# CVEs published 2017-05-15 29 CVEs were published on May 15, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2016-5979](https://cve.now/CVE-2016-5979.md): IBM Distributed Marketing 8.6, 9.0, and 10.0 could allow a privileged authenticated user to create an instance that gets created with securi (no CVSS, IBM Distributed Marketing) - [CVE-2016-9735](https://cve.now/CVE-2016-9735.md): IBM Jazz Foundation could allow an authenticated user to obtain sensitive information from stack traces. (no CVSS, IBM Rational Collaborative Lifecycle Management) - [CVE-2016-9750](https://cve.now/CVE-2016-9750.md): IBM QRadar 7.2 and 7.3 stores user credentials in plain in clear text which can be read by an authenticated user. (no CVSS, IBM QRadar SIEM) - [CVE-2017-6889](https://cve.now/CVE-2017-6889.md): An integer overflow error within the "foveon\_load\_camf()" function (dcraw\_foveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploi (no CVSS, LibRaw-demosaic-pack-GPL2) - [CVE-2017-6890](https://cve.now/CVE-2017-6890.md): A boundary error within the "foveon\_load\_camf()" function (dcraw\_foveon.c) when initializing a huffman table in LibRaw-demosaic-pack-GPL2 be (no CVSS, LibRaw-demosaic-pack-GPL2) - [CVE-2017-7478](https://cve.now/CVE-2017-7478.md): OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. (no CVSS, OpenVPN Technologies openvpn) - [CVE-2017-7479](https://cve.now/CVE-2017-7479.md): OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denia (no CVSS, OpenVPN Technologies openvpn) - [CVE-2017-7495](https://cve.now/CVE-2017-7495.md): fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which (no CVSS, Linux kernel before) - [CVE-2017-8926](https://cve.now/CVE-2017-8926.md): Buffer overflow in Halliburton LogView Pro 10.0.1 allows attackers to cause a denial of service or possibly have unspecified other impact vi (no CVSS) - [CVE-2017-8927](https://cve.now/CVE-2017-8927.md): Buffer overflow in Larson VizEx Reader 9.7.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a c (no CVSS) - [CVE-2017-8935](https://cve.now/CVE-2017-8935.md): The Quest Information Systems Indiana Voters app 1.1.24 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the (no CVSS) - [CVE-2017-8936](https://cve.now/CVE-2017-8936.md): The MoboTap Dolphin Web Browser - Fast Private Internet Search app 9.23.0 through 9.23.2 for iOS does not verify X.509 certificates from SSL (no CVSS) - [CVE-2017-8937](https://cve.now/CVE-2017-8937.md): The Life Before Us Yo app 2.5.8 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spo (no CVSS) - [CVE-2017-8938](https://cve.now/CVE-2017-8938.md): The Radio Javan app 9.3.4 through 9.6.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacker (no CVSS) - [CVE-2017-8939](https://cve.now/CVE-2017-8939.md): The Warner Bros. (no CVSS) - [CVE-2017-8940](https://cve.now/CVE-2017-8940.md): The Zipongo - Healthy Recipes and Grocery Deals app before 6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man (no CVSS) - [CVE-2017-8941](https://cve.now/CVE-2017-8941.md): The Interval International app 3.3 through 3.5.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle (no CVSS) - [CVE-2017-8942](https://cve.now/CVE-2017-8942.md): The YottaMark ShopWell - Healthy Diet & Grocery Food Scanner app 5.3.7 through 5.4.2 for iOS does not verify X.509 certificates from SSL ser (no CVSS) - [CVE-2017-8943](https://cve.now/CVE-2017-8943.md): The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof s (no CVSS) - [CVE-2017-0223](https://cve.now/CVE-2017-0223.md): A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory. (no CVSS, Microsoft Chakra Core · Microsoft.ChakraCore) - [CVE-2017-0252](https://cve.now/CVE-2017-0252.md): A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory. (no CVSS, Microsoft Chakra Core · Microsoft.ChakraCore) - [CVE-2016-8741](https://cve.now/CVE-2016-8741.md): The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. (no CVSS, Apache Software Foundation Apache Qpid Broker-J · org.apach…) - [CVE-2017-5655](https://cve.now/CVE-2017-5655.md): In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari Server host. (no CVSS, Apache Software Foundation Apache Ambari) - [CVE-2017-7489](https://cve.now/CVE-2017-7489.md): In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link. (no CVSS, Moodle 2.x and 3.x · moodle/moodle) - [CVE-2017-7490](https://cve.now/CVE-2017-7490.md): In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing. (no CVSS, Moodle 2.x and 3.x · moodle/moodle) - [CVE-2017-7491](https://cve.now/CVE-2017-7491.md): In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview blo (no CVSS, Moodle 2.x and 3.x · moodle/moodle) - [CVE-2017-8933](https://cve.now/CVE-2017-8933.md): Libmenu-cache 1.0.2 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (menu unavailability). (no CVSS) - [CVE-2017-8934](https://cve.now/CVE-2017-8934.md): PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (application unavailability). (no CVSS) - [CVE-2017-7213](https://cve.now/CVE-2017-7213.md): Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected active desktops via unspe (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-05-15 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.