# CVEs published 2017-06-24

7 CVEs were published on June 24, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-9846](https://cve.now/CVE-2017-9846.md): Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move\_folder\_file ca (no CVSS)
- [CVE-2017-9847](https://cve.now/CVE-2017-9847.md): The bdecode function in bdecode.cpp in libtorrent 1.1.3 allows remote attackers to cause a denial of service (heap-based buffer over-read an (no CVSS)
- [CVE-2017-9848](https://cve.now/CVE-2017-9848.md): SQL injection vulnerability in C\_InfoService.asmx in WebServices in Easysite 7.0 could allow remote attackers to execute arbitrary SQL comma (no CVSS)
- [CVE-2017-9836](https://cve.now/CVE-2017-9836.md): Cross-site scripting (XSS) vulnerability in Piwigo 2.9.1 allows remote authenticated administrators to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2017-9831](https://cve.now/CVE-2017-9831.md): An integer overflow vulnerability in the ptp\_unpack\_EOS\_CustomFuncEx function of the ptp-pack.c file of libmtp (version 1.1.12 and below) al (no CVSS)
- [CVE-2017-9832](https://cve.now/CVE-2017-9832.md): An integer overflow vulnerability in ptp-pack.c (ptp\_unpack\_OPL function) of libmtp (version 1.1.12 and below) allows attackers to cause a d (no CVSS)
- [CVE-2017-9833](https://cve.now/CVE-2017-9833.md): /cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root priv (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-06-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.