# CVEs published 2017-05-26

25 CVEs were published on May 26, 2017: 1 critical, 1 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2017-3126](https://cve.now/CVE-2017-3126.md): An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute (no CVSS, Fortinet FortiAnalyzer, FortiManager)
- [CVE-2017-3129](https://cve.now/CVE-2017-3129.md): A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5.7.1 and below allows attacker to execute unauthorized code or commands (no CVSS, Fortinet FortiWeb)
- [CVE-2017-3134](https://cve.now/CVE-2017-3134.md): An escalation of privilege vulnerability in Fortinet FortiWLC-SD versions 8.2.4 and below allows attacker to gain root access via the CLI co (no CVSS, Fortinet FortiWLC-SD)
- [CVE-2017-7337](https://cve.now/CVE-2017-7337.md): An improper Access Control vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to interact with unauthorized V (no CVSS, Fortinet FortiPortal)
- [CVE-2017-7338](https://cve.now/CVE-2017-7338.md): A password management vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to carry out information disclosure (no CVSS, Fortinet FortiPortal)
- [CVE-2017-7339](https://cve.now/CVE-2017-7339.md): A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or com (no CVSS, Fortinet FortiPortal)
- [CVE-2017-7343](https://cve.now/CVE-2017-7343.md): An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url (no CVSS, Fortinet FortiPortal)
- [CVE-2017-7731](https://cve.now/CVE-2017-7731.md): A weak password recovery vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows attacker to carry out information disclosure (no CVSS, Fortinet FortiPortal)
- [CVE-2017-5646](https://cve.now/CVE-2017-5646.md): For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while a (no CVSS, Apache Software Foundation Apache Knox · org.apache.knox:ga…)
- [CVE-2017-6862](https://cve.now/CVE-2017-6862.md): NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication byp (CVSS 9.8, KEV, NETGEAR All versions prior to WNR2000v3 1.1.2.14, WNR2000v4…)
- [CVE-2017-8535](https://cve.now/CVE-2017-8535.md): The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP (no CVSS, Microsoft Malware Protection Engine)
- [CVE-2017-8536](https://cve.now/CVE-2017-8536.md): The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP (no CVSS, Microsoft Malware Protection Engine)
- [CVE-2017-8537](https://cve.now/CVE-2017-8537.md): The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP (no CVSS, Microsoft Malware Protection Engine)
- [CVE-2017-8538](https://cve.now/CVE-2017-8538.md): The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP (no CVSS, Microsoft Malware Protection Engine)
- [CVE-2017-8539](https://cve.now/CVE-2017-8539.md): The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP (no CVSS, Microsoft Malware Protection Engine)
- [CVE-2017-8540](https://cve.now/CVE-2017-8540.md): The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP (CVSS 7.8, KEV, Microsoft Malware Protection Engine)
- [CVE-2017-8541](https://cve.now/CVE-2017-8541.md): The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP (no CVSS, Microsoft Malware Protection Engine)
- [CVE-2017-8542](https://cve.now/CVE-2017-8542.md): The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP (no CVSS, Microsoft Malware Protection)
- [CVE-2015-0269](https://cve.now/CVE-2015-0269.md): Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files (no CVSS, contao/core)
- [CVE-2016-10375](https://cve.now/CVE-2016-10375.md): Yodl before 3.07.01 has a Buffer Over-read in the queue\_push function in queue/queuepush.c. (no CVSS)
- [CVE-2017-1291](https://cve.now/CVE-2017-1291.md): IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. (no CVSS, IBM Maximo Asset Management)
- [CVE-2017-1292](https://cve.now/CVE-2017-1292.md): IBM Maximo Asset Management 7.5 and 7.6 generates error messages that could reveal sensitive information that could be used in further attac (no CVSS, IBM Maximo Asset Management)
- [CVE-2017-1325](https://cve.now/CVE-2017-1325.md): IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. (no CVSS, IBM iNotes)
- [CVE-2017-7505](https://cve.now/CVE-2017-7505.md): Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assig (no CVSS, foreman)
- [CVE-2017-9239](https://cve.now/CVE-2017-9239.md): An issue was discovered in Exiv2 0.26. (no CVSS, exiv2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-05-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.