# CVEs published 2017-05-25 26 CVEs were published on May 25, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2016-6256](https://cve.now/CVE-2016-6256.md): SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to (no CVSS) - [CVE-2017-5868](https://cve.now/CVE-2017-5868.md): CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers an (no CVSS) - [CVE-2017-7236](https://cve.now/CVE-2017-7236.md): SQL injection vulnerability in NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 allows remote attackers to execute arbitrary (no CVSS) - [CVE-2017-7439](https://cve.now/CVE-2017-7439.md): NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors in (no CVSS) - [CVE-2017-9032](https://cve.now/CVE-2017-9032.md): Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inje (no CVSS) - [CVE-2017-9033](https://cve.now/CVE-2017-9033.md): Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack (no CVSS) - [CVE-2017-9034](https://cve.now/CVE-2017-9034.md): Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code (no CVSS) - [CVE-2017-9035](https://cve.now/CVE-2017-9035.md): Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted commu (no CVSS) - [CVE-2017-9036](https://cve.now/CVE-2017-9036.md): Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows local users to gain privileges by leveraging an unrestricted quarantine direct (no CVSS) - [CVE-2017-9037](https://cve.now/CVE-2017-9037.md): Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inje (no CVSS) - [CVE-2014-0097](https://cve.now/CVE-2014-0097.md): The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. (no CVSS, Pivotal Spring Security · org.springframework.security:spri…) - [CVE-2014-0225](https://cve.now/CVE-2014-0225.md): When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions (no CVSS, Pivotal Spring Framework · org.springframework:spring-webmvc) - [CVE-2014-3527](https://cve.now/CVE-2014-3527.md): When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service int (no CVSS, Pivotal Spring Security · org.springframework.security:spri…) - [CVE-2015-1834](https://cve.now/CVE-2015-1834.md): A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 (no CVSS, Pivotal Cloud Foundry) - [CVE-2015-3189](https://cve.now/CVE-2015-3189.md): With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1 (no CVSS, Pivotal Cloud Foundry · org.cloudfoundry.identity:cloudfoun…) - [CVE-2015-3190](https://cve.now/CVE-2015-3190.md): With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1 (no CVSS, Pivotal Cloud Foundry) - [CVE-2015-3191](https://cve.now/CVE-2015-3191.md): With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1 (no CVSS, Pivotal Cloud Foundry) - [CVE-2015-5211](https://cve.now/CVE-2015-5211.md): Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to (no CVSS, org.springframework:spring-core) - [CVE-2016-0761](https://cve.now/CVE-2016-0761.md): Cloud Foundry Garden-Linux versions prior to v0.333.0 and Elastic Runtime 1.6.x version prior to 1.6.17 contain a flaw in managing container (no CVSS, Pivotal Cloud Foundry) - [CVE-2016-0780](https://cve.now/CVE-2016-0780.md): It was discovered that cf-release v231 and lower, Pivotal Cloud Foundry Elastic Runtime 1.5.x versions prior to 1.5.17 and Pivotal Cloud Fou (no CVSS, Pivotal Cloud Foundry) - [CVE-2016-0781](https://cve.now/CVE-2016-0781.md): The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Re (no CVSS, Pivotal Cloud Foundry) - [CVE-2016-2165](https://cve.now/CVE-2016-2165.md): The Loggregator Traffic Controller endpoints in cf-release v231 and lower, Pivotal Elastic Runtime versions prior to 1.5.19 AND 1.6.x versio (no CVSS, Pivotal Cloud Foundry) - [CVE-2016-3084](https://cve.now/CVE-2016-3084.md): The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Log (no CVSS, Pivotal Cloud Foundry · org.cloudfoundry.identity:cloudfoun…) - [CVE-2016-4435](https://cve.now/CVE-2016-4435.md): An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated client (no CVSS, Pivotal Cloud Foundry) - [CVE-2016-4977](https://cve.now/CVE-2016-4977.md): When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response\_t (no CVSS, Pivotal Spring Security OAuth · org.springframework.securit…) - [CVE-2016-5007](https://cve.now/CVE-2016-5007.md): Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization (no CVSS, Pivotal Spring Security · Pivotal Spring Framework +2) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-05-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.