CVEs published July 13, 2017
92 CVEs were published on July 13, 2017: 0 critical, 0 high. Browse them by severity, product and exploitation status.
- Published
- 92
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 92
- Now in CISA KEV
- 0
- Fix available
- 26
Most affected products
- phpmyadmin/phpmyadmin
- 6
- IBM Emptoris Strategic Supply Management
- 3
- Apache Software Foundation Apache HTTP Server
- 2
- Apache Software Foundation Apache Struts · org.apache.strut…
- 2
- github.com/bitly/oauth2_proxy
- 2
- mapbox.js · mapbox-rails
- 2
- plug
- 2
- akeneo/pim-community-dev
- 1
- Android
- 1
- com.typesafe.akka:akka-actor
- 1
Medium, low and unrated 92
- CVE-2017-1000001FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on.fedmsg
- CVE-2017-1000002ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component…
- CVE-2017-1000003ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application component…
- CVE-2017-1000004ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course…
- CVE-2017-1000005PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases, tables and columns resulting in potential account…
- CVE-2017-1000006Plotly, Inc.plotly.js
- CVE-2017-1000007txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information…txaws
- CVE-2017-1000008Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged…
- CVE-2017-1000009Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution.akeneo/pim-community-dev
- CVE-2017-1000010Audacity 2.1.2 through 2.3.2 is vulnerable to Dll HIjacking in the avformat-55.dll resulting arbitrary code execution.
- CVE-2017-1000011MyWebSQL version 3.6 is vulnerable to stored XSS in the database manager component resulting in account takeover or stealing of information
- CVE-2017-1000012MySQL Dumper version 1.24 is vulnerable to stored XSS when displaying the data in the database to the user
- CVE-2017-1000013phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weaknessphpmyadmin/phpmyadmin
- CVE-2017-1000014phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionalityphpmyadmin/phpmyadmin
- CVE-2017-1000015phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parametersphpmyadmin/phpmyadmin
- CVE-2017-1000016A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies.phpmyadmin/phpmyadmin
- CVE-2017-1000017phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary…phpmyadmin/phpmyadmin
- CVE-2017-1000018phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table namephpmyadmin/phpmyadmin
- CVE-2017-1000020SYN Flood or FIN Flood attack in ECos 1 and other versions embedded devices results in web Authentication Bypass.
- CVE-2017-1000021LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents.
- CVE-2017-1000022LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalation.
- CVE-2017-1000023LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document.
- CVE-2017-1000024Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins…
- CVE-2017-1000025GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulnerable to…
- CVE-2017-1000026Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite…mixlib-archive
Show all 92 entriesShow fewer entries
- CVE-2017-1000027Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user web login function…
- CVE-2017-1000028Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal…
- CVE-2017-1000029Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible…
- CVE-2017-1000030Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure vulnerability, that…
- CVE-2017-1000031SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via…
- CVE-2017-1000032Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parent_id…
- CVE-2017-1000033Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in…
- CVE-2017-1000034Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code…com.typesafe.akka:akka-actor
- CVE-2017-1000035Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack
- CVE-2017-1000037RVM automatically loads environment variables from files in $PWD resulting in command execution RVM vulnerable to command injection when…
- CVE-2017-1000038WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the…
- CVE-2017-1000039Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution
- CVE-2017-1000042Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage…mapbox.js · mapbox-rails
- CVE-2017-1000043Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage…mapbox.js · mapbox-rails
- CVE-2017-1000044gtk-vnc 0.4.2 and older doesn't check framebuffer boundaries correctly when updating framebuffer which may lead to memory corruption when…
- CVE-2017-1000046Mautic 2.6.1 and earlier fails to set flags on session cookiesmautic/core
- CVE-2017-1000047rbenv (all current versions) is vulnerable to Directory Traversal in the specification of Ruby version resulting in arbitrary code execution
- CVE-2017-1000048the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS.qs
- CVE-2017-1000050JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at…
- CVE-2017-1000051Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attackers to inject arbitrary web…
- CVE-2017-1000052Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow…plug
- CVE-2017-1000053Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of…plug
- CVE-2017-1000054Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.
- CVE-2017-1000056Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability…k8s.io/kubernetes
- CVE-2017-1000058Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data parser.
- CVE-2017-1000059Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of…
- CVE-2017-1000060EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root
- CVE-2017-1000061xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible…
- CVE-2017-1000062kittoframework kitto 0.5.1 is vulnerable to directory traversal in the router resulting in remote code execution
- CVE-2017-1000063kittoframework kitto version 0.5.1 is vulnerable to an XSS in the 404 page resulting in information disclosure
- CVE-2017-1000064kittoframework kitto version 0.5.1 is vulnerable to memory exhaustion in the router resulting in DoS
- CVE-2017-1000065Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Management(Users)…
- CVE-2017-1000066The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in…
- CVE-2017-1000067MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in…modx/revolution
- CVE-2017-1000068TestTrack Server versions 1.0 and earlier are vulnerable to an authentication flaw in the split disablement feature resulting in the…
- CVE-2017-1000069CSRF in Bitly oauth2_proxy 2.1 during authentication flowgithub.com/bitly/oauth2_proxy
- CVE-2017-1000070The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the…github.com/bitly/oauth2_proxy
- CVE-2017-1000071Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against…
- CVE-2017-1000072Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravity_value resulting potentially leading to modification of unexpected…
- CVE-2017-1000073Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary code execution.
- CVE-2017-1000074Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the string_repeat() function.
- CVE-2017-1000075Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the memcmp function
- CVE-2017-1000078Linux foundation ONOS 1.9 is vulnerable to XSS in the device.
- CVE-2017-1000079Linux foundation ONOS 1.9.0 is vulnerable to a DoS.
- CVE-2017-1000080Linux foundation ONOS 1.9.0 allows unauthenticated use of websockets.
- CVE-2017-1000081Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code execution.
- CVE-2017-1000362The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key.org.jenkins-ci.main:jenkins-core
- CVE-2017-1000363Linux drivers/char/lp.c Out-of-Bounds Write.
- CVE-2017-11311soundlib/Load_psm.cpp in OpenMPT through 1.26.12.00 and libopenmpt before 0.2.8461-beta26 has a heap buffer overflow with the potential…
- CVE-2017-11310The read_user_chunk_callback function in coders\png.c in ImageMagick 7.0.6-1 Q16 2017-06-21 (beta) has memory leak vulnerabilities via…
- CVE-2017-6249An elevation of privilege vulnerability in the NVIDIA sound driver could enable a local malicious application to execute arbitrary code…Android
- CVE-2017-9788In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not…Apache Software Foundation Apache HTTP Server
- CVE-2017-9789When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has…Apache Software Foundation Apache HTTP Server
- CVE-2016-6019IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site scripting.IBM Emptoris Strategic Supply Management
- CVE-2016-8951IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to a denial of service attack.IBM Emptoris Strategic Supply Management
- CVE-2016-8952IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site scripting.IBM Emptoris Strategic Supply Management
- CVE-2016-8964IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account…IBM BigFix Inventory
- CVE-2017-1308IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not…IBM Daeja ViewONE
- CVE-2017-7672If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which…Apache Software Foundation Apache Struts · org.apache.strut…
- CVE-2017-9787When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack.Apache Software Foundation Apache Struts · org.apache.strut…
- CVE-2017-11103Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names…
- CVE-2017-7529Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module…nginx
- CVE-2017-11173Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests.rack-cors
- CVE-2017-11198Cross-site scripting (XSS) vulnerability in /application/lib/ajax/get_image.php in FineCMS through 2017-07-12 allows remote attackers to…
- CVE-2017-11200SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitor_ip parameter.
- CVE-2017-11201application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to conduct XSS attacks by…
- CVE-2017-11202FineCMS through 2017-07-12 allows XSS in visitors.php because JavaScript in visited URLs is not restricted either during logging or during…