CVEs published May 21, 2017
24 CVEs were published on May 21, 2017: 0 critical, 0 high.
- Published
- 24
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 23
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- openexr
- 2
- LibTIFF
- 1
- mantisbt/mantisbt
- 1
- org.jasypt:jasypt
- 1
Medium, low and unrated 24
- CVE-2017-9138There is a debug-interface vulnerability on some Tenda routers (FH1202/F1202/F1200: versions before 1.2.0.20).
- CVE-2017-9139There is a stack-based buffer overflow on some Tenda routers (FH1202/F1202/F1200: versions before 1.2.0.20).
- CVE-2017-9131An issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3.
- CVE-2017-9132A hard-coded credentials issue was discovered on Mimosa Client Radios before 2.2.3, Mimosa Backhaul Radios before 2.2.3, and Mimosa Access P
- CVE-2017-9133An issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3.
- CVE-2017-9134An information-leakage issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3.
- CVE-2017-9135An issue was discovered on Mimosa Client Radios before 2.2.4 and Mimosa Backhaul Radios before 2.2.4.
- CVE-2017-9136An issue was discovered on Mimosa Client Radios before 2.2.3.
- CVE-2017-9137Ceragon FibeAir IP-10 wireless radios through 7.2.0 have a default password of mateidu for the mateidu account (a hidden user account establ
- CVE-2017-9117In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-infLibTIFF
- CVE-2017-9119The i_zval_ptr_dtor function in Zend/zend_variables.h in PHP 7.1.5 allows attackers to cause a denial of service (memory consumption and app
- CVE-2014-9970jasypt before 1.9.2 allows a timing attack against the password hash comparison.org.jasypt:jasypt
- CVE-2017-9101import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header a
- CVE-2017-9110In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.
- CVE-2017-9111In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or openexr
- CVE-2017-9112In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.openexr
- CVE-2017-9113In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or
- CVE-2017-9114In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.
- CVE-2017-9115In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary
- CVE-2017-9116In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.
- CVE-2017-7620MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting mantisbt/mantisbt
- CVE-2017-9024Secure Bytes Cisco Configuration Manager, as bundled in Secure Bytes Secure Cisco Auditor (SCA) 3.0, has a Directory Traversal issue in its
- CVE-2017-9046winpm-32.exe in Pegasus Mail (aka Pmail) v4.72 build 572 allows code execution via a crafted ssgp.dll file that must be installed locally.
- CVE-2017-9100login.cgi on D-Link DIR-600M devices with firmware 3.04 allows remote attackers to bypass authentication by entering more than 20 blank spac