CVEs published May 10, 2017
31 CVEs were published on May 10, 2017: 1 critical, 0 high.
- Published
- 31
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- dolibarr/dolibarr
- 4
- IBM Rational Collaborative Lifecycle Management
- 3
- IBM Interact
- 2
- BlackBerry Unified Endpoint Manager · BlackBerry BES12
- 1
- F5 Networks BIG-IP
- 1
- IBM Cognos Analytics
- 1
- IBM WebSphere Application Server
- 1
- mautic/core
- 1
- VMware Airwatch Agent
- 1
- VMware Airwatch Console · VMware Airwatch Inbox
- 1
Critical 1
Medium, low and unrated 30
- CVE-2017-8895In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulner
- CVE-2017-8852SAP SAPCAR 721.510 has a Heap Based Buffer Overflow Vulnerability.
- CVE-2017-8892Cross-site scripting (XSS) vulnerability in OpenText Tempo Box 10.0.3 allows remote attackers to inject arbitrary web script or HTML persist
- CVE-2017-3894A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, andBlackBerry Unified Endpoint Manager · BlackBerry BES12
- CVE-2017-8890The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial o
- CVE-2017-8891Dropbox Lepton 1.2.1 allows DoS (SEGV and application crash) via a malformed lepton file because the code does not ensure setup of a correct
- CVE-2016-3032IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting.IBM Cognos Analytics
- CVE-2016-5888IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site scripting.IBM Interact
- CVE-2016-5889IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauIBM Interact
- CVE-2016-6035IBM Rational Quality Manager is vulnerable to cross-site scripting.IBM Rational Collaborative Lifecycle Management
- CVE-2016-6037IBM Rational Team Concert (RTC) is vulnerable to HTML injection.IBM Rational Collaborative Lifecycle Management
- CVE-2016-9250In F5 BIG-IP 11.2.1, 11.4.0 through 11.6.1, and 12.0.0 through 12.1.2, an unauthenticated user with access to the control plane may be able F5 Networks BIG-IP
- CVE-2017-1103IBM Team Concert (RTC) is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML dataIBM Rational Collaborative Lifecycle Management
- CVE-2017-1137IBM WebSphere Application Server 8.0 and 8.5.5 could provide weaker than expected security.IBM WebSphere Application Server
- CVE-2017-4895Airwatch Agent for Android contains a vulnerability that may allow a device to bypass root detection.VMware Airwatch Agent
- CVE-2017-4896Airwatch Inbox for Android contains a vulnerability that may allow a rooted device to decrypt the local data used by the application.VMware Airwatch Console · VMware Airwatch Inbox
- CVE-2017-7698A Use After Free in the pdf2swf part of swftools 0.9.2 and earlier allows remote attackers to execute arbitrary code via a malformed PDF doc
- CVE-2017-7886Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter.dolibarr/dolibarr
- CVE-2017-7887Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter.dolibarr/dolibarr
- CVE-2017-7888Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier.dolibarr/dolibarr
- CVE-2017-8879Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackdolibarr/dolibarr
- CVE-2016-10371The TIFFWriteDirectoryTagCheckedRational function in tif_dirwrite.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (a
- CVE-2017-5891ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 have Login Page CSRF and Save Settings CSRF.
- CVE-2017-5892ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map.
- CVE-2017-8868acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php.
- CVE-2017-8874Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for mautic/core
- CVE-2017-8875CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL.
- CVE-2017-8876Symphony 2 2.6.11 has XSS in the meta[navigation_group] parameter to content/content.blueprintssections.php.
- CVE-2017-8877ASUS RT-AC* and RT-N* devices with firmware through 3.0.0.4.380.7378 allow JSONP Information Disclosure such as the SSID.
- CVE-2017-8878ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 allow remote authenticated users to discover the Wi-Fi password via WPS_