# CVEs published 2017-05-12

174 CVEs were published on May 12, 2017: 0 critical, 6 high. 5 are now in CISA KEV. Days are UTC.

- [CVE-2017-5654](https://cve.now/CVE-2017-5654.md): In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthorized read access to (no CVSS, Apache Software Foundation Apache Ambari)
- [CVE-2017-8924](https://cve.now/CVE-2017-8924.md): The edge\_bulk\_in\_callback function in drivers/usb/serial/io\_ti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive in (no CVSS)
- [CVE-2017-8925](https://cve.now/CVE-2017-8925.md): The omninet\_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of service (no CVSS)
- [CVE-2016-10329](https://cve.now/CVE-2016-10329.md): Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code v (no CVSS, Synology Photo Station)
- [CVE-2016-10330](https://cve.now/CVE-2016-10330.md): Directory traversal vulnerability in synophoto\_dsm\_user, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local us (no CVSS, Synology Photo Station)
- [CVE-2016-10331](https://cve.now/CVE-2016-10331.md): Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary file (no CVSS, Synology Photo Station)
- [CVE-2017-8244](https://cve.now/CVE-2017-8244.md): In core\_info\_read and inst\_info\_read in all Android releases from CAF using the Linux kernel, variable "dbg\_buf", "dbg\_buf-\>curr" and "dbg\_b (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-8245](https://cve.now/CVE-2017-8245.md): In all Android releases from CAF using the Linux kernel, while processing a voice SVC request which is nonstandard by specifying a payload s (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-8246](https://cve.now/CVE-2017-8246.md): In function msm\_pcm\_playback\_close() in all Android releases from CAF using the Linux kernel, prtd is assigned substream-\>runtime-\>private\_d (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-8923](https://cve.now/CVE-2017-8923.md): The zend\_string\_extend function in Zend/zend\_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negat (no CVSS)
- [CVE-2017-7474](https://cve.now/CVE-2017-7474.md): It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. (no CVSS, Red Hat Keycloak Node.js adapter · keycloak-connect +1)
- [CVE-2017-7484](https://cve.now/CVE-2017-7484.md): It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before (no CVSS, The PostgreSQL Global Development Group PostgreSQL)
- [CVE-2017-7485](https://cve.now/CVE-2017-7485.md): In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL envir (no CVSS, The PostgreSQL Global Development Group PostgreSQL)
- [CVE-2017-7486](https://cve.now/CVE-2017-7486.md): PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg\_user\_mappings view which discloses foreign server passwords to any us (no CVSS, The PostgreSQL Global Development Group PostgreSQL)
- [CVE-2017-8921](https://cve.now/CVE-2017-8921.md): In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data (no CVSS)
- [CVE-2016-4838](https://cve.now/CVE-2016-4838.md): The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior t (no CVSS, Money Foward Money Forward · SOURCENEXT Money Forward fo… +2)
- [CVE-2016-4839](https://cve.now/CVE-2016-4839.md): The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior t (no CVSS, Money Foward Money Forward · SOURCENEXT Money Forward fo… +2)
- [CVE-2016-4855](https://cve.now/CVE-2016-4855.md): Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unsp (no CVSS, ADOdb · adodb/adodb-php)
- [CVE-2016-4856](https://cve.now/CVE-2016-4856.md): Cross-site scripting vulnerability in Splunk Enterprise 6.3.x prior to 6.3.5 and Splunk Light 6.3.x prior to 6.3.5 allows attacker with admi (no CVSS, Splunk Enterprise · Splunk Light)
- [CVE-2016-4857](https://cve.now/CVE-2016-4857.md): Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior (no CVSS, Splunk Enterprise · Splunk Light)
- [CVE-2016-4858](https://cve.now/CVE-2016-4858.md): Cross-site scripting vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2. (no CVSS, Splunk Enterprise · Splunk Light)
- [CVE-2016-4859](https://cve.now/CVE-2016-4859.md): Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior (no CVSS, Splunk Enterprise · Splunk Light)
- [CVE-2016-4864](https://cve.now/CVE-2016-4864.md): H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string spec (no CVSS, Kazuho Oku H2O)
- [CVE-2016-4876](https://cve.now/CVE-2016-4876.md): Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication (no CVSS, baserCMS Users Community baserCMS)
- [CVE-2016-4877](https://cve.now/CVE-2016-4877.md): Cross-site scripting vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote authenticated attackers to inject arbitr (no CVSS, baserCMS Users Community baserCMS plugin Mail)
- [CVE-2016-4878](https://cve.now/CVE-2016-4878.md): Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication (no CVSS, baserCMS Users Community baserCMS · baserproject/basercms)
- [CVE-2016-4879](https://cve.now/CVE-2016-4879.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the aut (no CVSS, baserCMS Users Community baserCMS plugin Mail · baserprojec…)
- [CVE-2016-4880](https://cve.now/CVE-2016-4880.md): Cross-site scripting vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote authenticated attackers to inject arbitr (no CVSS, baserCMS Users Community baserCMS plugin Blog · baserprojec…)
- [CVE-2016-4881](https://cve.now/CVE-2016-4881.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the aut (no CVSS, baserCMS Users Community baserCMS plugin Blog · baserprojec…)
- [CVE-2016-4882](https://cve.now/CVE-2016-4882.md): Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication (no CVSS, baserCMS Users Community baserCMS)
- [CVE-2016-4883](https://cve.now/CVE-2016-4883.md): Cross-site scripting vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to inject arbitrary web script or HTML via (no CVSS, baserCMS Users Community baserCMS)
- [CVE-2016-4884](https://cve.now/CVE-2016-4884.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the aut (no CVSS, baserCMS Users Community baserCMS plugin Blog)
- [CVE-2016-4885](https://cve.now/CVE-2016-4885.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Feed version 3.0.10 and earlier allows remote attackers to hijack the aut (no CVSS, baserCMS Users Community baserCMS plugin Feed)
- [CVE-2016-4886](https://cve.now/CVE-2016-4886.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the aut (no CVSS, baserCMS Users Community baserCMS plugin Mail)
- [CVE-2016-4887](https://cve.now/CVE-2016-4887.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Uploader version 3.0.10 and earlier allows remote attackers to hijack the (no CVSS, baserCMS Users Community baserCMS plugin Uploader)
- [CVE-2017-2122](https://cve.now/CVE-2017-2122.md): Cross-site scripting vulnerability in Nessus versions 6.8.0, 6.8.1, 6.9.0, 6.9.1 and 6.9.2 allows remote authenticated attackers to inject a (no CVSS, Tenable Network Security Nessus)
- [CVE-2017-2157](https://cve.now/CVE-2017-2157.md): Untrusted search path vulnerability in installers for The Public Certification Service for Individuals "The JPKI user's software (for Window (no CVSS, Japan Agency for Local Authority Information Systems Ins… +1)
- [CVE-2017-2163](https://cve.now/CVE-2017-2163.md): Directory traversal vulnerability in SOY CMS Ver.1.8.1 to Ver.1.8.12 allows authenticated attackers to read arbitrary files via shop\_id. (no CVSS, Nippon Institute of Agroinformatics SOY CMS)
- [CVE-2017-2164](https://cve.now/CVE-2017-2164.md): Cross-site scripting vulnerability in SOY CMS with installer 1.8.12 and earlier allows remote attackers to inject arbitrary web script or HT (no CVSS, Nippon Institute of Agroinformatics SOY CMS with installer)
- [CVE-2017-2167](https://cve.now/CVE-2017-2167.md): Untrusted search path vulnerability in Installer for PrimeDrive Desktop Application version 1.4.4 and earlier allows remote attackers to exe (no CVSS, SoftBank Installer for PrimeDrive Desktop Application)
- [CVE-2016-10274](https://cve.now/CVE-2016-10274.md): An elevation of privilege vulnerability in the MediaTek touchscreen driver could enable a local malicious application to execute arbitrary c (no CVSS, Google Android)
- [CVE-2016-10275](https://cve.now/CVE-2016-10275.md): An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code with (no CVSS, Google Android)
- [CVE-2016-10276](https://cve.now/CVE-2016-10276.md): An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code with (no CVSS, Google Android)
- [CVE-2016-10277](https://cve.now/CVE-2016-10277.md): An elevation of privilege vulnerability in the Motorola bootloader could enable a local malicious application to execute arbitrary code with (no CVSS, Google Android)
- [CVE-2016-10280](https://cve.now/CVE-2016-10280.md): An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary code (no CVSS, Google Android)
- [CVE-2016-10281](https://cve.now/CVE-2016-10281.md): An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary code (no CVSS, Google Android)
- [CVE-2016-10282](https://cve.now/CVE-2016-10282.md): An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary code (no CVSS, Google Android)
- [CVE-2016-10283](https://cve.now/CVE-2016-10283.md): An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2016-10284](https://cve.now/CVE-2016-10284.md): An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2016-10285](https://cve.now/CVE-2016-10285.md): An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2016-10286](https://cve.now/CVE-2016-10286.md): An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2016-10287](https://cve.now/CVE-2016-10287.md): An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2016-10288](https://cve.now/CVE-2016-10288.md): An elevation of privilege vulnerability in the Qualcomm LED driver could enable a local malicious application to execute arbitrary code with (no CVSS, Google Android)
- [CVE-2016-10289](https://cve.now/CVE-2016-10289.md): An elevation of privilege vulnerability in the Qualcomm crypto driver could enable a local malicious application to execute arbitrary code w (no CVSS, Google Android)
- [CVE-2016-10290](https://cve.now/CVE-2016-10290.md): An elevation of privilege vulnerability in the Qualcomm shared memory driver could enable a local malicious application to execute arbitrary (no CVSS, Google Android)
- [CVE-2016-10291](https://cve.now/CVE-2016-10291.md): An elevation of privilege vulnerability in the Qualcomm Slimbus driver could enable a local malicious application to execute arbitrary code (no CVSS, Google Android)
- [CVE-2016-10292](https://cve.now/CVE-2016-10292.md): A denial of service vulnerability in the Qualcomm Wi-Fi driver could enable a proximate attacker to cause a denial of service in the Wi-Fi s (no CVSS, Google Android)
- [CVE-2016-10293](https://cve.now/CVE-2016-10293.md): An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of it (no CVSS, Google Android)
- [CVE-2016-10294](https://cve.now/CVE-2016-10294.md): An information disclosure vulnerability in the Qualcomm power driver could enable a local malicious application to access data outside of it (no CVSS, Google Android)
- [CVE-2016-10295](https://cve.now/CVE-2016-10295.md): An information disclosure vulnerability in the Qualcomm LED driver could enable a local malicious application to access data outside of its (no CVSS, Google Android)
- [CVE-2016-10296](https://cve.now/CVE-2016-10296.md): An information disclosure vulnerability in the Qualcomm shared memory driver could enable a local malicious application to access data outsi (no CVSS, Google Android)
- [CVE-2017-0465](https://cve.now/CVE-2017-0465.md): An elevation of privilege vulnerability in the Qualcomm ADSPRPC driver could enable a local malicious application to execute arbitrary code (no CVSS, Google Android)
- [CVE-2017-0493](https://cve.now/CVE-2017-0493.md): An information disclosure vulnerability in File-Based Encryption could enable a local malicious attacker to bypass operating system protecti (no CVSS, Google Android)
- [CVE-2017-0587](https://cve.now/CVE-2017-0587.md): A remote code execution vulnerability in libmpeg2 in Mediaserver could enable an attacker using a specially crafted file to cause memory cor (no CVSS, Google Android)
- [CVE-2017-0588](https://cve.now/CVE-2017-0588.md): A remote code execution vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable an attacker using a specially crafted fil (no CVSS, Google Android)
- [CVE-2017-0589](https://cve.now/CVE-2017-0589.md): A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corr (no CVSS, Google Android)
- [CVE-2017-0590](https://cve.now/CVE-2017-0590.md): A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corr (no CVSS, Google Android)
- [CVE-2017-0591](https://cve.now/CVE-2017-0591.md): A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corru (no CVSS, Google Android)
- [CVE-2017-0592](https://cve.now/CVE-2017-0592.md): A remote code execution vulnerability in FLACExtractor.cpp in libstagefright in Mediaserver could enable an attacker using a specially craft (no CVSS, Google Android)
- [CVE-2017-0593](https://cve.now/CVE-2017-0593.md): An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to obtain access to custom permissi (no CVSS, Google Android)
- [CVE-2017-0594](https://cve.now/CVE-2017-0594.md): An elevation of privilege vulnerability in codecs/aacenc/SoftAACEncoder2.cpp in libstagefright in Mediaserver could enable a local malicious (no CVSS, Google Android)
- [CVE-2017-0595](https://cve.now/CVE-2017-0595.md): An elevation of privilege vulnerability in libstagefright in Mediaserver could enable a local malicious application to execute arbitrary cod (no CVSS, Google Android)
- [CVE-2017-0596](https://cve.now/CVE-2017-0596.md): An elevation of privilege vulnerability in libstagefright in Mediaserver could enable a local malicious application to execute arbitrary cod (no CVSS, Google Android)
- [CVE-2017-0597](https://cve.now/CVE-2017-0597.md): An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the conte (no CVSS, Google Android)
- [CVE-2017-0598](https://cve.now/CVE-2017-0598.md): An information disclosure vulnerability in the Framework APIs could enable a local malicious application to bypass operating system protecti (no CVSS, Google Android)
- [CVE-2017-0599](https://cve.now/CVE-2017-0599.md): A remote denial of service vulnerability in libhevc in Mediaserver could enable an attacker to use a specially crafted file to cause a devic (no CVSS, Google Android)
- [CVE-2017-0600](https://cve.now/CVE-2017-0600.md): A remote denial of service vulnerability in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause (no CVSS, Google Android)
- [CVE-2017-0601](https://cve.now/CVE-2017-0601.md): An Elevation of Privilege vulnerability in Bluetooth could potentially enable a local malicious application to accept harmful files shared v (no CVSS, Google Android)
- [CVE-2017-0602](https://cve.now/CVE-2017-0602.md): An information disclosure vulnerability in Bluetooth could allow a local malicious application to bypass operating system protections that i (no CVSS, Google Android)
- [CVE-2017-0603](https://cve.now/CVE-2017-0603.md): A denial of service vulnerability in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a devic (no CVSS, Google Android)
- [CVE-2017-0604](https://cve.now/CVE-2017-0604.md): An elevation of privilege vulnerability in the kernel Qualcomm power driver could enable a local malicious application to execute arbitrary (no CVSS, Google Android)
- [CVE-2017-0606](https://cve.now/CVE-2017-0606.md): An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2017-0607](https://cve.now/CVE-2017-0607.md): An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2017-0608](https://cve.now/CVE-2017-0608.md): An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2017-0609](https://cve.now/CVE-2017-0609.md): An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2017-0610](https://cve.now/CVE-2017-0610.md): An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2017-0611](https://cve.now/CVE-2017-0611.md): An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2017-0612](https://cve.now/CVE-2017-0612.md): An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious appl (no CVSS, Google Android)
- [CVE-2017-0613](https://cve.now/CVE-2017-0613.md): An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious appl (no CVSS, Google Android)
- [CVE-2017-0614](https://cve.now/CVE-2017-0614.md): An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious appl (no CVSS, Google Android)
- [CVE-2017-0615](https://cve.now/CVE-2017-0615.md): An elevation of privilege vulnerability in the MediaTek power driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2017-0616](https://cve.now/CVE-2017-0616.md): An elevation of privilege vulnerability in the MediaTek system management interrupt driver could enable a local malicious application to exe (no CVSS, Google Android)
- [CVE-2017-0617](https://cve.now/CVE-2017-0617.md): An elevation of privilege vulnerability in the MediaTek video driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2017-0618](https://cve.now/CVE-2017-0618.md): An elevation of privilege vulnerability in the MediaTek command queue driver could enable a local malicious application to execute arbitrary (no CVSS, Google Android)
- [CVE-2017-0619](https://cve.now/CVE-2017-0619.md): An elevation of privilege vulnerability in the Qualcomm pin controller driver could enable a local malicious application to execute arbitrar (no CVSS, Google Android)
- [CVE-2017-0620](https://cve.now/CVE-2017-0620.md): An elevation of privilege vulnerability in the Qualcomm Secure Channel Manager driver could enable a local malicious application to execute (no CVSS, Google Android)
- [CVE-2017-0621](https://cve.now/CVE-2017-0621.md): An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code w (no CVSS, Google Android)
- [CVE-2017-0622](https://cve.now/CVE-2017-0622.md): An elevation of privilege vulnerability in the Goodix touchscreen driver could enable a local malicious application to execute arbitrary cod (no CVSS, Google Android)
- [CVE-2017-0623](https://cve.now/CVE-2017-0623.md): An elevation of privilege vulnerability in the HTC bootloader could enable a local malicious application to execute arbitrary code within th (no CVSS, Google Android)
- [CVE-2017-0624](https://cve.now/CVE-2017-0624.md): An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of it (no CVSS, Google Android)
- [CVE-2017-0625](https://cve.now/CVE-2017-0625.md): An information disclosure vulnerability in the MediaTek command queue driver could enable a local malicious application to access data outsi (no CVSS, Google Android)
- [CVE-2017-0626](https://cve.now/CVE-2017-0626.md): An information disclosure vulnerability in the Qualcomm crypto engine driver could enable a local malicious application to access data outsi (no CVSS, Google Android)
- [CVE-2017-0627](https://cve.now/CVE-2017-0627.md): An information disclosure vulnerability in the kernel UVC driver could enable a local malicious application to access data outside of its pe (no CVSS, Google Android)
- [CVE-2017-0628](https://cve.now/CVE-2017-0628.md): An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of i (no CVSS, Google Android)
- [CVE-2017-0629](https://cve.now/CVE-2017-0629.md): An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of i (no CVSS, Google Android)
- [CVE-2017-0630](https://cve.now/CVE-2017-0630.md): An information disclosure vulnerability in the kernel trace subsystem could enable a local malicious application to access data outside of i (no CVSS, Google Android)
- [CVE-2017-0631](https://cve.now/CVE-2017-0631.md): An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of i (no CVSS, Google Android)
- [CVE-2017-0632](https://cve.now/CVE-2017-0632.md): An information disclosure vulnerability in the Qualcomm sound codec driver could enable a local malicious application to access data outside (no CVSS, Google Android)
- [CVE-2017-0633](https://cve.now/CVE-2017-0633.md): An information disclosure vulnerability in the Broadcom Wi-Fi driver could enable a local malicious component to access data outside of its (no CVSS, Google Android)
- [CVE-2017-0634](https://cve.now/CVE-2017-0634.md): An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outsid (no CVSS)
- [CVE-2017-0635](https://cve.now/CVE-2017-0635.md): A remote denial of service vulnerability in HevcUtils.cpp in libstagefright in Mediaserver could enable an attacker to use a specially craft (no CVSS, Google Android)
- [CVE-2017-0064](https://cve.now/CVE-2017-0064.md): A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mixed Content warnings, aka "Internet Explorer (no CVSS, Microsoft Internet Explorer)
- [CVE-2017-0077](https://cve.now/CVE-2017-0077.md): The kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, (no CVSS, Microsoft Windows)
- [CVE-2017-0171](https://cve.now/CVE-2017-0171.md): Windows DNS Server allows a denial of service vulnerability when Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and (no CVSS, Microsoft Windows DNS Server)
- [CVE-2017-0175](https://cve.now/CVE-2017-0175.md): The Windows kernel in Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows authenticated attackers to obtain sensitive information v (no CVSS, Microsoft Windows)
- [CVE-2017-0190](https://cve.now/CVE-2017-0190.md): The GDI component in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8 (no CVSS, Microsoft Windows)
- [CVE-2017-0212](https://cve.now/CVE-2017-0212.md): Windows Hyper-V allows an elevation of privilege vulnerability when Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 (no CVSS, Microsoft Hyper-V)
- [CVE-2017-0213](https://cve.now/CVE-2017-0213.md): Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2 (CVSS 7.3, KEV, Microsoft Windows COM)
- [CVE-2017-0214](https://cve.now/CVE-2017-0214.md): Windows COM in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wi (no CVSS, Microsoft Windows COM)
- [CVE-2017-0220](https://cve.now/CVE-2017-0220.md): The Windows kernel in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows Server 2012 Gold allows authenticated attackers to obta (no CVSS, Microsoft Windows)
- [CVE-2017-0221](https://cve.now/CVE-2017-0221.md): A vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This (no CVSS, Microsoft Edge)
- [CVE-2017-0222](https://cve.now/CVE-2017-0222.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor (CVSS 8.8, KEV, Microsoft Internet Explorer)
- [CVE-2017-0224](https://cve.now/CVE-2017-0224.md): A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft Edge, aka "Sc (no CVSS, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2017-0226](https://cve.now/CVE-2017-0226.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2017-0227](https://cve.now/CVE-2017-0227.md): A remote code execution vulnerability exists in Microsoft Edge in the way affected Microsoft scripting engines render when handling objects (no CVSS, Microsoft Edge)
- [CVE-2017-0228](https://cve.now/CVE-2017-0228.md): A remote code execution vulnerability exists in Microsoft browsers in the way JavaScript engines render when handling objects in memory, aka (no CVSS, Microsoft browsers)
- [CVE-2017-0229](https://cve.now/CVE-2017-0229.md): A remote code execution vulnerability exists in Microsoft Edge in the way JavaScript engines render when handling objects in memory, aka "Sc (no CVSS, Microsoft Edge)
- [CVE-2017-0230](https://cve.now/CVE-2017-0230.md): A remote code execution vulnerability exists in Microsoft Edge in the way JavaScript engines render when handling objects in memory, aka "Sc (no CVSS, Microsoft Edge)
- [CVE-2017-0231](https://cve.now/CVE-2017-0231.md): A spoofing vulnerability exists when Microsoft browsers render SmartScreen Filter, aka "Microsoft Browser Spoofing Vulnerability." (no CVSS, Microsoft browsers)
- [CVE-2017-0233](https://cve.now/CVE-2017-0233.md): An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the (no CVSS, Microsoft Edge)
- [CVE-2017-0234](https://cve.now/CVE-2017-0234.md): A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in (no CVSS, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2017-0235](https://cve.now/CVE-2017-0235.md): A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in (no CVSS, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2017-0236](https://cve.now/CVE-2017-0236.md): A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in (no CVSS, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2017-0238](https://cve.now/CVE-2017-0238.md): A remote code execution vulnerability exists in Microsoft browsers in the way JavaScript scripting engines handle objects in memory, aka "Sc (no CVSS, Microsoft browsers)
- [CVE-2017-0240](https://cve.now/CVE-2017-0240.md): A remote code execution vulnerability exists in Microsoft Edge in the way affected Microsoft scripting engines render when handling objects (no CVSS, Microsoft Edge)
- [CVE-2017-0241](https://cve.now/CVE-2017-0241.md): An elevation of privilege vulnerability exists when Microsoft Edge renders a domain-less page in the URL, which could allow Microsoft Edge t (no CVSS, Microsoft Edge)
- [CVE-2017-0242](https://cve.now/CVE-2017-0242.md): An information disclosure vulnerability exists in the way some ActiveX objects are instantiated, aka "Microsoft ActiveX Information Disclosu (no CVSS, Microsoft Windows)
- [CVE-2017-0244](https://cve.now/CVE-2017-0244.md): The kernel in Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows locally authenticated attackers to gain privileges via a crafted (no CVSS, Microsoft Windows)
- [CVE-2017-0245](https://cve.now/CVE-2017-0245.md): The kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1 and Windows Server 2012 Gold allow a local authenticated attack (no CVSS, Microsoft Windows)
- [CVE-2017-0246](https://cve.now/CVE-2017-0246.md): The Graphics Component in the kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gol (no CVSS, Microsoft Windows)
- [CVE-2017-0247](https://cve.now/CVE-2017-0247.md): A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.Mvc +18)
- [CVE-2017-0248](https://cve.now/CVE-2017-0248.md): Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when (no CVSS, Microsoft .NET Framework · Microsoft.AspNetCore.Mvc +18)
- [CVE-2017-0249](https://cve.now/CVE-2017-0249.md): An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests. (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.Mvc +19)
- [CVE-2017-0254](https://cve.now/CVE-2017-0254.md): Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Office for Mac 2011, Office for Mac 2016, Microsoft Offi (no CVSS, Microsoft Office)
- [CVE-2017-0255](https://cve.now/CVE-2017-0255.md): Microsoft SharePoint Foundation 2013 SP1 allows an elevation of privilege vulnerability when it does not properly sanitize a specially craft (no CVSS, Microsoft Office)
- [CVE-2017-0256](https://cve.now/CVE-2017-0256.md): A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests. (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.Mvc +18)
- [CVE-2017-0258](https://cve.now/CVE-2017-0258.md): The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT (no CVSS, Microsoft Windows)
- [CVE-2017-0259](https://cve.now/CVE-2017-0259.md): The Windows kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2 (no CVSS, Microsoft Windows)
- [CVE-2017-0261](https://cve.now/CVE-2017-0261.md): Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly (CVSS 7.8, KEV, Microsoft Office)
- [CVE-2017-0262](https://cve.now/CVE-2017-0262.md): Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly (CVSS 7.8, KEV, Microsoft Office)
- [CVE-2017-0263](https://cve.now/CVE-2017-0263.md): The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Window (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2017-0264](https://cve.now/CVE-2017-0264.md): Microsoft PowerPoint for Mac 2011 allows a remote code execution vulnerability when the software fails to properly handle objects in memory, (no CVSS, Microsoft Office)
- [CVE-2017-0265](https://cve.now/CVE-2017-0265.md): Microsoft PowerPoint for Mac 2011 allows a remote code execution vulnerability when the software fails to properly handle objects in memory, (no CVSS, Microsoft Office)
- [CVE-2017-0266](https://cve.now/CVE-2017-0266.md): A remote code execution vulnerability exists in Microsoft Edge in the way affected Microsoft scripting engines render when handling objects (no CVSS, Microsoft Edge)
- [CVE-2017-0267](https://cve.now/CVE-2017-0267.md): Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0268](https://cve.now/CVE-2017-0268.md): Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0269](https://cve.now/CVE-2017-0269.md): The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server, aka (no CVSS, Microsoft Server Block Message)
- [CVE-2017-0270](https://cve.now/CVE-2017-0270.md): Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0271](https://cve.now/CVE-2017-0271.md): Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0272](https://cve.now/CVE-2017-0272.md): The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows S (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0273](https://cve.now/CVE-2017-0273.md): The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server, aka (no CVSS, Microsoft Server Block Message)
- [CVE-2017-0274](https://cve.now/CVE-2017-0274.md): Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0275](https://cve.now/CVE-2017-0275.md): Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0276](https://cve.now/CVE-2017-0276.md): Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0277](https://cve.now/CVE-2017-0277.md): The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows S (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0278](https://cve.now/CVE-2017-0278.md): The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows S (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0279](https://cve.now/CVE-2017-0279.md): The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows S (no CVSS, Microsoft Server Message Block)
- [CVE-2017-0280](https://cve.now/CVE-2017-0280.md): The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server, aka (no CVSS, Microsoft Server Block Message)
- [CVE-2017-0281](https://cve.now/CVE-2017-0281.md): Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web App (no CVSS, Microsoft Office)
- [CVE-2017-8360](https://cve.now/CVE-2017-8360.md): Conexant Systems mictray64 task, as used on HP Elite, EliteBook, ProBook, and ZBook systems, leaks sensitive data (keystrokes) to any proces (no CVSS)
- [CVE-2017-8900](https://cve.now/CVE-2017-8900.md): LightDM through 1.22.0, when systemd is used in Ubuntu 16.10 and 17.x, allows physically proximate attackers to bypass intended AppArmor res (no CVSS)
- [CVE-2017-8908](https://cve.now/CVE-2017-8908.md): The mark\_line\_tr function in gxscanc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds read) (no CVSS)
- [CVE-2017-8911](https://cve.now/CVE-2017-8911.md): An integer underflow has been identified in the unicode\_to\_utf8() function in tnef 1.4.14. (no CVSS)
- [CVE-2017-8912](https://cve.now/CVE-2017-8912.md): CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editu (CVSS 7.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-05-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.