# CVEs published 2017-05-17

21 CVEs were published on May 17, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-8917](https://cve.now/CVE-2017-8917.md): SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors. (no CVSS)
- [CVE-2017-4011](https://cve.now/CVE-2017-4011.md): Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attacke (no CVSS, McAfee Network Data Loss Prevention)
- [CVE-2017-4012](https://cve.now/CVE-2017-4012.md): Privilege Escalation vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to vi (no CVSS, McAfee Network Data Loss Prevention)
- [CVE-2017-4013](https://cve.now/CVE-2017-4013.md): Banner Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to obtain product information vi (no CVSS, McAfee Network Data Loss Prevention)
- [CVE-2017-4014](https://cve.now/CVE-2017-4014.md): Session Side jacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to vi (no CVSS, McAfee Network Data Loss Prevention)
- [CVE-2017-4015](https://cve.now/CVE-2017-4015.md): Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to inject arb (no CVSS, McAfee Network Data Loss Prevention)
- [CVE-2017-4016](https://cve.now/CVE-2017-4016.md): Web Server method disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to exploit and find a (no CVSS, McAfee Network Data Loss Prevention)
- [CVE-2017-4017](https://cve.now/CVE-2017-4017.md): User Name Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to view user information via (no CVSS, McAfee Network Data Loss Prevention)
- [CVE-2016-10374](https://cve.now/CVE-2016-10374.md): perltidy through 20160302, as used by perlcritic, check-all-the-things, and other software, relies on the current working directory for cert (no CVSS)
- [CVE-2017-9031](https://cve.now/CVE-2017-9031.md): The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render (no CVSS)
- [CVE-2017-7493](https://cve.now/CVE-2017-7493.md): Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper acces (no CVSS, qemu)
- [CVE-2015-3998](https://cve.now/CVE-2015-3998.md): Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows (no CVSS)
- [CVE-2015-4070](https://cve.now/CVE-2015-4070.md): Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote (no CVSS)
- [CVE-2016-3403](https://cve.now/CVE-2016-3403.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote at (no CVSS)
- [CVE-2017-5214](https://cve.now/CVE-2017-5214.md): The Codextrous B2J Contact (aka b2j\_contact) extension before 2.1.13 for Joomla! allows prediction of a uniqid value based on knowledge of a (no CVSS)
- [CVE-2017-5215](https://cve.now/CVE-2017-5215.md): The Codextrous B2J Contact (aka b2j\_contact) extension before 2.1.13 for Joomla! allows a rename attack that bypasses a "safe file extension (no CVSS)
- [CVE-2017-8422](https://cve.now/CVE-2017-8422.md): KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and leveraging a privilege (no CVSS)
- [CVE-2017-8849](https://cve.now/CVE-2017-8849.md): smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service. (no CVSS)
- [CVE-2017-9030](https://cve.now/CVE-2017-9030.md): The Codextrous B2J Contact (aka b2j\_contact) extension before 2.1.13 for Joomla! allows a directory traversal attack that bypasses a uniqid (no CVSS)
- [CVE-2017-9025](https://cve.now/CVE-2017-9025.md): Heap buffer overflow in vshttpd (aka ioos) in HooToo Trip Mate 6 (TM6) firmware 2.000.030 and earlier allows remote unauthenticated attacker (no CVSS)
- [CVE-2017-9026](https://cve.now/CVE-2017-9026.md): Stack buffer overflow in vshttpd (aka ioos) in HooToo Trip Mate 6 (TM6) firmware 2.000.030 and earlier allows remote unauthenticated attacke (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-05-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.