CVEs published May 25, 2017

26 CVEs were published on May 25, 2017: 0 critical, 0 high.

Published: 26
Critical: 0
High: 0
Medium: 0
Low: 0
Unrated: 26
Now in CISA KEV: 0
Fix available: 8

Most affected products

Pivotal Cloud Foundry: 8
Pivotal Cloud Foundry · org.cloudfoundry.identity:cloudfoun…: 2
Pivotal Spring Security · org.springframework.security:spri…: 2
org.springframework:spring-core: 1
Pivotal Spring Framework · org.springframework:spring-webmvc: 1
Pivotal Spring Security · Pivotal Spring Framework +2: 1
Pivotal Spring Security OAuth · org.springframework.securit…: 1

Medium, low and unrated 26

CVE-2016-6256SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request toUnratedMay 25, 2017
CVE-2017-5868CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers anUnratedMay 25, 2017
CVE-2017-7236SQL injection vulnerability in NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 allows remote attackers to execute arbitraryUnratedMay 25, 2017
CVE-2017-7439NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors inUnratedMay 25, 2017
CVE-2017-9032Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to injeUnratedMay 25, 2017
CVE-2017-9033Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack UnratedMay 25, 2017
CVE-2017-9034Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code UnratedMay 25, 2017
CVE-2017-9035Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted commuUnratedMay 25, 2017
CVE-2017-9036Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows local users to gain privileges by leveraging an unrestricted quarantine directUnratedMay 25, 2017
CVE-2017-9037Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to injeUnratedMay 25, 2017
CVE-2014-0097The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length.Pivotal Spring Security · org.springframework.security:spri…UnratedFix availableMay 25, 2017
CVE-2014-0225When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions Pivotal Spring Framework · org.springframework:spring-webmvcUnratedFix availableMay 25, 2017
CVE-2014-3527When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service intPivotal Spring Security · org.springframework.security:spri…UnratedFix availableMay 25, 2017
CVE-2015-1834A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208Pivotal Cloud FoundryUnratedMay 25, 2017
CVE-2015-3189With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1Pivotal Cloud Foundry · org.cloudfoundry.identity:cloudfoun…UnratedFix availableMay 25, 2017
CVE-2015-3190With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1Pivotal Cloud FoundryUnratedMay 25, 2017
CVE-2015-3191With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1Pivotal Cloud FoundryUnratedMay 25, 2017
CVE-2015-5211Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to org.springframework:spring-coreUnratedFix availableMay 25, 2017
CVE-2016-0761Cloud Foundry Garden-Linux versions prior to v0.333.0 and Elastic Runtime 1.6.x version prior to 1.6.17 contain a flaw in managing containerPivotal Cloud FoundryUnratedMay 25, 2017
CVE-2016-0780It was discovered that cf-release v231 and lower, Pivotal Cloud Foundry Elastic Runtime 1.5.x versions prior to 1.5.17 and Pivotal Cloud FouPivotal Cloud FoundryUnratedMay 25, 2017
CVE-2016-0781The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-RePivotal Cloud FoundryUnratedMay 25, 2017
CVE-2016-2165The Loggregator Traffic Controller endpoints in cf-release v231 and lower, Pivotal Elastic Runtime versions prior to 1.5.19 AND 1.6.x versioPivotal Cloud FoundryUnratedMay 25, 2017
CVE-2016-3084The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of LogPivotal Cloud Foundry · org.cloudfoundry.identity:cloudfoun…UnratedFix availableMay 25, 2017
CVE-2016-4435An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated clientPivotal Cloud FoundryUnratedMay 25, 2017
CVE-2016-4977When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_tPivotal Spring Security OAuth · org.springframework.securit…UnratedFix availableMay 25, 2017
CVE-2016-5007Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization Pivotal Spring Security · Pivotal Spring Framework +2UnratedFix availableMay 25, 2017