# CVEs published 2017-05-05

43 CVEs were published on May 5, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-6877](https://cve.now/CVE-2016-6877.md): Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP (no CVSS)
- [CVE-2016-0255](https://cve.now/CVE-2016-0255.md): IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. (no CVSS, IBM Marketing Platform)
- [CVE-2016-8916](https://cve.now/CVE-2016-8916.md): IBM Tivoli Storage Manager 5.5, 6.1-6.4, and 7.1 stores password information in a log file that could be read by a local user when a set pas (no CVSS)
- [CVE-2016-9691](https://cve.now/CVE-2016-9691.md): IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) er (no CVSS, IBM WebSphere Cast Iron Cloud integration)
- [CVE-2016-9692](https://cve.now/CVE-2016-9692.md): IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to External Service Interaction attack, caused by improper validation of us (no CVSS, IBM WebSphere Cast Iron Cloud integration)
- [CVE-2017-1156](https://cve.now/CVE-2017-1156.md): IBM WebSphere Portal 8.5 and 9.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (no CVSS, IBM WebSphere Portal)
- [CVE-2017-8801](https://cve.now/CVE-2017-8801.md): Trend Micro OfficeScan 11.0 before SP1 CP 6325 (with Agent Module Build before 6152) and XG before CP 1352 has XSS via a crafted URI using a (no CVSS)
- [CVE-2017-8303](https://cve.now/CVE-2017-8303.md): An issue was discovered on Accellion FTA devices before FTA\_9\_12\_180. (no CVSS)
- [CVE-2017-8304](https://cve.now/CVE-2017-8304.md): An issue was discovered on Accellion FTA devices before FTA\_9\_12\_180. (no CVSS)
- [CVE-2017-8760](https://cve.now/CVE-2017-8760.md): An issue was discovered on Accellion FTA devices before FTA\_9\_12\_180. (no CVSS)
- [CVE-2017-8788](https://cve.now/CVE-2017-8788.md): An issue was discovered on Accellion FTA devices before FTA\_9\_12\_180. (no CVSS)
- [CVE-2017-8789](https://cve.now/CVE-2017-8789.md): An issue was discovered on Accellion FTA devices before FTA\_9\_12\_180. (no CVSS)
- [CVE-2017-8790](https://cve.now/CVE-2017-8790.md): An issue was discovered on Accellion FTA devices before FTA\_9\_12\_180. (no CVSS)
- [CVE-2017-8791](https://cve.now/CVE-2017-8791.md): An issue was discovered on Accellion FTA devices before FTA\_9\_12\_180. (no CVSS)
- [CVE-2017-8792](https://cve.now/CVE-2017-8792.md): An issue was discovered on Accellion FTA devices before FTA\_9\_12\_180. (no CVSS)
- [CVE-2017-8793](https://cve.now/CVE-2017-8793.md): An issue was discovered on Accellion FTA devices before FTA\_9\_12\_180. (no CVSS)
- [CVE-2017-8794](https://cve.now/CVE-2017-8794.md): An issue was discovered on Accellion FTA devices before FTA\_9\_12\_180. (no CVSS)
- [CVE-2017-8795](https://cve.now/CVE-2017-8795.md): An issue was discovered on Accellion FTA devices before FTA\_9\_12\_180. (no CVSS)
- [CVE-2017-8796](https://cve.now/CVE-2017-8796.md): An issue was discovered on Accellion FTA devices before FTA\_9\_12\_180. (no CVSS)
- [CVE-2017-8799](https://cve.now/CVE-2017-8799.md): Untrusted input execution via igetwild in all iRODS versions before 4.1.11 and 4.2.1 allows other iRODS users (potentially anonymous) to exe (no CVSS)
- [CVE-2017-8080](https://cve.now/CVE-2017-8080.md): Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors inv (no CVSS)
- [CVE-2017-6557](https://cve.now/CVE-2017-6557.md): SQL injection vulnerability in ArrayOS before AG 9.4.0.135, when the portal bookmark function is enabled, allows remote authenticated users (no CVSS)
- [CVE-2017-3212](https://cve.now/CVE-2017-3212.md): The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which al (no CVSS, Space Coast Credit Union Mobile)
- [CVE-2017-3213](https://cve.now/CVE-2017-3213.md): The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle a (no CVSS, Think Mutual Bank Mobile Banking)
- [CVE-2017-5901](https://cve.now/CVE-2017-5901.md): The State Bank of India State Bank Anywhere app 5.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-m (no CVSS)
- [CVE-2017-5902](https://cve.now/CVE-2017-5902.md): The PayQuicker app 1.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serv (no CVSS)
- [CVE-2017-5905](https://cve.now/CVE-2017-5905.md): The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to sp (no CVSS)
- [CVE-2017-5906](https://cve.now/CVE-2017-5906.md): The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, w (no CVSS)
- [CVE-2017-5907](https://cve.now/CVE-2017-5907.md): The Great Southern Bank Great Southern Mobile Banking app before 4.0.4 for iOS does not verify X.509 certificates from SSL servers, which al (no CVSS)
- [CVE-2017-5909](https://cve.now/CVE-2017-5909.md): The Electronic Funds Source (EFS) Mobile Driver Source app 2.5 for iOS does not verify X.509 certificates from SSL servers, which allows man (no CVSS)
- [CVE-2017-5911](https://cve.now/CVE-2017-5911.md): The Banco Santander Mexico SA Supermovil app 3.5 through 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-i (no CVSS)
- [CVE-2017-5912](https://cve.now/CVE-2017-5912.md): The FOREX.com FOREXTrader for iPhone app 2.9.12 through 2.9.14 for iOS does not verify X.509 certificates from SSL servers, which allows man (no CVSS)
- [CVE-2017-5913](https://cve.now/CVE-2017-5913.md): The TradeKing Forex for iPhone app 1.2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacke (no CVSS)
- [CVE-2017-5914](https://cve.now/CVE-2017-5914.md): The DOT IT Banque Zitouna app 2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to s (no CVSS)
- [CVE-2017-5915](https://cve.now/CVE-2017-5915.md): The Emirates NBD Bank P.J.S.C Emirates NBD KSA app 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) for iOS does not verify X.509 c (no CVSS)
- [CVE-2017-5916](https://cve.now/CVE-2017-5916.md): The America's First Federal Credit Union (FCU) Mobile Banking app 3.1.0 for iOS does not verify X.509 certificates from SSL servers, which a (no CVSS)
- [CVE-2017-5918](https://cve.now/CVE-2017-5918.md): The Banco de Costa Rica BCR Movil app 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attack (no CVSS)
- [CVE-2017-5919](https://cve.now/CVE-2017-5919.md): The 21st Century Insurance app 10.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers (no CVSS)
- [CVE-2017-8058](https://cve.now/CVE-2017-8058.md): Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically p (no CVSS)
- [CVE-2017-8059](https://cve.now/CVE-2017-8059.md): Acceptance of invalid/self-signed TLS certificates in "Foxit PDF - PDF reader, editor, form, signature" before 5.4 for iOS allows a man-in-t (no CVSS)
- [CVE-2017-8060](https://cve.now/CVE-2017-8060.md): Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proxi (no CVSS)
- [CVE-2017-8787](https://cve.now/CVE-2017-8787.md): The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in base/PdfXRefStreamParserObject.cpp:224 in PoDoFo 0.9.5 allows remote (no CVSS)
- [CVE-2017-8786](https://cve.now/CVE-2017-8786.md): pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified ot (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-05-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.