# CVEs published 2017-07-10

33 CVEs were published on July 10, 2017: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-5640](https://cve.now/CVE-2017-5640.md): It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala… (no CVSS, Apache Software Foundation Apache Impala)
- [CVE-2017-5652](https://cve.now/CVE-2017-5652.md): During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext… (no CVSS, Apache Software Foundation Apache Impala)
- [CVE-2017-6726](https://cve.now/CVE-2017-6726.md): A vulnerability in the CLI of the Cisco Prime Network Gateway could allow an authenticated, local attacker to retrieve system process… (no CVSS, Cisco Prime Network Gateway)
- [CVE-2017-6727](https://cve.now/CVE-2017-6727.md): A vulnerability in the Server Message Block (SMB) protocol of Cisco Wide Area Application Services (WAAS) could allow an unauthenticated… (no CVSS, Cisco Wide Area Application Services)
- [CVE-2017-6728](https://cve.now/CVE-2017-6728.md): A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary code at the root… (no CVSS, Cisco IOS XR)
- [CVE-2017-6729](https://cve.now/CVE-2017-6729.md): A vulnerability in the Border Gateway Protocol (BGP) processing functionality of the Cisco StarOS operating system for Cisco ASR 5000… (no CVSS, Cisco StarOS)
- [CVE-2017-6730](https://cve.now/CVE-2017-6730.md): A vulnerability in the web-based GUI of Cisco Wide Area Application Services (WAAS) Central Manager could allow an unauthenticated, remote… (no CVSS, Cisco Wide Area Application Services)
- [CVE-2017-6731](https://cve.now/CVE-2017-6731.md): A vulnerability in Multicast Source Discovery Protocol (MSDP) ingress packet processing for Cisco IOS XR Software could allow an… (no CVSS, Cisco IOS XR)
- [CVE-2017-6732](https://cve.now/CVE-2017-6732.md): A vulnerability in the installation procedure for Cisco Prime Network Software could allow an authenticated, local attacker to elevate… (no CVSS, Cisco Prime Network)
- [CVE-2017-6733](https://cve.now/CVE-2017-6733.md): A vulnerability in the web-based application interface of the Cisco Identity Services Engine (ISE) portal could allow an unauthenticated… (no CVSS, Cisco Identity Services Engine)
- [CVE-2017-6734](https://cve.now/CVE-2017-6734.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated… (no CVSS, Cisco Identity Services Engine)
- [CVE-2017-6735](https://cve.now/CVE-2017-6735.md): A vulnerability in the backup and restore functionality of Cisco FireSIGHT System Software could allow an authenticated, local attacker to… (no CVSS, Cisco FireSIGHT System Software)
- [CVE-2017-8032](https://cve.now/CVE-2017-8032.md): In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x… (no CVSS, Cloud Foundry · org.cloudfoundry.identity:cloudfoundry-iden…)
- [CVE-2017-7175](https://cve.now/CVE-2017-7175.md): NfSen before 1.3.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the customfmt parameter (aka the… (no CVSS)
- [CVE-2017-11163](https://cve.now/CVE-2017-11163.md): Cross-site scripting (XSS) vulnerability in aggregate\_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web… (no CVSS)
- [CVE-2017-11166](https://cve.now/CVE-2017-11166.md): The ReadXWDImage function in coders\\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a… (no CVSS)
- [CVE-2017-7670](https://cve.now/CVE-2017-7670.md): The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. (no CVSS, Apache Software Foundation Apache Traffic Control · github.…)
- [CVE-2017-1284](https://cve.now/CVE-2017-1284.md): IBM WebSphere MQ 9.0.1 and 9.0.2 could allow a local user with ability to run or enable trace, to obtain sensitive information from… (no CVSS, IBM MQ)
- [CVE-2017-1337](https://cve.now/CVE-2017-1337.md): IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text. (no CVSS, IBM MQ)
- [CVE-2017-1398](https://cve.now/CVE-2017-1398.md): IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct… (no CVSS, IBM WebSphere Commerce Enterprise)
- [CVE-2017-9791](https://cve.now/CVE-2017-9791.md): The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message t (CVSS 9.8, KEV, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2016-10397](https://cve.now/CVE-2016-10397.md): In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to… (no CVSS)
- [CVE-2017-11142](https://cve.now/CVE-2017-11142.md): In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack… (no CVSS)
- [CVE-2017-11143](https://cve.now/CVE-2017-11143.md): In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for… (no CVSS)
- [CVE-2017-11144](https://cve.now/CVE-2017-11144.md): In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of… (no CVSS)
- [CVE-2017-11145](https://cve.now/CVE-2017-11145.md): In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib\_meridian parsing code could be… (no CVSS)
- [CVE-2017-11147](https://cve.now/CVE-2017-11147.md): In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash… (no CVSS)
- [CVE-2017-11124](https://cve.now/CVE-2017-11124.md): libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar\_unserialize function in archive.c. (no CVSS)
- [CVE-2017-11125](https://cve.now/CVE-2017-11125.md): libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar\_get\_path function in util.c. (no CVSS)
- [CVE-2017-11126](https://cve.now/CVE-2017-11126.md): The III\_i\_stereo function in libmpg123/layer3.c in mpg123 through 1.25.1 allows remote attackers to cause a denial of service (buffer… (no CVSS)
- [CVE-2017-11139](https://cve.now/CVE-2017-11139.md): GraphicsMagick 1.3.26 has double free vulnerabilities in the ReadOneJNGImage() function in coders/png.c. (no CVSS)
- [CVE-2017-11140](https://cve.now/CVE-2017-11140.md): The ReadJPEGImage function in coders/jpeg.c in GraphicsMagick 1.3.26 creates a pixel cache before a successful read of a scanline, which… (no CVSS)
- [CVE-2017-11141](https://cve.now/CVE-2017-11141.md): The ReadMATImage function in coders\\mat.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-07-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.