# CVEs published 2017-05-08 26 CVEs were published on May 8, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-4982](https://cve.now/CVE-2017-4982.md): EMC Mainframe Enablers ResourcePak Base versions 7.6.0, 8.0.0, and 8.1.0 contains a fix for a privilege management vulnerability that could (no CVSS, EMC Mainframe Enablers ResourcePak Base versions 7.6.0, 8.0…) - [CVE-2017-0890](https://cve.now/CVE-2017-0890.md): Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. (no CVSS, Nextcloud Server) - [CVE-2017-0891](https://cve.now/CVE-2017-0891.md): Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabiliti (no CVSS, Nextcloud Server) - [CVE-2017-0892](https://cve.now/CVE-2017-0892.md): Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to (no CVSS, Nextcloud Server) - [CVE-2017-0893](https://cve.now/CVE-2017-0893.md): Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which (no CVSS, Nextcloud Server) - [CVE-2017-0894](https://cve.now/CVE-2017-0894.md): Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. (no CVSS, Nextcloud Server) - [CVE-2017-0895](https://cve.now/CVE-2017-0895.md): Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. (no CVSS, Nextcloud Server) - [CVE-2016-10369](https://cve.now/CVE-2016-10369.md): unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (prevent (no CVSS) - [CVE-2016-8202](https://cve.now/CVE-2016-8202.md): A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and (no CVSS, Brocade Communications Systems Fibre Channel SAN products r…) - [CVE-2016-8209](https://cve.now/CVE-2016-8209.md): Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Ma (no CVSS, Brocade Communications Systems NetIron XMR/MLX and Brocade…) - [CVE-2017-6051](https://cve.now/CVE-2017-6051.md): An Uncontrolled Search Path Element issue was discovered in BLF-Tech LLC VisualView HMI Version 9.9.14.0 and prior. (no CVSS, BLF-Tech LLC VisualView HMI) - [CVE-2017-6953](https://cve.now/CVE-2017-6953.md): Gemalto SmartDiag Diagnosis Tool v2.5 has a stack-based Buffer Overflow with SEH Overwrite via long "Register a new card" input fields. (no CVSS) - [CVE-2017-8848](https://cve.now/CVE-2017-8848.md): Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password. (no CVSS) - [CVE-2017-8825](https://cve.now/CVE-2017-8825.md): A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. (no CVSS) - [CVE-2017-8842](https://cve.now/CVE-2017-8842.md): The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (divide- (no CVSS) - [CVE-2017-8843](https://cve.now/CVE-2017-8843.md): The join\_pthread function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL pointer deref (no CVSS) - [CVE-2017-8844](https://cve.now/CVE-2017-8844.md): The read\_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (heap-based buffer overf (no CVSS) - [CVE-2017-8845](https://cve.now/CVE-2017-8845.md): The lzo1x\_decompress function in lzo1x\_d.ch in LZO 2.08, as used in lrzip 0.631, allows remote attackers to cause a denial of service (inval (no CVSS) - [CVE-2017-8846](https://cve.now/CVE-2017-8846.md): The read\_stream function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (use-after-free and (no CVSS) - [CVE-2017-8847](https://cve.now/CVE-2017-8847.md): The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL po (no CVSS) - [CVE-2017-8827](https://cve.now/CVE-2017-8827.md): forgotpassword.php in GeniXCMS 1.0.2 lacks a rate limit, which might allow remote attackers to cause a denial of service (login inability) o (no CVSS, genix/cms) - [CVE-2017-8829](https://cve.now/CVE-2017-8829.md): Deserialization vulnerability in lintian through 2.5.50.3 allows attackers to trigger code execution by requesting a review of a source pack (no CVSS) - [CVE-2017-8830](https://cve.now/CVE-2017-8830.md): In ImageMagick 7.0.5-6, the ReadBMPImage function in bmp.c:1379 allows attackers to cause a denial of service (memory leak) via a crafted fi (no CVSS) - [CVE-2017-8831](https://cve.now/CVE-2017-8831.md): The saa7164\_bus\_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5 allows local users to cause a den (no CVSS) - [CVE-2017-8832](https://cve.now/CVE-2017-8832.md): Allen Disk 1.6 has XSS in the id parameter to downfile.php. (no CVSS) - [CVE-2017-8833](https://cve.now/CVE-2017-8833.md): Zen Cart 1.6.0 has XSS in the main\_page parameter to index.php. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-05-08 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.