# CVEs published 2017-06-14

37 CVEs were published on June 14, 2017: 0 critical, 2 high. Days are UTC.

- [CVE-2017-4981](https://cve.now/CVE-2017-4981.md): EMC RSA BSAFE Cert-C before 2.9.0.5 contains a potential improper certificate processing vulnerability. (no CVSS, RSA BSAFE Cert-C RSA BSAFE Cert-C)
- [CVE-2017-4986](https://cve.now/CVE-2017-4986.md): EMC ESRS VE 3.18 or earlier contains Authentication Bypass that could potentially be exploited by malicious users to compromise the affected (no CVSS, EMC ESRS Virtual Edition EMC ESRS VE 3.18 or earlier)
- [CVE-2017-7910](https://cve.now/CVE-2017-7910.md): A Stack-Based Buffer Overflow issue was discovered in Digital Canal Structural Wind Analysis versions 9.1 and prior. (no CVSS, Digital Canal Structural Wind Analysis)
- [CVE-2017-7914](https://cve.now/CVE-2017-7914.md): A Missing Authorization issue was discovered in Rockwell Automation PanelView Plus 6 700-1500 6.00.04, 6.00.05, 6.00.42, 6.00-20140306, 6.10 (no CVSS, Rockwell Automation PanelView Plus 6 700-1500)
- [CVE-2017-9621](https://cve.now/CVE-2017-9621.md): Cross-site scripting (XSS) vulnerability in modules/Base/Lang/Administrator/update\_translation.php in EPESI in Telaxus/EPESI 1.8.2 and earli (no CVSS)
- [CVE-2017-9622](https://cve.now/CVE-2017-9622.md): Multiple cross-site scripting (XSS) vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2017-9623](https://cve.now/CVE-2017-9623.md): Multiple cross-site scripting (XSS) vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2017-9624](https://cve.now/CVE-2017-9624.md): Multiple cross-site scripting (XSS) vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2017-8907](https://cve.now/CVE-2017-8907.md): Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permiss (CVSS 8.8, Atlassian Bamboo)
- [CVE-2017-9616](https://cve.now/CVE-2017-9616.md): In Wireshark 2.2.7, overly deep mp4 chunks may cause stack exhaustion (uncontrolled recursion) in the dissect\_mp4\_box function in epan/disse (no CVSS)
- [CVE-2017-9617](https://cve.now/CVE-2017-9617.md): In Wireshark 2.2.7, deeply nested DAAP data may cause stack exhaustion (uncontrolled recursion) in the dissect\_daap\_one\_tag function in epan (no CVSS)
- [CVE-2017-9463](https://cve.now/CVE-2017-9463.md): The application Piwigo is affected by a SQL injection vulnerability in version 2.9.0 and possibly prior. (no CVSS)
- [CVE-2017-9464](https://cve.now/CVE-2017-9464.md): An open redirect vulnerability is present in Piwigo 2.9 and probably prior versions, allowing remote attackers to redirect users to arbitrar (no CVSS)
- [CVE-2016-8746](https://cve.now/CVE-2016-8746.md): Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recu (no CVSS, Apache Software Foundation Apache Ranger · org.apache.range…)
- [CVE-2016-8751](https://cve.now/CVE-2016-8751.md): Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. (no CVSS, Apache Software Foundation Apache Ranger · org.apache.range…)
- [CVE-2017-7676](https://cve.now/CVE-2017-7676.md): Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '\*' wildcard character - like my\*test, test\*.txt. (no CVSS, Apache Software Foundation Apache Ranger · org.apache.range…)
- [CVE-2017-7677](https://cve.now/CVE-2017-7677.md): In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission (no CVSS, Apache Software Foundation Apache Ranger · org.apache.range…)
- [CVE-2017-0636](https://cve.now/CVE-2017-0636.md): An elevation of privilege vulnerability in the MediaTek command queue driver could enable a local malicious application to execute arbitrary (no CVSS, Google Android)
- [CVE-2017-0637](https://cve.now/CVE-2017-0637.md): A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corr (no CVSS, Google Android)
- [CVE-2017-0638](https://cve.now/CVE-2017-0638.md): A remote code execution vulnerability in System UI component could enable an attacker using a specially crafted file to execute arbitrary co (no CVSS, Google Android)
- [CVE-2017-0639](https://cve.now/CVE-2017-0639.md): An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its perm (no CVSS, Google Android)
- [CVE-2017-0640](https://cve.now/CVE-2017-0640.md): A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or r (no CVSS, Google Android)
- [CVE-2017-0641](https://cve.now/CVE-2017-0641.md): A remote denial of service vulnerability in libvpx in Mediaserver could enable an attacker to use a specially crafted file to cause a device (no CVSS, Google Android)
- [CVE-2017-0642](https://cve.now/CVE-2017-0642.md): A remote denial of service vulnerability in libhevc in Mediaserver could enable an attacker to use a specially crafted file to cause a devic (no CVSS, Google Android)
- [CVE-2017-0643](https://cve.now/CVE-2017-0643.md): A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or r (no CVSS, Google Android)
- [CVE-2017-0644](https://cve.now/CVE-2017-0644.md): A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or r (no CVSS, Google Android)
- [CVE-2017-0645](https://cve.now/CVE-2017-0645.md): An elevation of privilege vulnerability in Bluetooth could enable a local malicious application to access data outside of its permission lev (no CVSS, Google Android)
- [CVE-2017-0646](https://cve.now/CVE-2017-0646.md): An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its perm (no CVSS, Google Android)
- [CVE-2017-0647](https://cve.now/CVE-2017-0647.md): An information disclosure vulnerability in libziparchive could enable a local malicious application to access data outside of its permission (no CVSS, Google Android)
- [CVE-2017-0648](https://cve.now/CVE-2017-0648.md): An elevation of privilege vulnerability in the kernel FIQ debugger could enable a local malicious application to execute arbitrary code with (no CVSS, Google Android)
- [CVE-2017-0649](https://cve.now/CVE-2017-0649.md): An elevation of privilege vulnerability in the MediaTek sound driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2017-0650](https://cve.now/CVE-2017-0650.md): An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outsid (no CVSS, Google Android)
- [CVE-2017-0651](https://cve.now/CVE-2017-0651.md): An information disclosure vulnerability in the kernel ION subsystem could enable a local malicious application to access data outside of its (no CVSS, Google Android)
- [CVE-2017-0663](https://cve.now/CVE-2017-0663.md): A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within th (no CVSS, Google Android)
- [CVE-2017-2810](https://cve.now/CVE-2017-2810.md): An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. (CVSS 7.5, Kenneth Reitz Tablib · tablib)
- [CVE-2017-9502](https://cve.now/CVE-2017-9502.md): In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which pr (no CVSS)
- [CVE-2017-5697](https://cve.now/CVE-2017-5697.md): Insufficient clickjacking protection in the Web User Interface of Intel AMT firmware versions before 9.1.40.1000, 9.5.60.1952, 10.0.50.1004, (no CVSS, Intel Active Mangement Technology)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-06-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.