# CVEs published 2017-05-04 19 CVEs were published on May 4, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-8768](https://cve.now/CVE-2017-8768.md): Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. (no CVSS) - [CVE-2016-7055](https://cve.now/CVE-2016-7055.md): There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL 1.0.2 and 1.1.0 before 1.1.0c that (no CVSS) - [CVE-2016-7053](https://cve.now/CVE-2016-7053.md): CMS Null dereference (no CVSS, OpenSSL) - [CVE-2016-7054](https://cve.now/CVE-2016-7054.md): ChaCha20/Poly1305 heap-buffer-overflow (no CVSS, OpenSSL) - [CVE-2017-3730](https://cve.now/CVE-2017-3730.md): Bad (EC)DHE parameters cause a client crash (no CVSS, OpenSSL) - [CVE-2017-3731](https://cve.now/CVE-2017-3731.md): Truncated packet could crash via OOB read (no CVSS, OpenSSL) - [CVE-2017-3732](https://cve.now/CVE-2017-3732.md): BN\_mod\_exp may produce incorrect results on x86\_64 (no CVSS, OpenSSL) - [CVE-2017-3733](https://cve.now/CVE-2017-3733.md): Encrypt-Then-Mac renegotiation crash (no CVSS, OpenSSL) - [CVE-2017-8778](https://cve.now/CVE-2017-8778.md): GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is a (no CVSS) - [CVE-2017-4983](https://cve.now/CVE-2017-4983.md): EMC Data Domain OS 5.2 through 5.7 before 5.7.3.0 and 6.0 before 6.0.1.0 is affected by a privilege escalation vulnerability that may potent (no CVSS, EMC Data Domain OS 5.2 through 5.7 before 5.7.3.0 and 6.0 b…) - [CVE-2017-8295](https://cve.now/CVE-2017-8295.md): WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to re (no CVSS) - [CVE-2017-8779](https://cve.now/CVE-2017-8779.md): rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data (no CVSS) - [CVE-2017-8780](https://cve.now/CVE-2017-8780.md): GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malfor (no CVSS, genix/cms) - [CVE-2017-8763](https://cve.now/CVE-2017-8763.md): Cross-site scripting (XSS) vulnerability in modules/Base/Box/check\_for\_new\_version.php in EPESI in Telaxus/EPESI 1.8.2 and earlier allows re (no CVSS) - [CVE-2017-8765](https://cve.now/CVE-2017-8765.md): The function named ReadICONImage in coders\\icon.c in ImageMagick 7.0.5-5 has a memory leak vulnerability which can cause memory exhaustion v (no CVSS) - [CVE-2017-8773](https://cve.now/CVE-2017-8773.md): Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316, and Quick Heal AntiVirus Pro 10.1.0.316 are vulnerable to Out (no CVSS) - [CVE-2017-8774](https://cve.now/CVE-2017-8774.md): Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316, and Quick Heal AntiVirus Pro 10.1.0.316 are vulnerable to Mem (no CVSS) - [CVE-2017-8775](https://cve.now/CVE-2017-8775.md): Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316, and Quick Heal AntiVirus Pro 10.1.0.316 are vulnerable to Mem (no CVSS) - [CVE-2017-8776](https://cve.now/CVE-2017-8776.md): Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316, and Quick Heal AntiVirus Pro 10.1.0.316 have approximately 16 (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-05-04 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.