CVEs published June 7, 2017
59 CVEs were published on June 7, 2017: 0 critical, 0 high.
- Published
- 59
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 59
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- VMware ESXi · VMware Workstation Pro / Player +1
- 4
- IBM Cognos Business Intelligence
- 3
- VMware Workstation Pro/Player
- 3
- IBM Endpoint Manager for Security and Compliance
- 2
- IBM Security Access Manager
- 2
- IBM Security Privileged Identity Manager
- 2
- Schneider Electric SE SoMachine HVAC Programming Software
- 2
- VMware vSphere Data Protection
- 2
- ansible
- 1
- IBM Domino
- 1
Medium, low and unrated 59
- CVE-2014-9310Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress.
- CVE-2015-3295markdown-it before 4.1.0 does not block data: URLs.
- CVE-2015-7346SQL injection vulnerability in ZCMS 1.1.
- CVE-2015-5175Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.org.apache.cxf.fediz:fediz-idp · org.apache.cxf.fediz:fediz…
- CVE-2015-5232Race conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197.
- CVE-2015-6240The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attansible
- CVE-2015-6540Cross-site scripting (XSS) vulnerability in Intellect Design Arena Intellect Core banking software.
- CVE-2015-6959Cross-site scripting (XSS) vulnerability in Vindula 1.9.
- CVE-2015-8235Directory traversal vulnerability in Spiffy before 5.4.
- CVE-2015-8538dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).
- CVE-2016-4973Binaries compiled against targets that use the libssp library in GCC for stack smashing protection (SSP) might allow local users to perform
- CVE-2017-7965A buffer overflow vulnerability exists in Programming Software executable AlTracePrint.exe, in Schneider Electric's SoMachine HVAC v2.1.0 foSchneider Electric SE SoMachine HVAC Programming Software
- CVE-2017-7966A DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute Schneider Electric SE SoMachine HVAC Programming Software
- CVE-2017-9355XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side
- CVE-2017-4898VMware Workstation Pro/Player 12.x before 12.5.3 contains a DLL loading vulnerability that occurs due to the "vmware-vmx" process loading DLVMware Workstation Pro/Player
- CVE-2017-4899VMware Workstation Pro/Player 12.x before 12.5.3 contains a security vulnerability that exists in the SVGA driver.VMware Workstation Pro/Player
- CVE-2017-4900VMware Workstation Pro/Player 12.x before 12.5.3 contains a NULL pointer dereference vulnerability that exists in the SVGA driver.VMware Workstation Pro/Player
- CVE-2017-4902VMware ESXi 6.5 without patch ESXi650-201703410-SG and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5VMware ESXi · VMware Workstation Pro / Player +1
- CVE-2017-4903VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.VMware ESXi · VMware Workstation Pro / Player +1
- CVE-2017-4904The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch EVMware ESXi · VMware Workstation Pro / Player +1
- CVE-2017-4905VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.VMware ESXi · VMware Workstation Pro / Player +1
- CVE-2016-0254IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error IBM Cognos Business Intelligence
- CVE-2016-3019IBM Security Access Manager for Web 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly IBM Security Access Manager
- CVE-2016-3051IBM Security Access Manager for Web 9.0.0 could allow an authenticated user to access some privileged functionality of the server.IBM Security Access Manager
- CVE-2016-5959IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores sensitive information in URL parameters.IBM Security Privileged Identity Manager
- CVE-2016-5960IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores user credentials in plain in clear text which can be read by a local user.IBM Security Privileged Identity Manager
- CVE-2016-6087IBM Domino 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data using Domino TLS Key EIBM Domino
- CVE-2016-6089IBM WebSphere MQ 9.0.0.1 and 9.0.2 could allow a local user to write to a file or delete files in a directory they should not have access toIBM MQ
- CVE-2016-8939IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) clients/agents store password information in the Windows Registry in a manner IBM Spectrum Protect
- CVE-2016-9710IBM Predictive Solutions Foundation (formerly PMQ) could allow a remote attacker to include arbitrary files.IBM Cognos Business Intelligence
- CVE-2016-9977IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate IBM Maximo Asset Management
- CVE-2017-1125IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents IBM Cognos Business Intelligence
- CVE-2017-1178IBM Endpoint Manager for Security and Compliance 1.9.70 is vulnerable to cross-site scripting.IBM Endpoint Manager for Security and Compliance
- CVE-2017-1196IBM BigFix Compliance (TEMA SUAv1 SCA SCM) 1.9.70 does not require that users should have strong passwords by default, which makes it easierIBM Endpoint Manager for Security and Compliance
- CVE-2017-1305IBM DOORS Next Generation (DNG/RRC) 6.0.2 and 6.0.3 is vulnerable to cross-site scripting.IBM Rational DOORS Next Generation
- CVE-2017-4914VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue.VMware vSphere Data Protection
- CVE-2017-4917VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption.VMware vSphere Data Protection
- CVE-2017-7563In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT_EXECUTE_NEVER protect
- CVE-2017-7564In ARM Trusted Firmware through 1.3, the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of serv
- CVE-2015-7326XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.
- CVE-2015-7514OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive inform
- CVE-2015-7723AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack.
- CVE-2015-7724AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack.
- CVE-2015-7888Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overw
- CVE-2015-8326The IPTables-Parse module before 1.6 for Perl allows local users to write to arbitrary files owned by the current user.
- CVE-2017-9499In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function SetPixelChannelAttributes, which allows attackers to cause a deni
- CVE-2017-9500In ImageMagick 7.0.5-8 Q16, an assertion failure was found in the function ResetImageProfileIterator, which allows attackers to cause a deni
- CVE-2017-9501In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function LockSemaphoreInfo, which allows attackers to cause a denial of se
- CVE-2017-7312An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1.
- CVE-2017-7313An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1.
- CVE-2017-7314An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1.
- CVE-2016-9834An XSS vulnerability allows remote attackers to execute arbitrary client side script on vulnerable installations of Sophos Cyberoam firewall
- CVE-2017-9470In ytnef 1.9.2, the MAPIPrint function in lib/ytnef.c allows remote attackers to cause a denial of service (NULL pointer dereference and app
- CVE-2017-9471In ytnef 1.9.2, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and a
- CVE-2017-9472In ytnef 1.9.2, the SwapDWord function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and
- CVE-2017-9473In ytnef 1.9.2, the TNEFFillMapi function in lib/ytnef.c allows remote attackers to cause a denial of service (memory consumption) via a cra
- CVE-2017-9474In ytnef 1.9.2, the DecompressRTF function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read
- CVE-2017-9468In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer.
- CVE-2017-9469In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the alloc