# CVEs published 2017-06-07

59 CVEs were published on June 7, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2014-9310](https://cve.now/CVE-2014-9310.md): Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress. (no CVSS)
- [CVE-2015-3295](https://cve.now/CVE-2015-3295.md): markdown-it before 4.1.0 does not block data: URLs. (no CVSS)
- [CVE-2015-7346](https://cve.now/CVE-2015-7346.md): SQL injection vulnerability in ZCMS 1.1. (no CVSS)
- [CVE-2015-5175](https://cve.now/CVE-2015-5175.md): Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service. (no CVSS, org.apache.cxf.fediz:fediz-idp · org.apache.cxf.fediz:fediz…)
- [CVE-2015-5232](https://cve.now/CVE-2015-5232.md): Race conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197. (no CVSS)
- [CVE-2015-6240](https://cve.now/CVE-2015-6240.md): The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink att (no CVSS, ansible)
- [CVE-2015-6540](https://cve.now/CVE-2015-6540.md): Cross-site scripting (XSS) vulnerability in Intellect Design Arena Intellect Core banking software. (no CVSS)
- [CVE-2015-6959](https://cve.now/CVE-2015-6959.md): Cross-site scripting (XSS) vulnerability in Vindula 1.9. (no CVSS)
- [CVE-2015-8235](https://cve.now/CVE-2015-8235.md): Directory traversal vulnerability in Spiffy before 5.4. (no CVSS)
- [CVE-2015-8538](https://cve.now/CVE-2015-8538.md): dwarf\_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV). (no CVSS)
- [CVE-2016-4973](https://cve.now/CVE-2016-4973.md): Binaries compiled against targets that use the libssp library in GCC for stack smashing protection (SSP) might allow local users to perform (no CVSS)
- [CVE-2017-7965](https://cve.now/CVE-2017-7965.md): A buffer overflow vulnerability exists in Programming Software executable AlTracePrint.exe, in Schneider Electric's SoMachine HVAC v2.1.0 fo (no CVSS, Schneider Electric SE SoMachine HVAC Programming Software)
- [CVE-2017-7966](https://cve.now/CVE-2017-7966.md): A DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute (no CVSS, Schneider Electric SE SoMachine HVAC Programming Software)
- [CVE-2017-9355](https://cve.now/CVE-2017-9355.md): XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side (no CVSS)
- [CVE-2017-4898](https://cve.now/CVE-2017-4898.md): VMware Workstation Pro/Player 12.x before 12.5.3 contains a DLL loading vulnerability that occurs due to the "vmware-vmx" process loading DL (no CVSS, VMware Workstation Pro/Player)
- [CVE-2017-4899](https://cve.now/CVE-2017-4899.md): VMware Workstation Pro/Player 12.x before 12.5.3 contains a security vulnerability that exists in the SVGA driver. (no CVSS, VMware Workstation Pro/Player)
- [CVE-2017-4900](https://cve.now/CVE-2017-4900.md): VMware Workstation Pro/Player 12.x before 12.5.3 contains a NULL pointer dereference vulnerability that exists in the SVGA driver. (no CVSS, VMware Workstation Pro/Player)
- [CVE-2017-4902](https://cve.now/CVE-2017-4902.md): VMware ESXi 6.5 without patch ESXi650-201703410-SG and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5 (no CVSS, VMware ESXi · VMware Workstation Pro / Player +1)
- [CVE-2017-4903](https://cve.now/CVE-2017-4903.md): VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6. (no CVSS, VMware ESXi · VMware Workstation Pro / Player +1)
- [CVE-2017-4904](https://cve.now/CVE-2017-4904.md): The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch E (no CVSS, VMware ESXi · VMware Workstation Pro / Player +1)
- [CVE-2017-4905](https://cve.now/CVE-2017-4905.md): VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6. (no CVSS, VMware ESXi · VMware Workstation Pro / Player +1)
- [CVE-2016-0254](https://cve.now/CVE-2016-0254.md): IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error (no CVSS, IBM Cognos Business Intelligence)
- [CVE-2016-3019](https://cve.now/CVE-2016-3019.md): IBM Security Access Manager for Web 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly (no CVSS, IBM Security Access Manager)
- [CVE-2016-3051](https://cve.now/CVE-2016-3051.md): IBM Security Access Manager for Web 9.0.0 could allow an authenticated user to access some privileged functionality of the server. (no CVSS, IBM Security Access Manager)
- [CVE-2016-5959](https://cve.now/CVE-2016-5959.md): IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores sensitive information in URL parameters. (no CVSS, IBM Security Privileged Identity Manager)
- [CVE-2016-5960](https://cve.now/CVE-2016-5960.md): IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores user credentials in plain in clear text which can be read by a local user. (no CVSS, IBM Security Privileged Identity Manager)
- [CVE-2016-6087](https://cve.now/CVE-2016-6087.md): IBM Domino 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data using Domino TLS Key E (no CVSS, IBM Domino)
- [CVE-2016-6089](https://cve.now/CVE-2016-6089.md): IBM WebSphere MQ 9.0.0.1 and 9.0.2 could allow a local user to write to a file or delete files in a directory they should not have access to (no CVSS, IBM MQ)
- [CVE-2016-8939](https://cve.now/CVE-2016-8939.md): IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) clients/agents store password information in the Windows Registry in a manner (no CVSS, IBM Spectrum Protect)
- [CVE-2016-9710](https://cve.now/CVE-2016-9710.md): IBM Predictive Solutions Foundation (formerly PMQ) could allow a remote attacker to include arbitrary files. (no CVSS, IBM Cognos Business Intelligence)
- [CVE-2016-9977](https://cve.now/CVE-2016-9977.md): IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate (no CVSS, IBM Maximo Asset Management)
- [CVE-2017-1125](https://cve.now/CVE-2017-1125.md): IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents (no CVSS, IBM Cognos Business Intelligence)
- [CVE-2017-1178](https://cve.now/CVE-2017-1178.md): IBM Endpoint Manager for Security and Compliance 1.9.70 is vulnerable to cross-site scripting. (no CVSS, IBM Endpoint Manager for Security and Compliance)
- [CVE-2017-1196](https://cve.now/CVE-2017-1196.md): IBM BigFix Compliance (TEMA SUAv1 SCA SCM) 1.9.70 does not require that users should have strong passwords by default, which makes it easier (no CVSS, IBM Endpoint Manager for Security and Compliance)
- [CVE-2017-1305](https://cve.now/CVE-2017-1305.md): IBM DOORS Next Generation (DNG/RRC) 6.0.2 and 6.0.3 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS Next Generation)
- [CVE-2017-4914](https://cve.now/CVE-2017-4914.md): VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. (no CVSS, VMware vSphere Data Protection)
- [CVE-2017-4917](https://cve.now/CVE-2017-4917.md): VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. (no CVSS, VMware vSphere Data Protection)
- [CVE-2017-7563](https://cve.now/CVE-2017-7563.md): In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT\_EXECUTE\_NEVER protect (no CVSS)
- [CVE-2017-7564](https://cve.now/CVE-2017-7564.md): In ARM Trusted Firmware through 1.3, the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of serv (no CVSS)
- [CVE-2015-7326](https://cve.now/CVE-2015-7326.md): XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3. (no CVSS)
- [CVE-2015-7514](https://cve.now/CVE-2015-7514.md): OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive inform (no CVSS)
- [CVE-2015-7723](https://cve.now/CVE-2015-7723.md): AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. (no CVSS)
- [CVE-2015-7724](https://cve.now/CVE-2015-7724.md): AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. (no CVSS)
- [CVE-2015-7888](https://cve.now/CVE-2015-7888.md): Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overw (no CVSS)
- [CVE-2015-8326](https://cve.now/CVE-2015-8326.md): The IPTables-Parse module before 1.6 for Perl allows local users to write to arbitrary files owned by the current user. (no CVSS)
- [CVE-2017-9499](https://cve.now/CVE-2017-9499.md): In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function SetPixelChannelAttributes, which allows attackers to cause a deni (no CVSS)
- [CVE-2017-9500](https://cve.now/CVE-2017-9500.md): In ImageMagick 7.0.5-8 Q16, an assertion failure was found in the function ResetImageProfileIterator, which allows attackers to cause a deni (no CVSS)
- [CVE-2017-9501](https://cve.now/CVE-2017-9501.md): In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function LockSemaphoreInfo, which allows attackers to cause a denial of se (no CVSS)
- [CVE-2017-7312](https://cve.now/CVE-2017-7312.md): An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. (no CVSS)
- [CVE-2017-7313](https://cve.now/CVE-2017-7313.md): An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. (no CVSS)
- [CVE-2017-7314](https://cve.now/CVE-2017-7314.md): An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. (no CVSS)
- [CVE-2016-9834](https://cve.now/CVE-2016-9834.md): An XSS vulnerability allows remote attackers to execute arbitrary client side script on vulnerable installations of Sophos Cyberoam firewall (no CVSS)
- [CVE-2017-9470](https://cve.now/CVE-2017-9470.md): In ytnef 1.9.2, the MAPIPrint function in lib/ytnef.c allows remote attackers to cause a denial of service (NULL pointer dereference and app (no CVSS)
- [CVE-2017-9471](https://cve.now/CVE-2017-9471.md): In ytnef 1.9.2, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and a (no CVSS)
- [CVE-2017-9472](https://cve.now/CVE-2017-9472.md): In ytnef 1.9.2, the SwapDWord function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and (no CVSS)
- [CVE-2017-9473](https://cve.now/CVE-2017-9473.md): In ytnef 1.9.2, the TNEFFillMapi function in lib/ytnef.c allows remote attackers to cause a denial of service (memory consumption) via a cra (no CVSS)
- [CVE-2017-9474](https://cve.now/CVE-2017-9474.md): In ytnef 1.9.2, the DecompressRTF function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read (no CVSS)
- [CVE-2017-9468](https://cve.now/CVE-2017-9468.md): In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. (no CVSS)
- [CVE-2017-9469](https://cve.now/CVE-2017-9469.md): In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the alloc (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-06-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.