# CVEs published 2017-06-05

29 CVEs were published on June 5, 2017: 0 critical, 1 high. Days are UTC.

- [CVE-2017-9420](https://cve.now/CVE-2017-9420.md): Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2017-9441](https://cve.now/CVE-2017-9441.md): Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web s (CVSS 2.7)
- [CVE-2017-9442](https://cve.now/CVE-2017-9442.md): BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web s (no CVSS)
- [CVE-2017-9443](https://cve.now/CVE-2017-9443.md): BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json i (CVSS 8.8)
- [CVE-2017-9444](https://cve.now/CVE-2017-9444.md): BigTree CMS through 4.2.18 has CSRF related to the core\\admin\\modules\\users\\profile\\update.php script (modify user information), the index.p (no CVSS)
- [CVE-2017-9439](https://cve.now/CVE-2017-9439.md): In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of se (no CVSS)
- [CVE-2017-9440](https://cve.now/CVE-2017-9440.md): In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPSDChannel in coders/psd.c, which allows attackers to cause a denial of (no CVSS)
- [CVE-2017-9438](https://cve.now/CVE-2017-9438.md): libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (no CVSS)
- [CVE-2017-1000368](https://cve.now/CVE-2017-1000368.md): Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get\_process\_ttyname() functi (no CVSS)
- [CVE-2017-8438](https://cve.now/CVE-2017-8438.md): Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run\_as functionality. (no CVSS, Elastic X-Pack Security)
- [CVE-2017-8439](https://cve.now/CVE-2017-8439.md): Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. (no CVSS, Elastic Kibana)
- [CVE-2017-8440](https://cve.now/CVE-2017-8440.md): Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain (no CVSS, Elastic Kibana)
- [CVE-2017-8441](https://cve.now/CVE-2017-8441.md): Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. (no CVSS, Elastic X-Pack Security)
- [CVE-2017-8835](https://cve.now/CVE-2017-8835.md): SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2\_380hw6\_580hw2\_710hw3\_1350 (no CVSS)
- [CVE-2017-8836](https://cve.now/CVE-2017-8836.md): CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2\_380hw6\_580hw2\_710hw3\_1350hw2\_2500- (no CVSS)
- [CVE-2017-8837](https://cve.now/CVE-2017-8837.md): Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2\_380hw6\_580hw (no CVSS)
- [CVE-2017-8838](https://cve.now/CVE-2017-8838.md): XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2\_380hw6\_580hw2\_710hw3\_135 (no CVSS)
- [CVE-2017-8839](https://cve.now/CVE-2017-8839.md): XSS via orig\_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2\_380hw6\_580hw2\_710hw3\_1 (no CVSS)
- [CVE-2017-8840](https://cve.now/CVE-2017-8840.md): Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2\_380hw6\_580 (no CVSS)
- [CVE-2017-8841](https://cve.now/CVE-2017-8841.md): Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2\_380hw6\_580hw2\_7 (no CVSS)
- [CVE-2017-9434](https://cve.now/CVE-2017-9434.md): Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter. (no CVSS)
- [CVE-2017-9435](https://cve.now/CVE-2017-9435.md): Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search\_supervisor and search\_statut parameters). (no CVSS, dolibarr/dolibarr)
- [CVE-2017-9436](https://cve.now/CVE-2017-9436.md): TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php. (no CVSS, nilsteampassnet/teampass)
- [CVE-2017-9437](https://cve.now/CVE-2017-9437.md): Openbravo Business Suite 3.0 is affected by SQL injection. (no CVSS)
- [CVE-2017-9430](https://cve.now/CVE-2017-9430.md): Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service (application crash) or possibly have unsp (no CVSS)
- [CVE-2017-9431](https://cve.now/CVE-2017-9431.md): Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomgr/error.c. (no CVSS)
- [CVE-2017-9432](https://cve.now/CVE-2017-9432.md): Document Liberation Project libstaroffice before 2017-04-07 has an out-of-bounds write caused by a stack-based buffer overflow related to th (no CVSS)
- [CVE-2017-9433](https://cve.now/CVE-2017-9433.md): Document Liberation Project libmwaw before 2017-04-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd (no CVSS)
- [CVE-2017-1000367](https://cve.now/CVE-2017-1000367.md): Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get\_process\_ttyname() function r (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-06-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.