# CVEs published 2017-05-01 31 CVEs were published on May 1, 2017: 1 critical, 0 high. Days are UTC. - [CVE-2017-8403](https://cve.now/CVE-2017-8403.md): 360fly 4K cameras allow unauthenticated Wi-Fi password changes and complete access with REST by using the Bluetooth Low Energy pairing proce (no CVSS) - [CVE-2017-6564](https://cve.now/CVE-2017-6564.md): On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the Guest user, which contains the lowest privileges, can post to the idSourceFil (no CVSS) - [CVE-2017-6565](https://cve.now/CVE-2017-6565.md): On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the roleDiag user, which can be obtained by exploiting CVE-2013-7247, has the abi (no CVSS) - [CVE-2017-8400](https://cve.now/CVE-2017-8400.md): In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the function png\_load() in lib/png.c:755. (no CVSS) - [CVE-2017-8401](https://cve.now/CVE-2017-8401.md): In SWFTools 0.9.2, an out-of-bounds read of heap data can occur in the function png\_load() in lib/png.c:724. (no CVSS) - [CVE-2017-8392](https://cve.now/CVE-2017-8392.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 8 becau (no CVSS) - [CVE-2017-8393](https://cve.now/CVE-2017-8393.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error (no CVSS) - [CVE-2017-8394](https://cve.now/CVE-2017-8394.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 4 due t (no CVSS) - [CVE-2017-8395](https://cve.now/CVE-2017-8395.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid write of size 8 beca (no CVSS) - [CVE-2017-8396](https://cve.now/CVE-2017-8396.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 becau (no CVSS) - [CVE-2017-8397](https://cve.now/CVE-2017-8397.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 and a (no CVSS) - [CVE-2017-8398](https://cve.now/CVE-2017-8398.md): dwarf.c in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. (no CVSS) - [CVE-2017-8399](https://cve.now/CVE-2017-8399.md): PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2\_match.c, related to a "pattern with very many (no CVSS) - [CVE-2017-8376](https://cve.now/CVE-2017-8376.md): GeniXCMS 1.0.2 has XSS triggered by an authenticated comment that is mishandled during a mouse operation by an administrator. (no CVSS, genix/cms) - [CVE-2017-8377](https://cve.now/CVE-2017-8377.md): GeniXCMS 1.0.2 has SQL Injection in inc/lib/Control/Backend/menus.control.php via the menuid parameter. (no CVSS, genix/cms) - [CVE-2017-8388](https://cve.now/CVE-2017-8388.md): GeniXCMS 1.0.2 allows remote attackers to bypass the alertDanger MSG\_USER\_EMAIL\_EXIST protection mechanism via a register.php?act=edit&id=1 (no CVSS, genix/cms) - [CVE-2017-6128](https://cve.now/CVE-2017-6128.md): An attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 BIG-IP, Enterprise Manager, BIG-IQ, and i (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, E… +2) - [CVE-2017-5631](https://cve.now/CVE-2017-5631.md): An issue was discovered in KMCIS CaseAware. (no CVSS) - [CVE-2016-8649](https://cve.now/CVE-2016-8649.md): lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descript (no CVSS, LXC before 1.0.9 and 2.x before) - [CVE-2017-8383](https://cve.now/CVE-2017-8383.md): Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder. (no CVSS, craftcms/cms) - [CVE-2017-8384](https://cve.now/CVE-2017-8384.md): Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not (no CVSS, craftcms/cms) - [CVE-2017-8385](https://cve.now/CVE-2017-8385.md): Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message. (no CVSS, craftcms/cms) - [CVE-2016-10349](https://cve.now/CVE-2016-10349.md): The archive\_le32dec function in archive\_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer (no CVSS) - [CVE-2016-10350](https://cve.now/CVE-2016-10350.md): The archive\_read\_format\_cab\_read\_header function in archive\_read\_support\_format\_cab.c in libarchive 3.2.2 allows remote attackers to cause a (no CVSS) - [CVE-2016-10351](https://cve.now/CVE-2016-10351.md): Telegram Desktop 0.10.19 uses 0755 permissions for $HOME/.TelegramDesktop, which allows local users to obtain sensitive authentication infor (no CVSS) - [CVE-2017-6519](https://cve.now/CVE-2017-6519.md): avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, whic (CVSS 9.1) - [CVE-2017-6520](https://cve.now/CVE-2017-6520.md): The Multicast DNS (mDNS) responder used in BOSE Soundtouch 30 inadvertently responds to IPv4 unicast queries with source addresses that are (no CVSS) - [CVE-2017-8372](https://cve.now/CVE-2017-8372.md): The mad\_layer\_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of se (no CVSS) - [CVE-2017-8373](https://cve.now/CVE-2017-8373.md): The mad\_layer\_III function in layer3.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffe (no CVSS) - [CVE-2017-8374](https://cve.now/CVE-2017-8374.md): The mad\_bit\_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer ov (no CVSS) - [CVE-2017-8378](https://cve.now/CVE-2017-8378.md): Heap-based buffer overflow in the PdfParser::ReadObjects function in base/PdfParser.cpp in PoDoFo 0.9.5 allows remote attackers to cause a d (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-05-01 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.