# CVEs published 2017-07-03

15 CVEs were published on July 3, 2017: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-7919](https://cve.now/CVE-2017-7919.md): An Improper Authentication issue was discovered in Newport XPS-Cx and XPS-Qx. (no CVSS, Newport XPS-Cx, XPS-Qx)
- [CVE-2017-9248](https://cve.now/CVE-2017-9248.md): Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Te (CVSS 9.8, KEV)
- [CVE-2016-3400](https://cve.now/CVE-2016-3400.md): NetApp Data ONTAP 8.1 and 8.2, when operating in 7-Mode, allows man-in-the-middle attackers to obtain sensitive information, gain privileges (no CVSS)
- [CVE-2016-3997](https://cve.now/CVE-2016-3997.md): NetApp Clustered Data ONTAP allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of servic (no CVSS)
- [CVE-2016-3998](https://cve.now/CVE-2016-3998.md): NetApp AltaVault 4.1 and earlier allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of s (no CVSS)
- [CVE-2016-5045](https://cve.now/CVE-2016-5045.md): NetApp OnCommand System Manager before 9.0 allows remote attackers to obtain sensitive credentials via vectors related to cluster peering se (no CVSS)
- [CVE-2016-6127](https://cve.now/CVE-2016-6127.md): Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the Al (no CVSS)
- [CVE-2016-6201](https://cve.now/CVE-2016-6201.md): Cross-site scripting (XSS) vulnerability in Ektron Content Management System (CMS) before 9.1.0.184 SP3 (9.1.0.184.3.127) allows remote atta (no CVSS)
- [CVE-2017-5361](https://cve.now/CVE-2017-5361.md): Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for se (no CVSS)
- [CVE-2017-5943](https://cve.now/CVE-2017-5943.md): Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information (no CVSS)
- [CVE-2017-5944](https://cve.now/CVE-2017-5944.md): The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remo (no CVSS)
- [CVE-2017-8116](https://cve.now/CVE-2017-8116.md): The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute (no CVSS)
- [CVE-2017-10798](https://cve.now/CVE-2017-10798.md): In ObjectPlanet Opinio before 7.6.4, there is XSS. (no CVSS)
- [CVE-2017-10799](https://cve.now/CVE-2017-10799.md): When GraphicsMagick 1.3.25 processes a DPX image (with metadata indicating a large width) in coders/dpx.c, a denial of service (OOM) can occ (no CVSS)
- [CVE-2017-10800](https://cve.now/CVE-2017-10800.md): When GraphicsMagick 1.3.25 processes a MATLAB image in coders/mat.c, it can lead to a denial of service (OOM) in ReadMATImage() if the size (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-07-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.