# CVEs published 2017-05-11 25 CVEs were published on May 11, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-8906](https://cve.now/CVE-2017-8906.md): An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.4, as (no CVSS) - [CVE-2017-7472](https://cve.now/CVE-2017-7472.md): The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of K (no CVSS, Linux kernel before) - [CVE-2017-8903](https://cve.now/CVE-2017-8903.md): Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitra (no CVSS) - [CVE-2017-8904](https://cve.now/CVE-2017-8904.md): Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP\_transfer (aka guest transfer) operations, which mig (no CVSS) - [CVE-2017-8905](https://cve.now/CVE-2017-8905.md): Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the h (no CVSS) - [CVE-2016-10370](https://cve.now/CVE-2016-10370.md): An issue was discovered on OnePlus devices such as the 3T. (no CVSS) - [CVE-2017-5948](https://cve.now/CVE-2017-5948.md): An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. (no CVSS) - [CVE-2017-8850](https://cve.now/CVE-2017-8850.md): An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. (no CVSS) - [CVE-2017-8851](https://cve.now/CVE-2017-8851.md): An issue was discovered on OnePlus One and X devices. (no CVSS) - [CVE-2017-8897](https://cve.now/CVE-2017-8897.md): Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/conve (no CVSS) - [CVE-2017-8898](https://cve.now/CVE-2017-8898.md): Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from a (no CVSS) - [CVE-2017-8899](https://cve.now/CVE-2017-8899.md): Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the at (no CVSS) - [CVE-2016-7476](https://cve.now/CVE-2016-7476.md): The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe 11.6.0 before 11. (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Contr…) - [CVE-2015-5436](https://cve.now/CVE-2015-5436.md): A potential security vulnerability has been identified with HP Integrated Lights-Out 4 (iLO 4) firmware version 2.11 and later, but prior to (no CVSS, HP Integrated Lights-Out) - [CVE-2016-2126](https://cve.now/CVE-2016-2126.md): Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC (Privilege Attribute Certificate) (no CVSS) - [CVE-2016-9092](https://cve.now/CVE-2016-9092.md): The Symantec Content Analysis (CA) 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense (MTD) 1.1 management consoles are susceptible to a cro (no CVSS, Symantec Content Analysis · Symantec Mail Threat Defense) - [CVE-2016-9097](https://cve.now/CVE-2016-9097.md): The Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.8, ProxySG 6.5 prior 6.5.10.6, ProxySG 6.6 prior to 6.6.5.8, and ProxySG 6.7 p (no CVSS, Symantec Advanced Secure Gateway (ASG) and ProxySG) - [CVE-2016-9099](https://cve.now/CVE-2016-9099.md): Symantec Advanced Secure Gateway (ASG) 6.6, ASG 6.7 prior to 6.7.2.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6, and ProxySG 6.7 prior to 6 (no CVSS, Symantec ASG · Symantec ProxySG) - [CVE-2016-9100](https://cve.now/CVE-2016-9100.md): Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.13, ASG 6.7 prior to 6.7.3.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6 prior to (no CVSS, Symantec ASG · Symantec ProxySG) - [CVE-2017-2681](https://cve.now/CVE-2017-2681.md): Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial of service con (CVSS 6.5, Siemens Development/Evaluation Kits for PROFINET IO: DK… +93) - [CVE-2017-6865](https://cve.now/CVE-2017-6865.md): A vulnerability has been identified in Primary Setup Tool (PST) (All versions \< V4.2 HF1), SIMATIC Automation Tool (All versions \< V3.0), SI (no CVSS, Siemens AG Primary Setup Tool · Siemens AG SIMATIC Auto… +15) - [CVE-2017-6867](https://cve.now/CVE-2017-6867.md): A vulnerability was discovered in Siemens SIMATIC WinCC (V7.3 before Upd 11 and V7.4 before SP1), SIMATIC WinCC Runtime Professional (V13 be (no CVSS, Siemens SIMATIC WinCC) - [CVE-2017-2680](https://cve.now/CVE-2017-2680.md): Specially crafted PROFINET DCP broadcast packets could cause a denial of service condition of affected products on a local Ethernet segment (CVSS 6.5, Siemens Development/Evaluation Kits for PROFINET IO: D… +106) - [CVE-2017-5461](https://cve.now/CVE-2017-5461.md): Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 a (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1) - [CVE-2017-8798](https://cve.now/CVE-2017-8798.md): Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of service or possibly h (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-05-11 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.