CVEs published June 8, 2017
68 CVEs were published on June 8, 2017: 0 critical, 2 high.
- Published
- 68
- Critical
- 0
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 66
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- VMware Workstation · VMware Horizon View Client for Windows
- 6
- IBM Security Key Lifecycle Manager
- 2
- ansible
- 1
- Cisco AnyConnect Local Privilege Escalation Vulnerability
- 1
- Cisco Prime Data Center Network Manager Debug Remote Code E…
- 1
- Cisco Prime Data Center Network Manager Server Static Crede…
- 1
- Cisco TelePresence Endpoint Denial of Service Vulnerability
- 1
- craftcms/cms
- 1
- IBM BigFix Compliance Analytics
- 1
- IBM Business Process Manager Advanced
- 1
High 2
- CVE-2017-9022The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers
- CVE-2017-9023The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers t
Medium, low and unrated 66
- CVE-2015-1379The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze
- CVE-2015-1588Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-rev38, and 7.6.1-rev2
- CVE-2015-1786Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token idenzendframework/zendframework
- CVE-2015-2692AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters.
- CVE-2015-3634The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remo
- CVE-2015-3913The IP stack in multiple Huawei Campus series switch models allows remote attackers to cause a denial of service (reboot) via a crafted ICMP
- CVE-2016-6093IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers toIBM Security Key Lifecycle Manager
- CVE-2016-6098IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resourIBM Security Key Lifecycle Manager
- CVE-2016-8987IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they should not have accessIBM Maximo Asset Management
- CVE-2016-9698IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processiIBM Rational Rhapsody Design Manager
- CVE-2016-9736IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information.IBM WebSphere Application Server
- CVE-2016-9991IBM Sterling Order Management 9.2 through 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute maliciousIBM Sterling Order Management
- CVE-2017-1140IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting.IBM Business Process Manager Advanced
- CVE-2017-1179IBM BigFix Compliance Analytics 1.9.79 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly senIBM BigFix Compliance Analytics
- CVE-2017-1319IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted session (SSL) cookieIBM Tivoli Federated Identity Manager
- CVE-2014-7919b/libs/gui/ISurfaceComposer.cpp in Android allows attackers to trigger a denial of service (null pointer dereference and process crash).
- CVE-2016-4473/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code.
- CVE-2016-5648Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in
- CVE-2016-6594Blue Coat Advanced Secure Gateway 6.6, CacheFlow 3.4, ProxySG 6.5 and 6.6 allows remote attackers to bypass blocked requests, user authentic
- CVE-2016-3095server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.
- CVE-2016-3099mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise
- CVE-2016-4992389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linu
- CVE-2016-5405389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linu
- CVE-2016-5416389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linu
- CVE-2016-7050SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server
- CVE-2017-4918VMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service startup script.VMware Horizon View Client for Mac
- CVE-2014-3498The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.ansible
- CVE-2016-2034SQL injection vulnerability in ClearPass Policy Manager 6.5.x through 6.5.6 and 6.6.0.
- CVE-2016-3091Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service.
- CVE-2016-3107The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" dir
- CVE-2016-3108The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink att
- CVE-2016-3111pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp
- CVE-2016-3112client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which
- CVE-2016-3690The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload.
- CVE-2016-4457CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.
- CVE-2016-4471ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code.
- CVE-2014-4843Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix
- CVE-2014-6031Buffer overflow in the mcpq daemon in F5 BIG-IP systems 10.x before 10.2.4 HF12, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x before 11.4.1 HF9,
- CVE-2014-8687Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by levera
- CVE-2015-2251The DeviceManager in Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to obtain sensitive in
- CVE-2015-2252Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privile
- CVE-2015-2253The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensiti
- CVE-2015-2255Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board reset) via vectors invo
- CVE-2015-2800The user authentication module in Huawei Campus switches S5700, S5300, S6300, and S6700 with software before V200R001SPH012 and S7700, S9300
- CVE-2017-5878The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remo
- CVE-2017-8108Unspecified tests in Lynis before 2.5.0 allow local users to write to arbitrary files or possibly gain privileges via a symlink attack on a
- CVE-2017-9310QEMU (aka Quick Emulator), when built with the e1000e NIC emulation support, allows local guest OS privileged users to cause a denial of ser
- CVE-2017-9330QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of ser
- CVE-2017-9517atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV.
- CVE-2017-9518atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails.
- CVE-2017-9519atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account.
- CVE-2017-9520The r_config_set function in libr/config/config.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and
- CVE-2017-4901The drag-and-drop (DnD) function in VMware Workstation 12.x before version 12.5.4 and Fusion 8.x before version 8.5.5 has an out-of-bounds mVMware Workstation Pro/Player · VMware Fusion Pro / Fusion
- CVE-2017-4907VMware Unified Access Gateway (2.5.x, 2.7.x, 2.8.x prior to 2.8.1) and Horizon View (7.x prior to 7.1.0, 6.x prior to 6.2.4) contain a heap VMware Unified Access Gateway · VMware Horizon View
- CVE-2017-4908VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple heap buffer-overflow vulnerabilitiesVMware Workstation · VMware Horizon View Client for Windows
- CVE-2017-4909VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain a heap buffer-overflow vulnerability in TrueTVMware Workstation · VMware Horizon View Client for Windows
- CVE-2017-4910VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds read vulnerabilities iVMware Workstation · VMware Horizon View Client for Windows
- CVE-2017-4911VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds write vulnerabilities VMware Workstation · VMware Horizon View Client for Windows
- CVE-2017-4912VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds read vulnerabilities iVMware Workstation · VMware Horizon View Client for Windows
- CVE-2017-4913VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain an integer-overflow vulnerability in the TrueVMware Workstation · VMware Horizon View Client for Windows
- CVE-2017-6638A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attCisco AnyConnect Local Privilege Escalation Vulnerability
- CVE-2017-6639A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) could allow an unautCisco Prime Data Center Network Manager Debug Remote Code E…
- CVE-2017-6640A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an unauthenticated, remote attacker to log in to the Cisco Prime Data Center Network Manager Server Static Crede…
- CVE-2017-6648A vulnerability in the Session Initiation Protocol (SIP) of the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software couldCisco TelePresence Endpoint Denial of Service Vulnerability
- CVE-2017-9516Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.craftcms/cms
- CVE-2017-7180Net Monitor for Employees Pro through 5.3.4 has an unquoted service path, which allows a Security Feature Bypass of its documented "Block ap