# CVEs published 2017-05-19

30 CVEs were published on May 19, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-7475](https://cve.now/CVE-2017-7475.md): Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT\_Load\_Glyph and FT\_Render\_Glyph resulting in an applicatio (no CVSS, Red Hat Cairo · cairo)
- [CVE-2017-7504](https://cve.now/CVE-2017-7504.md): HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Appli (no CVSS, Red Hat JBoss)
- [CVE-2015-5241](https://cve.now/CVE-2015-5241.md): After logging into the portal, the logout jsp page redirects the browser back to the login page after. (no CVSS, Apache Software Foundation Apache jUDDI · org.apache.juddi:…)
- [CVE-2017-9093](https://cve.now/CVE-2017-9093.md): The my\_skip\_input\_data\_fn function in imagew-jpeg.c in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial o (no CVSS)
- [CVE-2017-9094](https://cve.now/CVE-2017-9094.md): The lzw\_add\_to\_dict function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of servi (no CVSS)
- [CVE-2017-9098](https://cve.now/CVE-2017-9098.md): ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensit (no CVSS)
- [CVE-2017-9090](https://cve.now/CVE-2017-9090.md): reg.php in Allen Disk 1.6 doesn't check if isset($\_SESSION\['captcha'\]\['code'\])==1, which makes it possible to bypass the CAPTCHA via an empt (no CVSS)
- [CVE-2017-9091](https://cve.now/CVE-2017-9091.md): /admin/loginc.php in Allen Disk 1.6 doesn't check if isset($\_SESSION\['captcha'\]\['code'\]) == 1, which leads to CAPTCHA bypass by emptying $\_P (no CVSS)
- [CVE-2017-9083](https://cve.now/CVE-2017-9083.md): poppler 0.54.0, as used in Evince and other products, has a NULL pointer dereference in the JPXStream::readUByte function in JPXStream.cc. (no CVSS)
- [CVE-2017-4978](https://cve.now/CVE-2017-4978.md): EMC RSA Adaptive Authentication (On-Premise) versions prior to 7.3 P2 (exclusive) contains a fix for a cross-site scripting vulnerability th (no CVSS, EMC RSA Adaptive Authentication (On-Premise) RSA Adaptive A…)
- [CVE-2017-4979](https://cve.now/CVE-2017-4979.md): EMC Isilon OneFS 8.0.1.0, OneFS 8.0.0.0 - 8.0.0.2, OneFS 7.2.1.0 - 7.2.1.3, and OneFS 7.2.0.x is affected by an NFS export vulnerability. (no CVSS, EMC Isilon OneFS OneFS 8.0.1.0, OneFS 8.0.0.0 8.0.0.2, OneF…)
- [CVE-2017-7968](https://cve.now/CVE-2017-7968.md): An Incorrect Default Permissions issue was discovered in Schneider Electric Wonderware InduSoft Web Studio v8.0 Patch 3 and prior versions. (no CVSS, Schneider Electric Wonderware InduSoft Web Studio)
- [CVE-2017-9080](https://cve.now/CVE-2017-9080.md): PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. (no CVSS)
- [CVE-2017-9077](https://cve.now/CVE-2017-9077.md): The tcp\_v6\_syn\_recv\_sock function in net/ipv6/tcp\_ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users (no CVSS)
- [CVE-2017-9078](https://cve.now/CVE-2017-9078.md): The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP (no CVSS)
- [CVE-2017-9079](https://cve.now/CVE-2017-9079.md): Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized\_keys file format with a comman (no CVSS)
- [CVE-2017-9074](https://cve.now/CVE-2017-9074.md): The IPv6 fragmentation implementation in the Linux kernel through 4.11.1 does not consider that the nexthdr field may be associated with an (no CVSS)
- [CVE-2017-9075](https://cve.now/CVE-2017-9075.md): The sctp\_v6\_create\_accept\_sk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users (no CVSS)
- [CVE-2017-9076](https://cve.now/CVE-2017-9076.md): The dccp\_v6\_request\_recv\_sock function in net/dccp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local user (no CVSS)
- [CVE-2017-5173](https://cve.now/CVE-2017-5173.md): An Improper Neutralization of Special Elements (in an OS command) issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0 (no CVSS, Geutebruck IP Cameras)
- [CVE-2017-5174](https://cve.now/CVE-2017-5174.md): An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. (no CVSS, Geutebruck IP Cameras)
- [CVE-2017-5176](https://cve.now/CVE-2017-5176.md): A DLL Hijack issue was discovered in Rockwell Automation Connected Components Workbench (CCW). (no CVSS, Rockwell Automation Connected Components Workbench)
- [CVE-2017-5177](https://cve.now/CVE-2017-5177.md): A Stack Buffer Overflow issue was discovered in VIPA Controls WinPLC7 5.0.45.5921 and prior. (no CVSS, VIPA Controls WinPLC7)
- [CVE-2017-6016](https://cve.now/CVE-2017-6016.md): An Improper Access Control issue was discovered in LCDS - Leao Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA. (no CVSS, LCDS Leao Consultoria e Desenvolvimento de Sistemas LTDA ME…)
- [CVE-2017-6025](https://cve.now/CVE-2017-6025.md): A Stack Buffer Overflow issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. (no CVSS, 3S-Smart Software Solutions GmbH CODESYS Web Server)
- [CVE-2017-6027](https://cve.now/CVE-2017-6027.md): An Arbitrary File Upload issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. (no CVSS, 3S-Smart Software Solutions GmbH CODESYS Web Server)
- [CVE-2017-6048](https://cve.now/CVE-2017-6048.md): A Command Injection issue was discovered in Satel Iberia SenNet Data Logger and Electricity Meters: SenNet Optimal DataLogger V5.37c-1.43c a (no CVSS, Satel Iberia SenNet Data Logger and Electricity Meters)
- [CVE-2017-7907](https://cve.now/CVE-2017-7907.md): An Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware Historian Client 2014 R2 SP1 and prior. (no CVSS, Schneider Electric Wonderware Historian Client)
- [CVE-2017-7935](https://cve.now/CVE-2017-7935.md): A Resource Exhaustion issue was discovered in Phoenix Contact GmbH mGuard firmware versions 8.3.0 to 8.4.2. (no CVSS, Phoenix Contact GmbH mGuard)
- [CVE-2017-7937](https://cve.now/CVE-2017-7937.md): An Improper Authentication issue was discovered in Phoenix Contact GmbH mGuard firmware versions 8.3.0 to 8.4.2. (no CVSS, Phoenix Contact GmbH mGuard)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-05-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.