# CVEs published 2017-05-29

26 CVEs were published on May 29, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-9303](https://cve.now/CVE-2017-9303.md): Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers (no CVSS, laravel/laravel · illuminate/auth +1)
- [CVE-2016-10378](https://cve.now/CVE-2016-10378.md): e107 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107\_admin/menus.php, related to the me (no CVSS)
- [CVE-2016-10379](https://cve.now/CVE-2016-10379.md): The VirtueMart com\_virtuemart component 3.0.14 for Joomla! allows SQL injection by remote authenticated administrators via the virtuemart\_pa (no CVSS)
- [CVE-2017-9299](https://cve.now/CVE-2017-9299.md): Open Ticket Request System (OTRS) 3.3.9 has XSS in index.pl?Action=AgentStats requests, as demonstrated by OrderBy=\[XSS\] and Direction=\[XSS\] (no CVSS)
- [CVE-2017-9300](https://cve.now/CVE-2017-9300.md): plugins\\codec\\libflac\_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (heap corruption an (no CVSS)
- [CVE-2017-9301](https://cve.now/CVE-2017-9301.md): plugins\\audio\_filter\\libmpgatofixed32\_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (in (no CVSS)
- [CVE-2017-9302](https://cve.now/CVE-2017-9302.md): RealPlayer 16.0.2.32 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted mp4 fil (no CVSS)
- [CVE-2017-9294](https://cve.now/CVE-2017-9294.md): RMI vulnerability in Hitachi Device Manager before 8.5.2-01 allows remote attackers to execute internal commands without authentication via (no CVSS)
- [CVE-2017-9295](https://cve.now/CVE-2017-9295.md): XXE vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Replication Manager before 8.5.2-00 allows authenticated remote user (no CVSS)
- [CVE-2017-9296](https://cve.now/CVE-2017-9296.md): Open Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Tuning Manager before 8.5.2-00 allows remote attackers to (no CVSS)
- [CVE-2017-9297](https://cve.now/CVE-2017-9297.md): Open Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 allows remote attackers to redirect users to arbitrary web sites. (no CVSS)
- [CVE-2017-9298](https://cve.now/CVE-2017-9298.md): Cross-site scripting vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Replication Manager before 8.5.2-00 allows authenti (no CVSS)
- [CVE-2017-9148](https://cve.now/CVE-2017-9148.md): The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to (no CVSS)
- [CVE-2017-9289](https://cve.now/CVE-2017-9289.md): Bram Korsten Note through 1.2.0 is vulnerable to a reflected XSS in note-source\\ui\\editor.php (edit parameter). (no CVSS)
- [CVE-2017-9292](https://cve.now/CVE-2017-9292.md): Lansweeper before 6.0.0.65 has XSS in an image retrieval URI, aka Bug 542782. (no CVSS)
- [CVE-2017-7913](https://cve.now/CVE-2017-7913.md): A Plaintext Storage of a Password issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3 (no CVSS, Moxa OnCell)
- [CVE-2017-7915](https://cve.now/CVE-2017-7915.md): An Improper Restriction of Excessive Authentication Attempts issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and p (no CVSS, Moxa OnCell)
- [CVE-2017-7917](https://cve.now/CVE-2017-7917.md): A Cross-Site Request Forgery issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-H (no CVSS, Moxa OnCell)
- [CVE-2017-9287](https://cve.now/CVE-2017-9287.md): servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. (no CVSS)
- [CVE-2017-9288](https://cve.now/CVE-2017-9288.md): The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter). (no CVSS)
- [CVE-2016-10377](https://cve.now/CVE-2016-10377.md): In Open vSwitch (OvS) 2.5.0, a malformed IP packet can cause the switch to read past the end of the packet buffer due to an unsigned integer (no CVSS)
- [CVE-2017-9261](https://cve.now/CVE-2017-9261.md): In ImageMagick 7.0.5-6 Q16, the ReadMNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a craf (no CVSS)
- [CVE-2017-9262](https://cve.now/CVE-2017-9262.md): In ImageMagick 7.0.5-6 Q16, the ReadJNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a craf (no CVSS)
- [CVE-2017-9263](https://cve.now/CVE-2017-9263.md): In Open vSwitch (OvS) 2.7.0, while parsing an OpenFlow role status message, there is a call to the abort() function for undefined role statu (no CVSS)
- [CVE-2017-9264](https://cve.now/CVE-2017-9264.md): In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, (no CVSS)
- [CVE-2017-9265](https://cve.now/CVE-2017-9265.md): In Open vSwitch (OvS) v2.7.0, there is a buffer over-read while parsing the group mod OpenFlow message sent from the controller in \`lib/ofp- (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-05-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.