# CVEs published 2017-06-29

38 CVEs were published on June 29, 2017: 0 critical, 8 high. Days are UTC.

- [CVE-2017-10683](https://cve.now/CVE-2017-10683.md): In mpg123 1.25.0, there is a heap-based buffer over-read in the convert\_latin1 function in libmpg123/id3.c. (no CVSS)
- [CVE-2017-10684](https://cve.now/CVE-2017-10684.md): In ncurses 6.0, there is a stack-based buffer overflow in the fmt\_entry function. (no CVSS)
- [CVE-2017-10685](https://cve.now/CVE-2017-10685.md): In ncurses 6.0, there is a format string vulnerability in the fmt\_entry function. (no CVSS)
- [CVE-2017-10686](https://cve.now/CVE-2017-10686.md): In Netwide Assembler (NASM) 2.14rc0, there are multiple heap use after free vulnerabilities in the tool nasm. (no CVSS)
- [CVE-2017-10687](https://cve.now/CVE-2017-10687.md): In LibSass 3.4.5, there is a heap-based buffer over-read in the function json\_mkstream() in sass\_context.cpp. (no CVSS)
- [CVE-2017-10688](https://cve.now/CVE-2017-10688.md): In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif\_dirwrite.c. (no CVSS)
- [CVE-2017-10678](https://cve.now/CVE-2017-10678.md): Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for… (no CVSS)
- [CVE-2017-10679](https://cve.now/CVE-2017-10679.md): Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the… (no CVSS)
- [CVE-2017-10680](https://cve.now/CVE-2017-10680.md): Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for… (no CVSS)
- [CVE-2017-10681](https://cve.now/CVE-2017-10681.md): Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for… (no CVSS)
- [CVE-2017-10682](https://cve.now/CVE-2017-10682.md): SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands… (no CVSS)
- [CVE-2017-2844](https://cve.now/CVE-2017-2844.md): In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can… (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2845](https://cve.now/CVE-2017-2845.md): An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running… (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2846](https://cve.now/CVE-2017-2846.md): In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can… (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2847](https://cve.now/CVE-2017-2847.md): In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can… (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2848](https://cve.now/CVE-2017-2848.md): In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can… (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2849](https://cve.now/CVE-2017-2849.md): In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can… (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2850](https://cve.now/CVE-2017-2850.md): In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can… (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2851](https://cve.now/CVE-2017-2851.md): In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can… (CVSS 7.5, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-4997](https://cve.now/CVE-2017-4997.md): EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could… (no CVSS, VASA Provider Virtual Appliance versions 8.3.x and prior)
- [CVE-2017-3747](https://cve.now/CVE-2017-3747.md): Privilege escalation vulnerability in Lenovo Nerve Center for Windows 10 on Desktop systems (Lenovo Nerve Center for notebook systems is… (no CVSS, Lenovo Group Lenovo Nerve Center)
- [CVE-2017-3748](https://cve.now/CVE-2017-3748.md): On Lenovo VIBE mobile phones, improper access controls on the nac\_server component can be abused in conjunction with CVE-2017-3749 and… (no CVSS, Lenovo Group Lenovo Vibe and Lenovo China-only Moto Mobile…)
- [CVE-2017-3749](https://cve.now/CVE-2017-3749.md): On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug… (no CVSS, Lenovo Group Lenovo Vibe and Lenovo China-only Moto Mobile…)
- [CVE-2017-3750](https://cve.now/CVE-2017-3750.md): On Lenovo VIBE mobile phones, the Lenovo Security Android application allows private data to be backed up and restored via Android Debug… (no CVSS, Lenovo Group Lenovo Vibe and Lenovo China-only Moto Mobile…)
- [CVE-2017-5528](https://cve.now/CVE-2017-5528.md): TIBCO JasperReports Server cross-site vulnerabilities (CVSS 5.7, TIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1)
- [CVE-2017-5529](https://cve.now/CVE-2017-5529.md): TIBCO JasperReports Library Information Disclosure (CVSS 4.1, TIBCO Software TIBCO JasperReports Library Community Edi… +5)
- [CVE-2017-1310](https://cve.now/CVE-2017-1310.md): IBM Informix Dynamic Server 12.1 could allow an authenticated user to cause a buffer overflow that would write large assertion fail files… (no CVSS, IBM Informix Servers)
- [CVE-2017-8554](https://cve.now/CVE-2017-8554.md): The kernel in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2… (no CVSS, Microsoft Microsof Windows)
- [CVE-2017-8558](https://cve.now/CVE-2017-8558.md): The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on 32-bit versions of Microsoft Windows… (no CVSS, Microsoft Malware Protection Engine)
- [CVE-2017-8575](https://cve.now/CVE-2017-8575.md): The kernel in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information… (no CVSS, Microsoft Windows)
- [CVE-2017-8576](https://cve.now/CVE-2017-8576.md): The graphics component in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to run… (no CVSS, Microsoft Windows)
- [CVE-2017-8579](https://cve.now/CVE-2017-8579.md): The DirectX component in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to run… (no CVSS, Microsoft Windows)
- [CVE-2017-8613](https://cve.now/CVE-2017-8613.md): Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized… (no CVSS, Microsoft Azure AD Connect)
- [CVE-2017-10671](https://cve.now/CVE-2017-10671.md): Heap-based Buffer Overflow in the de\_dotdot function in libhttpd.c in sthttpd before 2.27.1 allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2017-10672](https://cve.now/CVE-2017-10672.md): Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the… (no CVSS)
- [CVE-2017-10673](https://cve.now/CVE-2017-10673.md): admin/profile.php in GetSimple CMS 3.x has XSS in a name field. (no CVSS)
- [CVE-2016-10042](https://cve.now/CVE-2016-10042.md): Authorization Bypass in the Web interface of Arcadyan SLT-00 Star (aka Swisscom Internet-Box) devices before R7.7 allows unauthorized… (no CVSS)
- [CVE-2017-10667](https://cve.now/CVE-2017-10667.md): In index.php in Zen Cart 1.6.0, the products\_id parameter can cause XSS. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-06-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.