# CVEs published 2017-06-08

68 CVEs were published on June 8, 2017: 0 critical, 2 high. Days are UTC.

- [CVE-2015-1379](https://cve.now/CVE-2015-1379.md): The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze (no CVSS)
- [CVE-2015-1588](https://cve.now/CVE-2015-1588.md): Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-rev38, and 7.6.1-rev2 (no CVSS)
- [CVE-2015-1786](https://cve.now/CVE-2015-1786.md): Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token iden (no CVSS, zendframework/zendframework)
- [CVE-2015-2692](https://cve.now/CVE-2015-2692.md): AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters. (no CVSS)
- [CVE-2015-3634](https://cve.now/CVE-2015-3634.md): The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remo (no CVSS)
- [CVE-2015-3913](https://cve.now/CVE-2015-3913.md): The IP stack in multiple Huawei Campus series switch models allows remote attackers to cause a denial of service (reboot) via a crafted ICMP (no CVSS)
- [CVE-2016-6093](https://cve.now/CVE-2016-6093.md): IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to (no CVSS, IBM Security Key Lifecycle Manager)
- [CVE-2016-6098](https://cve.now/CVE-2016-6098.md): IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resour (no CVSS, IBM Security Key Lifecycle Manager)
- [CVE-2016-8987](https://cve.now/CVE-2016-8987.md): IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they should not have access (no CVSS, IBM Maximo Asset Management)
- [CVE-2016-9698](https://cve.now/CVE-2016-9698.md): IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processi (no CVSS, IBM Rational Rhapsody Design Manager)
- [CVE-2016-9736](https://cve.now/CVE-2016-9736.md): IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information. (no CVSS, IBM WebSphere Application Server)
- [CVE-2016-9991](https://cve.now/CVE-2016-9991.md): IBM Sterling Order Management 9.2 through 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious (no CVSS, IBM Sterling Order Management)
- [CVE-2017-1140](https://cve.now/CVE-2017-1140.md): IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting. (no CVSS, IBM Business Process Manager Advanced)
- [CVE-2017-1179](https://cve.now/CVE-2017-1179.md): IBM BigFix Compliance Analytics 1.9.79 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen (no CVSS, IBM BigFix Compliance Analytics)
- [CVE-2017-1319](https://cve.now/CVE-2017-1319.md): IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted session (SSL) cookie (no CVSS, IBM Tivoli Federated Identity Manager)
- [CVE-2014-7919](https://cve.now/CVE-2014-7919.md): b/libs/gui/ISurfaceComposer.cpp in Android allows attackers to trigger a denial of service (null pointer dereference and process crash). (no CVSS)
- [CVE-2016-4473](https://cve.now/CVE-2016-4473.md): /ext/phar/phar\_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. (no CVSS)
- [CVE-2016-5648](https://cve.now/CVE-2016-5648.md): Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in (no CVSS)
- [CVE-2016-6594](https://cve.now/CVE-2016-6594.md): Blue Coat Advanced Secure Gateway 6.6, CacheFlow 3.4, ProxySG 6.5 and 6.6 allows remote attackers to bypass blocked requests, user authentic (no CVSS)
- [CVE-2016-3095](https://cve.now/CVE-2016-3095.md): server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key. (no CVSS)
- [CVE-2016-3099](https://cve.now/CVE-2016-3099.md): mod\_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise (no CVSS)
- [CVE-2016-4992](https://cve.now/CVE-2016-4992.md): 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linu (no CVSS)
- [CVE-2016-5405](https://cve.now/CVE-2016-5405.md): 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linu (no CVSS)
- [CVE-2016-5416](https://cve.now/CVE-2016-5416.md): 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linu (no CVSS)
- [CVE-2016-7050](https://cve.now/CVE-2016-7050.md): SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server (no CVSS)
- [CVE-2017-4918](https://cve.now/CVE-2017-4918.md): VMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service startup script. (no CVSS, VMware Horizon View Client for Mac)
- [CVE-2014-3498](https://cve.now/CVE-2014-3498.md): The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands. (no CVSS, ansible)
- [CVE-2016-2034](https://cve.now/CVE-2016-2034.md): SQL injection vulnerability in ClearPass Policy Manager 6.5.x through 6.5.6 and 6.6.0. (no CVSS)
- [CVE-2016-3091](https://cve.now/CVE-2016-3091.md): Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service. (no CVSS)
- [CVE-2016-3107](https://cve.now/CVE-2016-3107.md): The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" dir (no CVSS)
- [CVE-2016-3108](https://cve.now/CVE-2016-3108.md): The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink att (no CVSS)
- [CVE-2016-3111](https://cve.now/CVE-2016-3111.md): pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp (no CVSS)
- [CVE-2016-3112](https://cve.now/CVE-2016-3112.md): client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which (no CVSS)
- [CVE-2016-3690](https://cve.now/CVE-2016-3690.md): The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload. (no CVSS)
- [CVE-2016-4457](https://cve.now/CVE-2016-4457.md): CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate. (no CVSS)
- [CVE-2016-4471](https://cve.now/CVE-2016-4471.md): ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code. (no CVSS)
- [CVE-2014-4843](https://cve.now/CVE-2014-4843.md): Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix (no CVSS)
- [CVE-2014-6031](https://cve.now/CVE-2014-6031.md): Buffer overflow in the mcpq daemon in F5 BIG-IP systems 10.x before 10.2.4 HF12, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x before 11.4.1 HF9, (no CVSS)
- [CVE-2014-8687](https://cve.now/CVE-2014-8687.md): Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by levera (no CVSS)
- [CVE-2015-2251](https://cve.now/CVE-2015-2251.md): The DeviceManager in Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to obtain sensitive in (no CVSS)
- [CVE-2015-2252](https://cve.now/CVE-2015-2252.md): Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privile (no CVSS)
- [CVE-2015-2253](https://cve.now/CVE-2015-2253.md): The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensiti (no CVSS)
- [CVE-2015-2255](https://cve.now/CVE-2015-2255.md): Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board reset) via vectors invo (no CVSS)
- [CVE-2015-2800](https://cve.now/CVE-2015-2800.md): The user authentication module in Huawei Campus switches S5700, S5300, S6300, and S6700 with software before V200R001SPH012 and S7700, S9300 (no CVSS)
- [CVE-2017-5878](https://cve.now/CVE-2017-5878.md): The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remo (no CVSS)
- [CVE-2017-8108](https://cve.now/CVE-2017-8108.md): Unspecified tests in Lynis before 2.5.0 allow local users to write to arbitrary files or possibly gain privileges via a symlink attack on a (no CVSS)
- [CVE-2017-9022](https://cve.now/CVE-2017-9022.md): The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz\_powm\_sec, which allows remote peers (CVSS 7.5)
- [CVE-2017-9023](https://cve.now/CVE-2017-9023.md): The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers t (CVSS 7.5)
- [CVE-2017-9310](https://cve.now/CVE-2017-9310.md): QEMU (aka Quick Emulator), when built with the e1000e NIC emulation support, allows local guest OS privileged users to cause a denial of ser (no CVSS)
- [CVE-2017-9330](https://cve.now/CVE-2017-9330.md): QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of ser (no CVSS)
- [CVE-2017-9517](https://cve.now/CVE-2017-9517.md): atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV. (no CVSS)
- [CVE-2017-9518](https://cve.now/CVE-2017-9518.md): atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails. (no CVSS)
- [CVE-2017-9519](https://cve.now/CVE-2017-9519.md): atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account. (no CVSS)
- [CVE-2017-9520](https://cve.now/CVE-2017-9520.md): The r\_config\_set function in libr/config/config.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and (no CVSS)
- [CVE-2017-4901](https://cve.now/CVE-2017-4901.md): The drag-and-drop (DnD) function in VMware Workstation 12.x before version 12.5.4 and Fusion 8.x before version 8.5.5 has an out-of-bounds m (no CVSS, VMware Workstation Pro/Player · VMware Fusion Pro / Fusion)
- [CVE-2017-4907](https://cve.now/CVE-2017-4907.md): VMware Unified Access Gateway (2.5.x, 2.7.x, 2.8.x prior to 2.8.1) and Horizon View (7.x prior to 7.1.0, 6.x prior to 6.2.4) contain a heap (no CVSS, VMware Unified Access Gateway · VMware Horizon View)
- [CVE-2017-4908](https://cve.now/CVE-2017-4908.md): VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple heap buffer-overflow vulnerabilities (no CVSS, VMware Workstation · VMware Horizon View Client for Windows)
- [CVE-2017-4909](https://cve.now/CVE-2017-4909.md): VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain a heap buffer-overflow vulnerability in TrueT (no CVSS, VMware Workstation · VMware Horizon View Client for Windows)
- [CVE-2017-4910](https://cve.now/CVE-2017-4910.md): VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds read vulnerabilities i (no CVSS, VMware Workstation · VMware Horizon View Client for Windows)
- [CVE-2017-4911](https://cve.now/CVE-2017-4911.md): VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds write vulnerabilities (no CVSS, VMware Workstation · VMware Horizon View Client for Windows)
- [CVE-2017-4912](https://cve.now/CVE-2017-4912.md): VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds read vulnerabilities i (no CVSS, VMware Workstation · VMware Horizon View Client for Windows)
- [CVE-2017-4913](https://cve.now/CVE-2017-4913.md): VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain an integer-overflow vulnerability in the True (no CVSS, VMware Workstation · VMware Horizon View Client for Windows)
- [CVE-2017-6638](https://cve.now/CVE-2017-6638.md): A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local att (no CVSS, Cisco AnyConnect Local Privilege Escalation Vulnerability)
- [CVE-2017-6639](https://cve.now/CVE-2017-6639.md): A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) could allow an unaut (no CVSS, Cisco Prime Data Center Network Manager Debug Remote Code E…)
- [CVE-2017-6640](https://cve.now/CVE-2017-6640.md): A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an unauthenticated, remote attacker to log in to the (no CVSS, Cisco Prime Data Center Network Manager Server Static Crede…)
- [CVE-2017-6648](https://cve.now/CVE-2017-6648.md): A vulnerability in the Session Initiation Protocol (SIP) of the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software could (no CVSS, Cisco TelePresence Endpoint Denial of Service Vulnerability)
- [CVE-2017-9516](https://cve.now/CVE-2017-9516.md): Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file. (no CVSS, craftcms/cms)
- [CVE-2017-7180](https://cve.now/CVE-2017-7180.md): Net Monitor for Employees Pro through 5.3.4 has an unquoted service path, which allows a Security Feature Bypass of its documented "Block ap (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-06-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.