname() function… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-06-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.