CVEs published June 9, 2017

68 CVEs were published on June 9, 2017: 1 critical, 0 high. 1 is now in CISA KEV.

Published: 68
Critical: 1
High: 0
Medium: 0
Low: 0
Unrated: 67
Now in CISA KEV: 1
Fix available: 0

Most affected products

Cybozu Garoon: 7
BUFFALO WNC01WH: 6
INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) Hands-…: 4
Corega CG-WLR300NX: 3
I-O DATA DEVICE TS-WRLP · I-O DATA DEVICE TS-WRLA: 3
Cybozu Dezie: 2
I-O DATA DEVICE WFS-SR01: 2
RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2…: 2
Tor before: 2
Acquisition, Technology & Logistics Agency Installer of ele…: 1

Critical 1

CVE-2016-7836SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection withSky Co. SKYSEA Client ViewCritical · 9.8KEVJun 9, 2017

Medium, low and unrated 67

CVE-2017-5003EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2 (all patch levels); RSA Via Lifecycle and Governance version 7.0 (all patch RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2…UnratedJun 9, 2017
CVE-2017-5004EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2 (all patch levels); RSA Via Lifecycle and Governance version 7.0 (all patch RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2…UnratedJun 9, 2017
CVE-2017-0375The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_fTor beforeUnratedJun 9, 2017
CVE-2017-0376The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_proceTor beforeUnratedJun 9, 2017
CVE-2016-4902Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)"Japan Agency for Local Authority Information Systems The… +1UnratedJun 9, 2017
CVE-2016-4906Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to inject arbitrary web script or HTML via "MessaCybozu GaroonUnratedJun 9, 2017
CVE-2016-4907Cybozu Garoon 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors.Cybozu GaroonUnratedJun 9, 2017
CVE-2016-4908Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSCybozu GaroonUnratedJun 9, 2017
CVE-2016-4909Cross-site request forgery (CSRF) vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to hijack the authentication of a loCybozu GaroonUnratedJun 9, 2017
CVE-2016-4910Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to delete other operational administrators' Cybozu GaroonUnratedJun 9, 2017
CVE-2016-7801Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to bypass access restrictions to delete other users' To-Dos via unspecified vectors.Cybozu GaroonUnratedJun 9, 2017
CVE-2016-7802Directory traversal vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to read arbitrary files via unspecifUnratedJun 9, 2017
CVE-2016-7803SQL injection vulnerability in the Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to execute arbitrary SQL commands via Cybozu GaroonUnratedJun 9, 2017
CVE-2016-7805The mobiGate App for Android version 2.2.1.2 and earlier and mobiGate App for iOS version 2.2.4.1 and earlier do not verify X.509 certificatNihon Unisys mobiGate App for Android · Nihon Unisys mobiGa…UnratedJun 9, 2017
CVE-2016-7806I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors.I-O DATA DEVICE WFS-SR01UnratedJun 9, 2017
CVE-2016-7807I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to bypass access restriction to access data on storage devI-O DATA DEVICE WFS-SR01UnratedJun 9, 2017
CVE-2016-7808Cross-site scripting vulnerability in Corega CG-WLBARGMH and CG-WLBARGNL allows remote attackers to inject arbitrary web script or HTML via Corega CG-WLBARGMH · Corega CG-WLBARGNLUnratedJun 9, 2017
CVE-2016-7809Cross-site request forgery (CSRF) vulnerability in Corega CG-WLR300NX firmware Ver.Corega CG-WLR300NXUnratedJun 9, 2017
CVE-2016-7810Cross-site scripting vulnerability in Corega CG-WLR300NX firmware Ver.Corega CG-WLR300NXUnratedJun 9, 2017
CVE-2016-7811Corega CG-WLR300NX firmware Ver.Corega CG-WLR300NXUnratedJun 9, 2017
CVE-2016-7813Cross-site scripting vulnerability in DERAEMON-CMS version 0.8.9 and earlier allows remote attackers to inject arbitrary web script or HTML TEAM DERAEMONS DERAEMON-CMSUnratedJun 9, 2017
CVE-2016-7814I-O DATA DEVICE TS-WRLP firmware version 1.00.01 and earlier and TS-WRLA firmware version 1.00.01 and earlier allow remote attackers to obtaI-O DATA DEVICE TS-WRLP · I-O DATA DEVICE TS-WRLAUnratedJun 9, 2017
CVE-2016-7816The Cybozu kintone mobile for Android 1.0.6 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle Cybozu kintone mobile for AndroidUnratedJun 9, 2017
CVE-2016-7817Cross-site scripting vulnerability in Simple keitai chat 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via LEMON-S PHP Simple keitai chatUnratedJun 9, 2017
CVE-2016-7818Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver.Japan Pension Service Intstaller for Specification check… +2UnratedJun 9, 2017
CVE-2016-7819I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an attacker with adminiI-O DATA DEVICE TS-WRLP · I-O DATA DEVICE TS-WRLAUnratedJun 9, 2017
CVE-2016-7820Buffer overflow in I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an aI-O DATA DEVICE TS-WRLP · I-O DATA DEVICE TS-WRLAUnratedJun 9, 2017
CVE-2016-7821Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allow remote attackers to cause a denial of service against the managementBUFFALO WNC01WHUnratedJun 9, 2017
CVE-2016-7822Cross-site request forgery (CSRF) vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows remote attackersBUFFALO WNC01WHUnratedJun 9, 2017
CVE-2016-7823Cross-site scripting vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to inBUFFALO WNC01WHUnratedJun 9, 2017
CVE-2016-7824Buffalo NC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to bypass access restriction to enable the dBUFFALO WNC01WHUnratedJun 9, 2017
CVE-2016-7825Directory traversal vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to reaBUFFALO WNC01WHUnratedJun 9, 2017
CVE-2016-7826Directory traversal vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to reaBUFFALO WNC01WHUnratedJun 9, 2017
CVE-2016-7830Sony PCS-XG100, PCS-XG100S, PCS-XG100C, PCS-XG77, PCS-XG77S, PCS-XG77C devices with firmware versions prior to Ver.1.51 and PCS-XC1 devices Sony PCS-XG100 · Sony PCS-XG100S +5UnratedJun 9, 2017
CVE-2016-7831Sleipnir 4 Black Edition for Mac 4.5.3 and earlier and Sleipnir 4 for Mac 4.5.3 and earlier (Mac App Store) may allow a remote attacker to sFenrir Sleipnir 4 Black Edition for Mac · Fenrir Sleipnir 4…UnratedJun 9, 2017
CVE-2016-7832Cybozu Dezie 8.0.0 to 8.1.1 allows remote attackers to bypass access restrictions to obtain an arbitrary DBM (Cybozu Dezie proprietary formaCybozu DezieUnratedJun 9, 2017
CVE-2016-7833Cybozu Dezie 8.0.0 to 8.1.1 allows remote attackers to bypass access restrictions to delete an arbitrary DBM (Cybozu Dezie proprietary formaCybozu DezieUnratedJun 9, 2017
CVE-2016-7835Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys andKazuho Oku H2OUnratedJun 9, 2017
CVE-2016-7837Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utiBlueZ Project BlueZUnratedJun 9, 2017
CVE-2016-7838Untrusted search path vulnerability in WinSparkle versions prior to 0.5.3 allows remote attackers to execute arbitrary code via a specially WinSparkleUnratedJun 9, 2017
CVE-2017-2165GroupSession versions 4.6.4 and earlier allows remote authenticated attackers to bypass access restrictions to obtain sensitive information Japan Total System Co. GroupSessionUnratedJun 9, 2017
CVE-2017-2176Untrusted search path vulnerability in screensaver installers (jasdf_01.exe, jasdf_02.exe, jasdf_03.exe, jasdf_04.exe, jasdf_05.exe, scramblJAPAN AIR SELF DEFENSE FORCE, MINISTRY OF DEFENSE jasdf_… +6UnratedJun 9, 2017
CVE-2017-2177Untrusted search path vulnerability in Installer of Shogyo Touki Denshi Ninsho Software Ver 1.7 and earlier allows an attacker to gain priviMinistry of Justice Installer of Shogyo Touki Denshi Ninsho…UnratedJun 9, 2017
CVE-2017-2178Untrusted search path vulnerability in Installer of electronic tendering and bid opening system available prior to May 25, 2017 allows an atAcquisition, Technology & Logistics Agency Installer of ele…UnratedJun 9, 2017
CVE-2017-2179Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allows remote code execution via unspecified vectors, INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) Hands-…UnratedJun 9, 2017
CVE-2017-2180Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspeINFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) Hands-…UnratedJun 9, 2017
CVE-2017-2181Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspeINFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) Hands-…UnratedJun 9, 2017
CVE-2017-2182Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspeINFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) Hands-…UnratedJun 9, 2017
CVE-2017-2187Cross-site scripting vulnerability in WP Live Chat Support prior to version 7.0.07 allows remote attackers to inject arbitrary web script orCODECABIN_ WP Live Chat SupportUnratedJun 9, 2017
CVE-2017-2189Untrusted search path vulnerability in RW-4040 driver installer for Windows 7 version 2.27 allows an attacker to gain privileges via a TrojaSharp RW-4040 driver installer for WindowsUnratedJun 9, 2017
CVE-2017-2190Untrusted search path vulnerability in RW-4040 tool to verify execution environment for Windows 7 version 1.2.0.0 allows an attacker to gainSharp RW-4040 tool to verify execution environment for Wind…UnratedJun 9, 2017
CVE-2017-2191Untrusted search path vulnerability in RW-5100 driver installer for Windows 7 version 1.0.0.9 and RW-5100 driver installer for Windows 8.1 vSharp RW-5100 driver installer for WindowsUnratedJun 9, 2017
CVE-2017-2192Untrusted search path vulnerability in RW-5100 tool to verify execution environment for Windows 7 version 1.1.0.0 and RW-5100 tool to verifySharp RW-5100 tool to verify execution environment for Wind…UnratedJun 9, 2017
CVE-2017-2193Untrusted search path vulnerability in the installer of Tera Term 4.94 and earlier allows an attacker to gain privileges via a Trojan horse TeraTerm Project The installer of Tera TermUnratedJun 9, 2017
CVE-2017-2195SQL injection vulnerability in the Multi Feed Reader prior to version 2.2.4 allows authenticated attackers to execute arbitrary SQL commandsEric Teubert Multi Feed ReaderUnratedJun 9, 2017
CVE-2017-2206Untrusted search path vulnerability in the installer of SaAT Netizen ver.1.2.10.510 and earlier allows an attacker to gain privileges via a NetMove The installer of SaAT NetizenUnratedJun 9, 2017
CVE-2017-2207Untrusted search path vulnerability in the installer of SaAT Personal ver.1.0.10.272 and earlier allows an attacker to gain privileges via aNetMove The installer of SaAT PersonalUnratedJun 9, 2017
CVE-2017-2209Untrusted search path vulnerability in the installer of Houkokusyo Sakusei Shien Tool ver3.0.2 (For the first installation) (The version whiMinistry of the Environment Installer of Houkokusyo Sakusei…UnratedJun 9, 2017
CVE-2017-2210Untrusted search path vulnerability in PatchJGD (PatchJGD101.EXE) ver.Geospatial Information Authority of Japan (GSI) PatchJGDUnratedJun 9, 2017
CVE-2017-2211Untrusted search path vulnerability in PatchJGD (Hyoko) (PatchJGDh101.EXE) ver.Geospatial Information Authority of Japan (GSI) PatchJGD (H…UnratedJun 9, 2017
CVE-2017-2212Untrusted search path vulnerability in TKY2JGD (TKY2JGD1379.EXE) ver.Geospatial Information Authority of Japan (GSI) TKY2JGDUnratedJun 9, 2017
CVE-2017-2213Untrusted search path vulnerability in SemiDynaEXE (SemiDynaEXE2008.EXE) ver.Geospatial Information Authority of Japan (GSI) SemiDynaEXEUnratedJun 9, 2017
CVE-2017-2214Untrusted search path vulnerability in AppCheck and AppCheck Pro prior to version 2.0.1.15 allows an attacker to execute arbitrary code via JIRANSOFT JAPAN AppCheckUnratedJun 9, 2017
CVE-2017-2219Untrusted search path vulnerability in the [Simeji for Windows] installer (simeji.exe) allows an attacker to gain privileges via a Trojan hoUnratedJun 9, 2017
CVE-2017-9525In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-cUnratedJun 9, 2017
CVE-2016-7469A stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, AAM, AFM, Analytics, AF5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…UnratedJun 9, 2017
CVE-2017-9523The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342.UnratedJun 9, 2017