# CVEs published 2017-05-22 127 CVEs were published on May 22, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-9150](https://cve.now/CVE-2017-9150.md): The do\_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allow\_ptr\_leaks value available for restr (no CVSS) - [CVE-2016-6112](https://cve.now/CVE-2016-6112.md): IBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an authenticated user to escalate their privileges and (no CVSS, IBM Marketing Platform) - [CVE-2017-1092](https://cve.now/CVE-2017-1092.md): IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows serv (no CVSS, IBM Informix Servers) - [CVE-2017-1159](https://cve.now/CVE-2017-1159.md): IBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (no CVSS, IBM Business Process Manager Advanced) - [CVE-2017-1282](https://cve.now/CVE-2017-1282.md): IBM Content Navigator & CMIS 2.0 and 3.0 is vulnerable to cross-site scripting. (no CVSS, IBM Content Navigator) - [CVE-2017-1289](https://cve.now/CVE-2017-1289.md): IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. (no CVSS, IBM Runtimes for Java Technology) - [CVE-2017-1320](https://cve.now/CVE-2017-1320.md): IBM Tivoli Federated Identity Manager 6.2 is vulnerable to cross-site scripting. (no CVSS, IBM Tivoli Federated Identity Manager) - [CVE-2017-6891](https://cve.now/CVE-2017-6891.md): Two errors in the "asn1\_find\_node()" function (lib/parser\_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-bas (no CVSS, Flexera Software GnuTLS libtasn1) - [CVE-2017-9149](https://cve.now/CVE-2017-9149.md): Metadata Anonymisation Toolkit (MAT) 0.6 and 0.6.1 silently fails to perform "Clean metadata" actions upon invocation from the Nautilus cont (no CVSS) - [CVE-2017-5657](https://cve.now/CVE-2017-5657.md): Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. (no CVSS, Apache Software Foundation Apache Archiva · org.apache.arch…) - [CVE-2017-9146](https://cve.now/CVE-2017-9146.md): The TNEFFillMapi function in lib/ytnef.c in libytnef in ytnef through 1.9.2 does not ensure a nonzero count value before a certain memory al (no CVSS) - [CVE-2017-9147](https://cve.now/CVE-2017-9147.md): LibTIFF 4.0.7 has an invalid read in the \_TIFFVGetField function in tif\_dir.c, which might allow remote attackers to cause a denial of servi (no CVSS) - [CVE-2016-4854](https://cve.now/CVE-2016-4854.md): Cross-site request forgery (CSRF) vulnerability in L-04D firmware version V10a and V10b allows remote attackers to hijack the authentication (no CVSS, NTT DOCOMO L-04D) - [CVE-2016-4863](https://cve.now/CVE-2016-4863.md): The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 wit (no CVSS, Toshiba FlashAir SD-WD/WC series Class 6 model · Toshiba… +6) - [CVE-2016-4900](https://cve.now/CVE-2016-4900.md): Untrusted search path vulnerability in Evernote for Windows versions prior to 6.3 allows remote attackers to gain privileges via a Trojan ho (no CVSS, Evernote for Windows) - [CVE-2016-4901](https://cve.now/CVE-2016-4901.md): Untrusted search path vulnerability in The installer of e-Tax Software all versions allows remote attackers to gain privileges via a Trojan (no CVSS, National Tax Agency The installer of e-Tax Software) - [CVE-2016-4903](https://cve.now/CVE-2016-4903.md): Cross-site scripting vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows remote attacke (no CVSS, Olive Design WP-OliveCart · Olive Design WP-OliveCartPro) - [CVE-2016-4904](https://cve.now/CVE-2016-4904.md): Cross-site request forgery (CSRF) vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows r (no CVSS, Olive Design WP-OliveCart · Olive Design WP-OliveCartPro) - [CVE-2016-4905](https://cve.now/CVE-2016-4905.md): SQL injection vulnerability in the WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows attackers with ad (no CVSS, Olive Design WP-OliveCart · Olive Design WP-OliveCartPro) - [CVE-2016-7804](https://cve.now/CVE-2016-7804.md): Untrusted search path vulnerability in 7 Zip for Windows 16.02 and earlier allows remote attackers to gain privileges via a Trojan horse DLL (no CVSS, Igor Pavlov 7 Zip for Windows) - [CVE-2017-2161](https://cve.now/CVE-2017-2161.md): FlashAirTM SDHC Memory Card (SD-WE Series \) V3.00.02 and earlier and FlashAirTM SDHC Memory Card (SD-WD/WC Series \) V2.00.04 and (no CVSS, Toshiba FlashAirTM SDHC Memory Card) - [CVE-2017-2162](https://cve.now/CVE-2017-2162.md): FlashAirTM SDHC Memory Card (SD-WE Series \) V3.00.02 and earlier and FlashAirTM SDHC Memory Card (SD-WD/WC Series \) V2.00.04 and (no CVSS, Toshiba FlashAirTM SDHC Memory Card) - [CVE-2017-2168](https://cve.now/CVE-2017-2168.md): Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to ver (no CVSS, WP Booking System Free version · WP Booking System Premium…) - [CVE-2017-2169](https://cve.now/CVE-2017-2169.md): Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to i (no CVSS, Max Foundry MaxButtons) - [CVE-2017-2171](https://cve.now/CVE-2017-2171.md): Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version (no CVSS, BestWebSoft Captcha · BestWebSoft Car Rental +48) - [CVE-2017-2173](https://cve.now/CVE-2017-2173.md): Cross-site scripting vulnerability in Empirical Project Monitor - eXtended all versions allows remote authenticated attackers to inject arbi (no CVSS, INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) Empiri…) - [CVE-2017-2174](https://cve.now/CVE-2017-2174.md): Cross-site scripting vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to inject arbitrary web scri (no CVSS, INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) Empiri…) - [CVE-2017-2175](https://cve.now/CVE-2017-2175.md): Untrusted search path vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to gain privileges via a Tr (no CVSS, INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) Empiri…) - [CVE-2017-4915](https://cve.now/CVE-2017-4915.md): VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. (no CVSS, VMware Workstation Pro/Player) - [CVE-2017-4916](https://cve.now/CVE-2017-4916.md): VMware Workstation Pro/Player contains a NULL pointer dereference vulnerability that exists in the vstor2 driver. (no CVSS, VMware Workstation Pro/Player) - [CVE-2017-9141](https://cve.now/CVE-2017-9141.md): In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the ResetImageProfileIterator function in MagickCore/profil (no CVSS) - [CVE-2017-9142](https://cve.now/CVE-2017-9142.md): In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of miss (no CVSS) - [CVE-2017-9143](https://cve.now/CVE-2017-9143.md): In ImageMagick 7.0.5-5, the ReadARTImage function in coders/art.c allows attackers to cause a denial of service (memory leak) via a crafted (no CVSS) - [CVE-2017-9144](https://cve.now/CVE-2017-9144.md): In ImageMagick 7.0.5-5, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c. (no CVSS) - [CVE-2017-2494](https://cve.now/CVE-2017-2494.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2495](https://cve.now/CVE-2017-2495.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2496](https://cve.now/CVE-2017-2496.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2497](https://cve.now/CVE-2017-2497.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2498](https://cve.now/CVE-2017-2498.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2499](https://cve.now/CVE-2017-2499.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2500](https://cve.now/CVE-2017-2500.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2501](https://cve.now/CVE-2017-2501.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2502](https://cve.now/CVE-2017-2502.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2503](https://cve.now/CVE-2017-2503.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2504](https://cve.now/CVE-2017-2504.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2505](https://cve.now/CVE-2017-2505.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2506](https://cve.now/CVE-2017-2506.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2507](https://cve.now/CVE-2017-2507.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2508](https://cve.now/CVE-2017-2508.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2509](https://cve.now/CVE-2017-2509.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2510](https://cve.now/CVE-2017-2510.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2511](https://cve.now/CVE-2017-2511.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2512](https://cve.now/CVE-2017-2512.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2513](https://cve.now/CVE-2017-2513.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2514](https://cve.now/CVE-2017-2514.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2515](https://cve.now/CVE-2017-2515.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2516](https://cve.now/CVE-2017-2516.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2518](https://cve.now/CVE-2017-2518.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2519](https://cve.now/CVE-2017-2519.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2520](https://cve.now/CVE-2017-2520.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2521](https://cve.now/CVE-2017-2521.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2522](https://cve.now/CVE-2017-2522.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2523](https://cve.now/CVE-2017-2523.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2524](https://cve.now/CVE-2017-2524.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2525](https://cve.now/CVE-2017-2525.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2526](https://cve.now/CVE-2017-2526.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2527](https://cve.now/CVE-2017-2527.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2528](https://cve.now/CVE-2017-2528.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2530](https://cve.now/CVE-2017-2530.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2531](https://cve.now/CVE-2017-2531.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2533](https://cve.now/CVE-2017-2533.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2534](https://cve.now/CVE-2017-2534.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2535](https://cve.now/CVE-2017-2535.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2536](https://cve.now/CVE-2017-2536.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2537](https://cve.now/CVE-2017-2537.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2538](https://cve.now/CVE-2017-2538.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2539](https://cve.now/CVE-2017-2539.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2540](https://cve.now/CVE-2017-2540.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2541](https://cve.now/CVE-2017-2541.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2542](https://cve.now/CVE-2017-2542.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2543](https://cve.now/CVE-2017-2543.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2544](https://cve.now/CVE-2017-2544.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2545](https://cve.now/CVE-2017-2545.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2546](https://cve.now/CVE-2017-2546.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2547](https://cve.now/CVE-2017-2547.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2548](https://cve.now/CVE-2017-2548.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-2549](https://cve.now/CVE-2017-2549.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6977](https://cve.now/CVE-2017-6977.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6978](https://cve.now/CVE-2017-6978.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6979](https://cve.now/CVE-2017-6979.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6980](https://cve.now/CVE-2017-6980.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6981](https://cve.now/CVE-2017-6981.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6982](https://cve.now/CVE-2017-6982.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6983](https://cve.now/CVE-2017-6983.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6984](https://cve.now/CVE-2017-6984.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6985](https://cve.now/CVE-2017-6985.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6986](https://cve.now/CVE-2017-6986.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6987](https://cve.now/CVE-2017-6987.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6988](https://cve.now/CVE-2017-6988.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6989](https://cve.now/CVE-2017-6989.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6990](https://cve.now/CVE-2017-6990.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6991](https://cve.now/CVE-2017-6991.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6994](https://cve.now/CVE-2017-6994.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6995](https://cve.now/CVE-2017-6995.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6996](https://cve.now/CVE-2017-6996.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6997](https://cve.now/CVE-2017-6997.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6998](https://cve.now/CVE-2017-6998.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-6999](https://cve.now/CVE-2017-6999.md): An issue was discovered in certain Apple products. (no CVSS) - [CVE-2017-9140](https://cve.now/CVE-2017-9140.md): Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer contro (no CVSS) - [CVE-2017-6630](https://cve.now/CVE-2017-6630.md): A vulnerability in the Session Initiation Protocol (SIP) implementation of Cisco IP Phone 8851 11.0(0.1) could allow an unauthenticated, rem (no CVSS, Cisco IP Phone) - [CVE-2017-6632](https://cve.now/CVE-2017-6632.md): A vulnerability in the logging configuration of Secure Sockets Layer (SSL) policies for Cisco FirePOWER System Software 5.3.0 through 6.2.2 (no CVSS, Cisco FirePOWER System Software) - [CVE-2017-6633](https://cve.now/CVE-2017-6633.md): A vulnerability in the TCP throttling process of Cisco UCS C-Series Rack Servers 3.0(0.234) could allow an unauthenticated, remote attacker (no CVSS, Cisco UCS C-Series Rack Servers) - [CVE-2017-6634](https://cve.now/CVE-2017-6634.md): A vulnerability in the Device Manager web interface of Cisco Industrial Ethernet 1000 Series Switches 1.3 could allow an unauthenticated, re (no CVSS, Cisco Industrial Ethernet 1000 Series Switches) - [CVE-2017-6635](https://cve.now/CVE-2017-6635.md): A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 12.1) could allow an authenticated (no CVSS, Cisco Prime Collaboration Provisioning) - [CVE-2017-6636](https://cve.now/CVE-2017-6636.md): A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 11.1) could allow an authenticated (no CVSS, Cisco Prime Collaboration Provisioning) - [CVE-2017-6637](https://cve.now/CVE-2017-6637.md): A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 11.1) could allow an authenticated (no CVSS, Cisco Prime Collaboration Provisioning) - [CVE-2017-6641](https://cve.now/CVE-2017-6641.md): A vulnerability in the TCP connection handling functionality of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, (no CVSS, Cisco Remote Expert Manager) - [CVE-2017-6642](https://cve.now/CVE-2017-6642.md): A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to acces (no CVSS, Cisco Remote Expert Manager) - [CVE-2017-6643](https://cve.now/CVE-2017-6643.md): A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to acces (no CVSS, Cisco Remote Expert Manager) - [CVE-2017-6644](https://cve.now/CVE-2017-6644.md): A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to acces (no CVSS, Cisco Remote Expert Manager) - [CVE-2017-6645](https://cve.now/CVE-2017-6645.md): A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to acces (no CVSS, Cisco Remote Expert Manager) - [CVE-2017-6646](https://cve.now/CVE-2017-6646.md): A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to acces (no CVSS, Cisco Remote Expert Manager) - [CVE-2017-6647](https://cve.now/CVE-2017-6647.md): A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to acces (no CVSS, Cisco Remote Expert Manager) - [CVE-2017-6649](https://cve.now/CVE-2017-6649.md): A vulnerability in the CLI of Cisco NX-OS System Software 7.1 through 7.3 running on Cisco Nexus Series Switches could allow an authenticate (no CVSS, Cisco Nexus Series Switches) - [CVE-2017-6650](https://cve.now/CVE-2017-6650.md): A vulnerability in the Telnet CLI command of Cisco NX-OS System Software 7.1 through 7.3 running on Cisco Nexus Series Switches could allow (no CVSS, Cisco Nexus Series Switches) - [CVE-2017-6653](https://cve.now/CVE-2017-6653.md): A vulnerability in the TCP throttling process for the GUI of the Cisco Identity Services Engine (ISE) 2.1(0.474) could allow an unauthentica (no CVSS, Cisco Identity Services Engine) - [CVE-2017-6654](https://cve.now/CVE-2017-6654.md): A vulnerability in the web-based management interface of Cisco Unified Communications Manager 10.5 through 11.5 could allow an unauthenticat (no CVSS, Cisco Unified Communications Manager) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-05-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.