# CVEs published 2017-05-28 10 CVEs were published on May 28, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-9249](https://cve.now/CVE-2017-9249.md): Cross-site scripting (XSS) vulnerability in Allen Disk 1.6 allows remote authenticated users to inject arbitrary web script or HTML persiste (no CVSS) - [CVE-2017-9250](https://cve.now/CVE-2017-9250.md): The lexer\_process\_char\_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty stri (no CVSS) - [CVE-2017-9251](https://cve.now/CVE-2017-9251.md): andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter to admin.php. (no CVSS) - [CVE-2017-9252](https://cve.now/CVE-2017-9252.md): andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route (no CVSS) - [CVE-2017-9243](https://cve.now/CVE-2017-9243.md): Aries QWR-1104 Wireless-N Router with Firmware Version WRC.253.2.0913 has XSS on the Wireless Site Survey page, exploitable with the name of (no CVSS) - [CVE-2015-9059](https://cve.now/CVE-2015-9059.md): picocom before 2.0 has a command injection vulnerability in the 'send and receive file' command because the command line is executed by /bin (no CVSS) - [CVE-2016-10376](https://cve.now/CVE-2016-10376.md): Gajim through 0.16.7 unconditionally implements the "XEP-0146: Remote Controlling Clients" extension. (no CVSS) - [CVE-2017-7295](https://cve.now/CVE-2017-7295.md): An issue was discovered in Contiki Operating System 3.0. (no CVSS) - [CVE-2017-7296](https://cve.now/CVE-2017-7296.md): An issue was discovered in Contiki Operating System 3.0. (no CVSS) - [CVE-2017-9232](https://cve.now/CVE-2017-9232.md): Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing (no CVSS, github.com/juju/juju) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-05-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.