# CVEs published 2017-06-12

27 CVEs were published on June 12, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2015-9096](https://cve.now/CVE-2015-9096.md): Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated (no CVSS)
- [CVE-2015-9097](https://cve.now/CVE-2015-9097.md): The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO (no CVSS, mail)
- [CVE-2017-1214](https://cve.now/CVE-2017-1214.md): IBM iNotes 8.5 and 9.0 could allow a remote attacker to send a malformed email to a victim, that when opened could cause an information disc (no CVSS, IBM iNotes)
- [CVE-2017-1247](https://cve.now/CVE-2017-1247.md): IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS Next Generation)
- [CVE-2017-1276](https://cve.now/CVE-2017-1276.md): IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS Next Generation)
- [CVE-2017-1278](https://cve.now/CVE-2017-1278.md): IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0 and 6.0 is vulnerable to HTML injection. (no CVSS, IBM Rational DOORS Next Generation)
- [CVE-2017-6892](https://cve.now/CVE-2017-6892.md): In libsndfile version 1.0.28, an error in the "aiff\_read\_chanmap()" function (aiff.c) can be exploited to cause an out-of-bounds read memory (no CVSS, Flexera Software libsndfile)
- [CVE-2017-7665](https://cve.now/CVE-2017-7665.md): In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms o (no CVSS, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2017-7667](https://cve.now/CVE-2017-7667.md): Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same ori (no CVSS, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2017-9557](https://cve.now/CVE-2017-9557.md): register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to discover passwords by sending the username para (no CVSS)
- [CVE-2014-9984](https://cve.now/CVE-2014-9984.md): nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing (no CVSS)
- [CVE-2017-9418](https://cve.now/CVE-2017-9418.md): SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands (no CVSS)
- [CVE-2017-8834](https://cve.now/CVE-2017-8834.md): The cr\_tknzr\_parse\_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation (no CVSS)
- [CVE-2017-8871](https://cve.now/CVE-2017-8871.md): The cr\_parser\_parse\_selector\_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite (no CVSS)
- [CVE-2017-9122](https://cve.now/CVE-2017-9122.md): The quicktime\_read\_moov function in moov.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (infinite loop and CPU (no CVSS)
- [CVE-2017-9123](https://cve.now/CVE-2017-9123.md): The lqt\_frame\_duration function in lqt\_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (invalid memor (no CVSS)
- [CVE-2017-9124](https://cve.now/CVE-2017-9124.md): The quicktime\_match\_32 function in util.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (NULL pointer dereferen (no CVSS)
- [CVE-2017-9125](https://cve.now/CVE-2017-9125.md): The lqt\_frame\_duration function in lqt\_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based bu (no CVSS)
- [CVE-2017-9126](https://cve.now/CVE-2017-9126.md): The quicktime\_read\_dref\_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buff (no CVSS)
- [CVE-2017-9127](https://cve.now/CVE-2017-9127.md): The quicktime\_user\_atoms\_read\_atom function in useratoms.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap- (no CVSS)
- [CVE-2017-9128](https://cve.now/CVE-2017-9128.md): The quicktime\_video\_width function in lqt\_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based (no CVSS)
- [CVE-2017-9324](https://cve.now/CVE-2017-9324.md): In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is (no CVSS)
- [CVE-2017-9543](https://cve.now/CVE-2017-9543.md): register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to reset arbitrary passwords via a crafted POST re (no CVSS)
- [CVE-2017-9544](https://cve.now/CVE-2017-9544.md): There is a remote stack-based buffer overflow (SEH) in register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1. (no CVSS)
- [CVE-2017-9546](https://cve.now/CVE-2017-9546.md): admin.php in BigTree through 4.2.18 allows remote authenticated users to cause a denial of service (inability to save revisions) via XSS seq (no CVSS)
- [CVE-2017-9547](https://cve.now/CVE-2017-9547.md): admin.php in BigTree through 4.2.18 has a Cross-site Scripting (XSS) vulnerability, which allows remote authenticated users to inject arbitr (no CVSS)
- [CVE-2017-9548](https://cve.now/CVE-2017-9548.md): admin.php in BigTree through 4.2.18 has a Cross-site Scripting (XSS) vulnerability, which allows remote authenticated users to inject arbitr (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-06-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.