# CVEs published 2017-05-18

41 CVEs were published on May 18, 2017: 0 critical, 3 high. Days are UTC.

- [CVE-2017-3980](https://cve.now/CVE-2017-3980.md): A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, and 5.1.3 and earlier allows rem (no CVSS, McAfee ePolicy Orchestrator)
- [CVE-2017-6621](https://cve.now/CVE-2017-6621.md): A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sen (no CVSS, Cisco Prime Collaboration)
- [CVE-2017-6622](https://cve.now/CVE-2017-6622.md): A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass au (no CVSS, Cisco Prime Collaboration Provisioning)
- [CVE-2017-6623](https://cve.now/CVE-2017-6623.md): A vulnerability in a script file that is installed as part of the Cisco Policy Suite (CPS) Software distribution for the CPS appliance could (no CVSS, Cisco Policy Suite)
- [CVE-2017-6652](https://cve.now/CVE-2017-6652.md): A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote attacker to access arbit (no CVSS, Cisco TelePresence IX5000 Series)
- [CVE-2017-9072](https://cve.now/CVE-2017-9072.md): Two CalendarXP products have XSS in common parts of HTML files. (no CVSS)
- [CVE-2017-9067](https://cve.now/CVE-2017-9067.md): In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to (no CVSS, modx/revolution)
- [CVE-2017-9068](https://cve.now/CVE-2017-9068.md): In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, a (no CVSS, modx/revolution)
- [CVE-2017-9069](https://cve.now/CVE-2017-9069.md): In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .ht (no CVSS, modx/revolution)
- [CVE-2017-9070](https://cve.now/CVE-2017-9070.md): In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitl (no CVSS, modx/revolution)
- [CVE-2017-9071](https://cve.now/CVE-2017-9071.md): In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. (no CVSS, modx/revolution)
- [CVE-2017-7503](https://cve.now/CVE-2017-7503.md): It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. (no CVSS, Red Hat JBoss Enterprise Application Platform)
- [CVE-2017-7433](https://cve.now/CVE-2017-7433.md): An absolute path traversal vulnerability (CWE-36) in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download a (no CVSS, Micro Focus Vibe)
- [CVE-2017-9061](https://cve.now/CVE-2017-9061.md): In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error m (no CVSS)
- [CVE-2017-9062](https://cve.now/CVE-2017-9062.md): In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. (no CVSS)
- [CVE-2017-9063](https://cve.now/CVE-2017-9063.md): In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization s (no CVSS)
- [CVE-2017-9064](https://cve.now/CVE-2017-9064.md): In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is (no CVSS)
- [CVE-2017-9065](https://cve.now/CVE-2017-9065.md): In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API. (no CVSS)
- [CVE-2017-9066](https://cve.now/CVE-2017-9066.md): In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF. (no CVSS)
- [CVE-2017-6195](https://cve.now/CVE-2017-6195.md): Ipswitch MOVEit Transfer (formerly DMZ) allows pre-authentication blind SQL injection. (no CVSS)
- [CVE-2017-8338](https://cve.now/CVE-2017-8338.md): A vulnerability in MikroTik Version 6.38.5 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of UDP pa (no CVSS)
- [CVE-2017-8769](https://cve.now/CVE-2017-8769.md): Facebook WhatsApp Messenger before 2.16.323 for Android uses the SD card for cleartext storage of files (Audio, Documents, Images, Video, an (no CVSS)
- [CVE-2017-9045](https://cve.now/CVE-2017-9045.md): The Google I/O 2017 application before 5.1.4 for Android downloads multiple .json files from http://storage.googleapis.com without SSL, whic (no CVSS)
- [CVE-2017-9047](https://cve.now/CVE-2017-9047.md): A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. (no CVSS)
- [CVE-2017-9048](https://cve.now/CVE-2017-9048.md): libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. (CVSS 7.5)
- [CVE-2017-9049](https://cve.now/CVE-2017-9049.md): libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. (CVSS 7.5)
- [CVE-2017-9050](https://cve.now/CVE-2017-9050.md): libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. (CVSS 7.5, nokogiri)
- [CVE-2017-9051](https://cve.now/CVE-2017-9051.md): libav before 12.1 is vulnerable to an invalid read of size 1 due to NULL pointer dereferencing in the nsv\_read\_chunk function in libavformat (no CVSS)
- [CVE-2017-9052](https://cve.now/CVE-2017-9052.md): An issue, also known as DW201703-006, was discovered in libdwarf 2017-03-21. (no CVSS)
- [CVE-2017-9053](https://cve.now/CVE-2017-9053.md): An issue, also known as DW201703-005, was discovered in libdwarf 2017-03-21. (no CVSS)
- [CVE-2017-9054](https://cve.now/CVE-2017-9054.md): An issue, also known as DW201703-002, was discovered in libdwarf 2017-03-21. (no CVSS)
- [CVE-2017-9055](https://cve.now/CVE-2017-9055.md): An issue, also known as DW201703-001, was discovered in libdwarf 2017-03-21. (no CVSS)
- [CVE-2017-9058](https://cve.now/CVE-2017-9058.md): In libytnef in ytnef through 1.9.2, there is a heap-based buffer over-read due to incorrect boundary checking in the SIZECHECK macro in lib/ (no CVSS)
- [CVE-2017-9059](https://cve.now/CVE-2017-9059.md): The NFSv4 implementation in the Linux kernel through 4.11.1 allows local users to cause a denial of service (resource consumption) by levera (no CVSS)
- [CVE-2017-9038](https://cve.now/CVE-2017-9038.md): GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF (no CVSS)
- [CVE-2017-9039](https://cve.now/CVE-2017-9039.md): GNU Binutils 2.28 allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file with many program headers (no CVSS)
- [CVE-2017-9040](https://cve.now/CVE-2017-9040.md): GNU Binutils 2017-04-03 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash), related to th (no CVSS)
- [CVE-2017-9041](https://cve.now/CVE-2017-9041.md): GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF (no CVSS)
- [CVE-2017-9042](https://cve.now/CVE-2017-9042.md): readelf.c in GNU Binutils 2017-04-12 has a "cannot be represented in type long" issue, which might allow remote attackers to cause a denial (no CVSS)
- [CVE-2017-9043](https://cve.now/CVE-2017-9043.md): readelf.c in GNU Binutils 2017-04-12 has a "shift exponent too large for type unsigned long" issue, which might allow remote attackers to ca (no CVSS)
- [CVE-2017-9044](https://cve.now/CVE-2017-9044.md): The print\_symbol\_for\_build\_attribute function in readelf.c in GNU Binutils 2017-04-12 allows remote attackers to cause a denial of service ( (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-05-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.