# CVEs published 2017-06-21 32 CVEs were published on June 21, 2017: 3 critical, 5 high. Days are UTC. - [CVE-2016-7508](https://cve.now/CVE-2016-7508.md): Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL commands by using a ce (no CVSS) - [CVE-2017-3218](https://cve.now/CVE-2017-3218.md): Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. (no CVSS, Samsung Magician) - [CVE-2017-3219](https://cve.now/CVE-2017-3219.md): Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. (no CVSS, Acronis True Image) - [CVE-2017-4988](https://cve.now/CVE-2017-4988.md): EMC Isilon OneFS 8.0.1.0, 8.0.0 - 8.0.0.3, 7.2.0 - 7.2.1.4, 7.1.x is affected by a privilege escalation vulnerability that could potentially (no CVSS, EMC Isilon OneFS 8.0.1.0, 8.0.0 8.0.0.3, 7.2.0 - 7.2.1.4, 7…) - [CVE-2017-4989](https://cve.now/CVE-2017-4989.md): In EMC Avamar Server Software 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401, an unauthenticated remote attacker may potenti (no CVSS, EMC Avamar Server Software 7.3.1-125, 7.3.0-233, 7.3.0-226,…) - [CVE-2017-4990](https://cve.now/CVE-2017-4990.md): In EMC Avamar Server Software 7.4.1-58, 7.4.0-242, 7.3.1-125, 7.3.0-233, 7.3.0-226, an unauthorized attacker may leverage the file upload fe (no CVSS, EMC Avamar Server Software 7.4.1-58, 7.4.0-242, 7.3.1-125,…) - [CVE-2017-9782](https://cve.now/CVE-2017-9782.md): JasPer 2.0.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted image, (no CVSS) - [CVE-2016-8731](https://cve.now/CVE-2016-8731.md): Hard-coded FTP credentials (r:r) are included in the Foscam C1 running firmware 1.9.1.12. (CVSS 9.8, Foscan Foscam C1 Webcam) - [CVE-2017-2813](https://cve.now/CVE-2017-2813.md): An exploitable integer overflow vulnerability exists in the JPEG 2000 parser functionality of IrfanView 4.44. (CVSS 8.8, Irfanview) - [CVE-2017-6043](https://cve.now/CVE-2017-6043.md): A Resource Consumption issue was discovered in Trihedral VTScada Versions prior to 11.2.26. (no CVSS, Trihedral VTScada) - [CVE-2017-6045](https://cve.now/CVE-2017-6045.md): An Information Exposure issue was discovered in Trihedral VTScada Versions prior to 11.2.26. (no CVSS, Trihedral VTScada) - [CVE-2017-6050](https://cve.now/CVE-2017-6050.md): A SQL Injection issue was discovered in Ecava IntegraXor Versions 5.2.1231.0 and prior. (no CVSS, Ecava IntegraXor) - [CVE-2017-6053](https://cve.now/CVE-2017-6053.md): A Cross-Site Scripting issue was discovered in Trihedral VTScada Versions prior to 11.2.26. (no CVSS, Trihedral VTScada) - [CVE-2017-7918](https://cve.now/CVE-2017-7918.md): An Improper Access Control issue was discovered in Cambium Networks ePMP. (no CVSS, Cambium Networks ePMP) - [CVE-2017-7922](https://cve.now/CVE-2017-7922.md): An Improper Privilege Management issue was discovered in Cambium Networks ePMP. (no CVSS, Cambium Networks ePMP) - [CVE-2017-1117](https://cve.now/CVE-2017-1117.md): IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user to cause a denial of service to the MQXR channel when trace is enabled. (no CVSS, IBM MQ) - [CVE-2017-1304](https://cve.now/CVE-2017-1304.md): IBM has identified a vulnerability with IBM Spectrum Scale/GPFS utilized on the Elastic Storage Server (ESS)/GPFS Storage Server (GSS) durin (no CVSS, IBM Elastic Storage Server) - [CVE-2017-9773](https://cve.now/CVE-2017-9773.md): Denial of Service was found in Horde\_Image 2.x before 2.5.0 via a crafted URL to the "Null" image driver. (no CVSS) - [CVE-2017-9774](https://cve.now/CVE-2017-9774.md): Remote Code Execution was found in Horde\_Image 2.x before 2.5.0 via a crafted GET request. (no CVSS) - [CVE-2017-9781](https://cve.now/CVE-2017-9781.md): A cross site scripting (XSS) vulnerability exists in Check\_MK versions 1.4.0x prior to 1.4.0p6, allowing an unauthenticated remote attacker (no CVSS) - [CVE-2017-9780](https://cve.now/CVE-2017-9780.md): In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for ex (no CVSS) - [CVE-2017-2805](https://cve.now/CVE-2017-2805.md): An exploitable stack-based buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera. (CVSS 9.8, Foscam Indoor IP Camera C1 Series) - [CVE-2017-2827](https://cve.now/CVE-2017-2827.md): An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applica (CVSS 8.8, Foscam Indoor IP Camera C1 Series) - [CVE-2017-2828](https://cve.now/CVE-2017-2828.md): An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applica (CVSS 8.8, Foscam Indoor IP Camera C1 Series) - [CVE-2017-2829](https://cve.now/CVE-2017-2829.md): An exploitable directory traversal vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running appli (CVSS 7.7, Foscam Indoor IP Camera C1 Series) - [CVE-2017-2830](https://cve.now/CVE-2017-2830.md): An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applicati (CVSS 8.1, Foscam Indoor IP Camera C1 Series) - [CVE-2017-2831](https://cve.now/CVE-2017-2831.md): An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applicati (CVSS 9.1, Foscam Indoor IP Camera C1 Series) - [CVE-2017-9129](https://cve.now/CVE-2017-9129.md): The wav\_open\_read function in frontend/input.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to cause a denial of ser (no CVSS) - [CVE-2017-9130](https://cve.now/CVE-2017-9130.md): The faacEncOpen function in libfaac/frame.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to cause a denial of servic (no CVSS) - [CVE-2017-9766](https://cve.now/CVE-2017-9766.md): In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in (no CVSS) - [CVE-2017-9771](https://cve.now/CVE-2017-9771.md): install\\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the database\_username, database\_host, or (no CVSS) - [CVE-2017-9778](https://cve.now/CVE-2017-9778.md): GNU Debugger (GDB) 8.0 and earlier fails to detect a negative length field in a DWARF section. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-06-21 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.