# CVEs published 2017-05-10

31 CVEs were published on May 10, 2017: 1 critical, 0 high. Days are UTC.

- [CVE-2017-8895](https://cve.now/CVE-2017-8895.md): In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulner (no CVSS)
- [CVE-2017-8852](https://cve.now/CVE-2017-8852.md): SAP SAPCAR 721.510 has a Heap Based Buffer Overflow Vulnerability. (no CVSS)
- [CVE-2017-8892](https://cve.now/CVE-2017-8892.md): Cross-site scripting (XSS) vulnerability in OpenText Tempo Box 10.0.3 allows remote attackers to inject arbitrary web script or HTML persist (no CVSS)
- [CVE-2017-3894](https://cve.now/CVE-2017-3894.md): A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, and (no CVSS, BlackBerry Unified Endpoint Manager · BlackBerry BES12)
- [CVE-2017-8890](https://cve.now/CVE-2017-8890.md): The inet\_csk\_clone\_lock function in net/ipv4/inet\_connection\_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial o (no CVSS)
- [CVE-2017-8891](https://cve.now/CVE-2017-8891.md): Dropbox Lepton 1.2.1 allows DoS (SEGV and application crash) via a malformed lepton file because the code does not ensure setup of a correct (no CVSS)
- [CVE-2016-3032](https://cve.now/CVE-2016-3032.md): IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. (no CVSS, IBM Cognos Analytics)
- [CVE-2016-5888](https://cve.now/CVE-2016-5888.md): IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site scripting. (no CVSS, IBM Interact)
- [CVE-2016-5889](https://cve.now/CVE-2016-5889.md): IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unau (no CVSS, IBM Interact)
- [CVE-2016-6035](https://cve.now/CVE-2016-6035.md): IBM Rational Quality Manager is vulnerable to cross-site scripting. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2016-6037](https://cve.now/CVE-2016-6037.md): IBM Rational Team Concert (RTC) is vulnerable to HTML injection. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2016-9250](https://cve.now/CVE-2016-9250.md): In F5 BIG-IP 11.2.1, 11.4.0 through 11.6.1, and 12.0.0 through 12.1.2, an unauthenticated user with access to the control plane may be able (no CVSS, F5 Networks BIG-IP)
- [CVE-2017-1103](https://cve.now/CVE-2017-1103.md): IBM Team Concert (RTC) is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2017-1137](https://cve.now/CVE-2017-1137.md): IBM WebSphere Application Server 8.0 and 8.5.5 could provide weaker than expected security. (no CVSS, IBM WebSphere Application Server)
- [CVE-2017-4895](https://cve.now/CVE-2017-4895.md): Airwatch Agent for Android contains a vulnerability that may allow a device to bypass root detection. (no CVSS, VMware Airwatch Agent)
- [CVE-2017-4896](https://cve.now/CVE-2017-4896.md): Airwatch Inbox for Android contains a vulnerability that may allow a rooted device to decrypt the local data used by the application. (no CVSS, VMware Airwatch Console · VMware Airwatch Inbox)
- [CVE-2017-7698](https://cve.now/CVE-2017-7698.md): A Use After Free in the pdf2swf part of swftools 0.9.2 and earlier allows remote attackers to execute arbitrary code via a malformed PDF doc (no CVSS)
- [CVE-2017-7886](https://cve.now/CVE-2017-7886.md): Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter. (no CVSS, dolibarr/dolibarr)
- [CVE-2017-7887](https://cve.now/CVE-2017-7887.md): Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter. (no CVSS, dolibarr/dolibarr)
- [CVE-2017-7888](https://cve.now/CVE-2017-7888.md): Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier. (no CVSS, dolibarr/dolibarr)
- [CVE-2017-8879](https://cve.now/CVE-2017-8879.md): Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attack (no CVSS, dolibarr/dolibarr)
- [CVE-2016-10371](https://cve.now/CVE-2016-10371.md): The TIFFWriteDirectoryTagCheckedRational function in tif\_dirwrite.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (a (no CVSS)
- [CVE-2017-5891](https://cve.now/CVE-2017-5891.md): ASUS RT-AC\* and RT-N\* devices with firmware before 3.0.0.4.380.7378 have Login Page CSRF and Save Settings CSRF. (no CVSS)
- [CVE-2017-5892](https://cve.now/CVE-2017-5892.md): ASUS RT-AC\* and RT-N\* devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map. (no CVSS)
- [CVE-2017-8868](https://cve.now/CVE-2017-8868.md): acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php. (no CVSS)
- [CVE-2017-8872](https://cve.now/CVE-2017-8872.md): The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or infor (CVSS 9.1)
- [CVE-2017-8874](https://cve.now/CVE-2017-8874.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for (no CVSS, mautic/core)
- [CVE-2017-8875](https://cve.now/CVE-2017-8875.md): CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL. (no CVSS)
- [CVE-2017-8876](https://cve.now/CVE-2017-8876.md): Symphony 2 2.6.11 has XSS in the meta\[navigation\_group\] parameter to content/content.blueprintssections.php. (no CVSS)
- [CVE-2017-8877](https://cve.now/CVE-2017-8877.md): ASUS RT-AC\* and RT-N\* devices with firmware through 3.0.0.4.380.7378 allow JSONP Information Disclosure such as the SSID. (no CVSS)
- [CVE-2017-8878](https://cve.now/CVE-2017-8878.md): ASUS RT-AC\* and RT-N\* devices with firmware before 3.0.0.4.380.7378 allow remote authenticated users to discover the Wi-Fi password via WPS\_ (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-05-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.