CVEs published June 8, 2017
68 CVEs were published on June 8, 2017: 0 critical, 2 high. Browse them by severity, product and exploitation status.
- Published
- 68
- Critical
- 0
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 66
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- VMware Workstation · VMware Horizon View Client for Windows
- 6
- IBM Security Key Lifecycle Manager
- 2
- ansible
- 1
- Cisco AnyConnect Local Privilege Escalation Vulnerability
- 1
- Cisco Prime Data Center Network Manager Debug Remote Code E…
- 1
- Cisco Prime Data Center Network Manager Server Static Crede…
- 1
- Cisco TelePresence Endpoint Denial of Service Vulnerability
- 1
- craftcms/cms
- 1
- IBM BigFix Compliance Analytics
- 1
- IBM Business Process Manager Advanced
- 1
High 2
Medium, low and unrated 66
- CVE-2015-1379The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process…
- CVE-2015-1588Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-rev38, and…
- CVE-2015-1786Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token…zendframework/zendframework
- CVE-2015-2692AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters.
- CVE-2015-3634The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows…
- CVE-2015-3913The IP stack in multiple Huawei Campus series switch models allows remote attackers to cause a denial of service (reboot) via a crafted…
- CVE-2016-6093IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers…IBM Security Key Lifecycle Manager
- CVE-2016-6098IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that…IBM Security Key Lifecycle Manager
- CVE-2016-8987IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they should not have…IBM Maximo Asset Management
- CVE-2016-9698IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when…IBM Rational Rhapsody Design Manager
- CVE-2016-9736IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information.IBM WebSphere Application Server
- CVE-2016-9991IBM Sterling Order Management 9.2 through 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute…IBM Sterling Order Management
- CVE-2017-1140IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting.IBM Business Process Manager Advanced
- CVE-2017-1179IBM BigFix Compliance Analytics 1.9.79 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly…IBM BigFix Compliance Analytics
- CVE-2017-1319IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted session (SSL)…IBM Tivoli Federated Identity Manager
- CVE-2014-7919b/libs/gui/ISurfaceComposer.cpp in Android allows attackers to trigger a denial of service (null pointer dereference and process crash).
- CVE-2016-4473/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code.
- CVE-2016-5648Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a…
- CVE-2016-6594Blue Coat Advanced Secure Gateway 6.6, CacheFlow 3.4, ProxySG 6.5 and 6.6 allows remote attackers to bypass blocked requests, user…
- CVE-2016-3095server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.
- CVE-2016-3099mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat…
- CVE-2016-4992389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise…
- CVE-2016-5405389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise…
- CVE-2016-5416389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise…
- CVE-2016-7050SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux…
Show all 66 entriesShow fewer entries
- CVE-2017-4918VMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service startup script.VMware Horizon View Client for Mac
- CVE-2014-3498The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.ansible
- CVE-2016-2034SQL injection vulnerability in ClearPass Policy Manager 6.5.x through 6.5.6 and 6.6.0.
- CVE-2016-3091Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service.
- CVE-2016-3107The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/"…
- CVE-2016-3108The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink…
- CVE-2016-3111pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and…
- CVE-2016-3112client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable…
- CVE-2016-3690The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload.
- CVE-2016-4457CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.
- CVE-2016-4471ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code.
- CVE-2014-4843Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5…
- CVE-2014-6031Buffer overflow in the mcpq daemon in F5 BIG-IP systems 10.x before 10.2.4 HF12, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x before 11.4.1…
- CVE-2014-8687Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by…
- CVE-2015-2251The DeviceManager in Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to obtain sensitive…
- CVE-2015-2252Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root…
- CVE-2015-2253The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain…
- CVE-2015-2255Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board reset) via vectors…
- CVE-2015-2800The user authentication module in Huawei Campus switches S5700, S5300, S6300, and S6700 with software before V200R001SPH012 and S7700…
- CVE-2017-5878The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows…
- CVE-2017-8108Unspecified tests in Lynis before 2.5.0 allow local users to write to arbitrary files or possibly gain privileges via a symlink attack on…
- CVE-2017-9310QEMU (aka Quick Emulator), when built with the e1000e NIC emulation support, allows local guest OS privileged users to cause a denial of…
- CVE-2017-9330QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of…
- CVE-2017-9517atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV.
- CVE-2017-9518atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails.
- CVE-2017-9519atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account.
- CVE-2017-9520The r_config_set function in libr/config/config.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free…
- CVE-2017-4901The drag-and-drop (DnD) function in VMware Workstation 12.x before version 12.5.4 and Fusion 8.x before version 8.5.5 has an out-of-bounds…VMware Workstation Pro/Player · VMware Fusion Pro / Fusion
- CVE-2017-4907VMware Unified Access Gateway (2.5.x, 2.7.x, 2.8.x prior to 2.8.1) and Horizon View (7.x prior to 7.1.0, 6.x prior to 6.2.4) contain a…VMware Unified Access Gateway · VMware Horizon View
- CVE-2017-4908VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple heap buffer-overflow…VMware Workstation · VMware Horizon View Client for Windows
- CVE-2017-4909VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain a heap buffer-overflow vulnerability in…VMware Workstation · VMware Horizon View Client for Windows
- CVE-2017-4910VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds read vulnerabilities…VMware Workstation · VMware Horizon View Client for Windows
- CVE-2017-4911VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds write…VMware Workstation · VMware Horizon View Client for Windows
- CVE-2017-4912VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds read vulnerabilities…VMware Workstation · VMware Horizon View Client for Windows
- CVE-2017-4913VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain an integer-overflow vulnerability in the…VMware Workstation · VMware Horizon View Client for Windows
- CVE-2017-6638A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local…Cisco AnyConnect Local Privilege Escalation Vulnerability
- CVE-2017-6639A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) could allow an…Cisco Prime Data Center Network Manager Debug Remote Code E…
- CVE-2017-6640A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an unauthenticated, remote attacker to log in to…Cisco Prime Data Center Network Manager Server Static Crede…
- CVE-2017-6648A vulnerability in the Session Initiation Protocol (SIP) of the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software…Cisco TelePresence Endpoint Denial of Service Vulnerability
- CVE-2017-9516Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.craftcms/cms
- CVE-2017-7180Net Monitor for Employees Pro through 5.3.4 has an unquoted service path, which allows a Security Feature Bypass of its documented "Block…