# CVEs published 2017-05-21 24 CVEs were published on May 21, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-9138](https://cve.now/CVE-2017-9138.md): There is a debug-interface vulnerability on some Tenda routers (FH1202/F1202/F1200: versions before 1.2.0.20). (no CVSS) - [CVE-2017-9139](https://cve.now/CVE-2017-9139.md): There is a stack-based buffer overflow on some Tenda routers (FH1202/F1202/F1200: versions before 1.2.0.20). (no CVSS) - [CVE-2017-9131](https://cve.now/CVE-2017-9131.md): An issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. (no CVSS) - [CVE-2017-9132](https://cve.now/CVE-2017-9132.md): A hard-coded credentials issue was discovered on Mimosa Client Radios before 2.2.3, Mimosa Backhaul Radios before 2.2.3, and Mimosa Access P (no CVSS) - [CVE-2017-9133](https://cve.now/CVE-2017-9133.md): An issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. (no CVSS) - [CVE-2017-9134](https://cve.now/CVE-2017-9134.md): An information-leakage issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. (no CVSS) - [CVE-2017-9135](https://cve.now/CVE-2017-9135.md): An issue was discovered on Mimosa Client Radios before 2.2.4 and Mimosa Backhaul Radios before 2.2.4. (no CVSS) - [CVE-2017-9136](https://cve.now/CVE-2017-9136.md): An issue was discovered on Mimosa Client Radios before 2.2.3. (no CVSS) - [CVE-2017-9137](https://cve.now/CVE-2017-9137.md): Ceragon FibeAir IP-10 wireless radios through 7.2.0 have a default password of mateidu for the mateidu account (a hidden user account establ (no CVSS) - [CVE-2017-9117](https://cve.now/CVE-2017-9117.md): In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-inf (CVSS 4.0, LibTIFF) - [CVE-2017-9119](https://cve.now/CVE-2017-9119.md): The i\_zval\_ptr\_dtor function in Zend/zend\_variables.h in PHP 7.1.5 allows attackers to cause a denial of service (memory consumption and app (no CVSS) - [CVE-2014-9970](https://cve.now/CVE-2014-9970.md): jasypt before 1.9.2 allows a timing attack against the password hash comparison. (no CVSS, org.jasypt:jasypt) - [CVE-2017-9101](https://cve.now/CVE-2017-9101.md): import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header a (no CVSS) - [CVE-2017-9110](https://cve.now/CVE-2017-9110.md): In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash. (no CVSS) - [CVE-2017-9111](https://cve.now/CVE-2017-9111.md): In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or (no CVSS, openexr) - [CVE-2017-9112](https://cve.now/CVE-2017-9112.md): In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash. (no CVSS, openexr) - [CVE-2017-9113](https://cve.now/CVE-2017-9113.md): In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or (no CVSS) - [CVE-2017-9114](https://cve.now/CVE-2017-9114.md): In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash. (no CVSS) - [CVE-2017-9115](https://cve.now/CVE-2017-9115.md): In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary (no CVSS) - [CVE-2017-9116](https://cve.now/CVE-2017-9116.md): In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash. (no CVSS) - [CVE-2017-7620](https://cve.now/CVE-2017-7620.md): MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string\_api.php and consequently has conflicting (no CVSS, mantisbt/mantisbt) - [CVE-2017-9024](https://cve.now/CVE-2017-9024.md): Secure Bytes Cisco Configuration Manager, as bundled in Secure Bytes Secure Cisco Auditor (SCA) 3.0, has a Directory Traversal issue in its (no CVSS) - [CVE-2017-9046](https://cve.now/CVE-2017-9046.md): winpm-32.exe in Pegasus Mail (aka Pmail) v4.72 build 572 allows code execution via a crafted ssgp.dll file that must be installed locally. (no CVSS) - [CVE-2017-9100](https://cve.now/CVE-2017-9100.md): login.cgi on D-Link DIR-600M devices with firmware 3.04 allows remote attackers to bypass authentication by entering more than 20 blank spac (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-05-21 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.