# CVEs published 2017-06-29

38 CVEs were published on June 29, 2017: 0 critical, 8 high. Days are UTC.

- [CVE-2017-10683](https://cve.now/CVE-2017-10683.md): In mpg123 1.25.0, there is a heap-based buffer over-read in the convert\_latin1 function in libmpg123/id3.c. (no CVSS)
- [CVE-2017-10684](https://cve.now/CVE-2017-10684.md): In ncurses 6.0, there is a stack-based buffer overflow in the fmt\_entry function. (no CVSS)
- [CVE-2017-10685](https://cve.now/CVE-2017-10685.md): In ncurses 6.0, there is a format string vulnerability in the fmt\_entry function. (no CVSS)
- [CVE-2017-10686](https://cve.now/CVE-2017-10686.md): In Netwide Assembler (NASM) 2.14rc0, there are multiple heap use after free vulnerabilities in the tool nasm. (no CVSS)
- [CVE-2017-10687](https://cve.now/CVE-2017-10687.md): In LibSass 3.4.5, there is a heap-based buffer over-read in the function json\_mkstream() in sass\_context.cpp. (no CVSS)
- [CVE-2017-10688](https://cve.now/CVE-2017-10688.md): In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif\_dirwrite.c. (no CVSS)
- [CVE-2017-10678](https://cve.now/CVE-2017-10678.md): Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for re (no CVSS)
- [CVE-2017-10679](https://cve.now/CVE-2017-10679.md): Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redi (no CVSS)
- [CVE-2017-10680](https://cve.now/CVE-2017-10680.md): Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for re (no CVSS)
- [CVE-2017-10681](https://cve.now/CVE-2017-10681.md): Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for re (no CVSS)
- [CVE-2017-10682](https://cve.now/CVE-2017-10682.md): SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via (no CVSS)
- [CVE-2017-2844](https://cve.now/CVE-2017-2844.md): In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can all (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2845](https://cve.now/CVE-2017-2845.md): An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applica (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2846](https://cve.now/CVE-2017-2846.md): In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can all (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2847](https://cve.now/CVE-2017-2847.md): In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can all (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2848](https://cve.now/CVE-2017-2848.md): In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can all (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2849](https://cve.now/CVE-2017-2849.md): In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can all (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2850](https://cve.now/CVE-2017-2850.md): In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can all (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2851](https://cve.now/CVE-2017-2851.md): In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can cau (CVSS 7.5, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-4997](https://cve.now/CVE-2017-4997.md): EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could potential (no CVSS, VASA Provider Virtual Appliance versions 8.3.x and prior)
- [CVE-2017-3747](https://cve.now/CVE-2017-3747.md): Privilege escalation vulnerability in Lenovo Nerve Center for Windows 10 on Desktop systems (Lenovo Nerve Center for notebook systems is not (no CVSS, Lenovo Group Lenovo Nerve Center)
- [CVE-2017-3748](https://cve.now/CVE-2017-3748.md): On Lenovo VIBE mobile phones, improper access controls on the nac\_server component can be abused in conjunction with CVE-2017-3749 and CVE-2 (no CVSS, Lenovo Group Lenovo Vibe and Lenovo China-only Moto Mobile…)
- [CVE-2017-3749](https://cve.now/CVE-2017-3749.md): On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, (no CVSS, Lenovo Group Lenovo Vibe and Lenovo China-only Moto Mobile…)
- [CVE-2017-3750](https://cve.now/CVE-2017-3750.md): On Lenovo VIBE mobile phones, the Lenovo Security Android application allows private data to be backed up and restored via Android Debug Bri (no CVSS, Lenovo Group Lenovo Vibe and Lenovo China-only Moto Mobile…)
- [CVE-2017-5528](https://cve.now/CVE-2017-5528.md): TIBCO JasperReports Server cross-site vulnerabilities (CVSS 5.7, TIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1)
- [CVE-2017-5529](https://cve.now/CVE-2017-5529.md): TIBCO JasperReports Library Information Disclosure (CVSS 4.1, TIBCO Software TIBCO JasperReports Library Community Edi… +5)
- [CVE-2017-1310](https://cve.now/CVE-2017-1310.md): IBM Informix Dynamic Server 12.1 could allow an authenticated user to cause a buffer overflow that would write large assertion fail files to (no CVSS, IBM Informix Servers)
- [CVE-2017-8554](https://cve.now/CVE-2017-8554.md): The kernel in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windo (no CVSS, Microsoft Microsof Windows)
- [CVE-2017-8558](https://cve.now/CVE-2017-8558.md): The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on 32-bit versions of Microsoft Windows Server (no CVSS, Microsoft Malware Protection Engine)
- [CVE-2017-8575](https://cve.now/CVE-2017-8575.md): The kernel in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information vi (no CVSS, Microsoft Windows)
- [CVE-2017-8576](https://cve.now/CVE-2017-8576.md): The graphics component in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to run arbit (no CVSS, Microsoft Windows)
- [CVE-2017-8579](https://cve.now/CVE-2017-8579.md): The DirectX component in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to run arbitr (no CVSS, Microsoft Windows)
- [CVE-2017-8613](https://cve.now/CVE-2017-8613.md): Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access (no CVSS, Microsoft Azure AD Connect)
- [CVE-2017-10671](https://cve.now/CVE-2017-10671.md): Heap-based Buffer Overflow in the de\_dotdot function in libhttpd.c in sthttpd before 2.27.1 allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2017-10672](https://cve.now/CVE-2017-10672.md): Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the argumen (no CVSS)
- [CVE-2017-10673](https://cve.now/CVE-2017-10673.md): admin/profile.php in GetSimple CMS 3.x has XSS in a name field. (no CVSS)
- [CVE-2016-10042](https://cve.now/CVE-2016-10042.md): Authorization Bypass in the Web interface of Arcadyan SLT-00 Star\* (aka Swisscom Internet-Box) devices before R7.7 allows unauthorized recon (no CVSS)
- [CVE-2017-10667](https://cve.now/CVE-2017-10667.md): In index.php in Zen Cart 1.6.0, the products\_id parameter can cause XSS. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-06-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.