CVEs published July 7, 2017
74 CVEs were published on July 7, 2017: 0 critical, 0 high.
- Published
- 74
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 74
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- RSA Archer
- 5
- Toshiba Lighting & Technology Toshiba Home gateway HEM-GW16…
- 5
- KDDI HOME SPOT CUBE2
- 4
- Cybozu Garoon
- 3
- Schneider Electric Wonderware ArchestrA Logger
- 3
- National Institute for Land and Infrastructure Management D…
- 2
- Nvidia Android
- 2
- W3 Eden WordPress Download Manager
- 2
- 3scale AMP before
- 1
- Acquisition, Technology & Logistics Agency Installer of ele…
- 1
Medium, low and unrated 74
- CVE-2017-7512Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret.3scale AMP before
- CVE-2017-8442Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuratElasticsearch X-Pack Security
- CVE-2017-7660Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled.Apache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2017-11096When SWFTools 0.9.2 processes a crafted file in swfcombine, it can lead to a NULL Pointer Dereference in the swf_DeleteFilter() function in
- CVE-2017-11097When SWFTools 0.9.2 processes a crafted file in swfc, it can lead to a NULL Pointer Dereference in the dict_lookup() function in lib/q.c.
- CVE-2017-11098When SWFTools 0.9.2 processes a crafted file in png2swf, it can lead to a Segmentation Violation in the png_load() function in lib/png.c.
- CVE-2017-11099When SWFTools 0.9.2 processes a crafted file in wav2swf, it can lead to a Segmentation Violation in the wav_convert2mono() function in lib/w
- CVE-2017-11100When SWFTools 0.9.2 processes a crafted file in swfextract, it can lead to a NULL Pointer Dereference in the swf_FoldSprite() function in li
- CVE-2017-11101When SWFTools 0.9.2 processes a crafted file in swfcombine, it can lead to a NULL Pointer Dereference in the swf_Relocate() function in lib/
- CVE-2017-11102The ReadOneJNGImage function in coders/png.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (application cras
- CVE-2014-7953Race condition in the bindBackupAgent method in the ActivityManagerService in Android 4.4.4 allows local users with adb shell access to exec
- CVE-2014-7954Directory traversal vulnerability in the doSendObjectInfo method in frameworks/av/media/mtp/MtpServer.cpp in Android 4.4.4 allows physically
- CVE-2017-1000082systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g.
- CVE-2017-1000381The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the
- CVE-2017-6868An Improper Authentication issue was discovered in Siemens SIMATIC CP 44x-1 RNA, all versions prior to 1.4.1.Siemens SIMATIC CP 44x-1 Redundant Network Access Modules
- CVE-2017-9627An Uncontrolled Resource Consumption issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prSchneider Electric Wonderware ArchestrA Logger
- CVE-2017-9629A Stack-Based Buffer Overflow issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior.Schneider Electric Wonderware ArchestrA Logger
- CVE-2017-9631A Null Pointer Dereference issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior.Schneider Electric Wonderware ArchestrA Logger
- CVE-2015-3297Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by
- CVE-2017-10994Foxit Reader before 8.3.1 and PhantomPDF before 8.3.1 have an Arbitrary Write vulnerability, which allows remote attackers to execute arbitr
- CVE-2017-10995The mng_get_long function in coders/png.c in ImageMagick 7.0.6-0 allows remote attackers to cause a denial of service (heap-based buffer ove
- CVE-2017-0326An information disclosure vulnerability in the NVIDIA Video Driver due to an out-of-bounds read function in the Tegra Display Controller driNvidia Android
- CVE-2017-0340An elevation of privilege vulnerability in the NVIDIA Libnvparser component due to a memcpy into a fixed sized buffer with a user-controlledNvidia Android
- CVE-2017-10965An issue was discovered in Irssi before 1.0.4.
- CVE-2017-10966An issue was discovered in Irssi before 1.0.4.
- CVE-2017-10991The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wps_referrers_page page.
- CVE-2017-2144Cybozu Garoon 3.0.0 to 4.2.4 may allow an attacker to lock another user's file through a specially crafted page.Cybozu Garoon
- CVE-2017-2145Session fixation vulnerability in Cybozu Garoon 4.0.0 to 4.2.4 allows remote attackers to perform arbitrary operations via unspecified vectoCybozu Garoon
- CVE-2017-2146Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.4 allows remote attackers to inject arbitrary web script or HTML via applicCybozu Garoon
- CVE-2017-2172Cross-site scripting vulnerability in Cybozu KUNAI for Android 3.0.0 to 3.0.6 allows remote attackers to inject arbitrary web script or HTMLCybozu KUNAI for Android
- CVE-2017-2183HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via Clock Settings.KDDI HOME SPOT CUBE2
- CVE-2017-2184Buffer overflow in HOME SPOT CUBE2 firmware V101 and earlier allows an attacker to execute arbitrary code via WebUI.KDDI HOME SPOT CUBE2
- CVE-2017-2185HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via WebUI.KDDI HOME SPOT CUBE2
- CVE-2017-2186HOME SPOT CUBE2 firmware V101 and earlier allows an attacker to bypass authentication to load malicious firmware via WebUI.KDDI HOME SPOT CUBE2
- CVE-2017-2188Untrusted search path vulnerability in Installer of Denshinouhin Check System (for Ministry of Agriculture, Forestry and Fisheries Nouson SeMinistry of Agreculture, Foresty and Fishery Installer of D…
- CVE-2017-2194Cross-site scripting vulnerability in Source code security studying tool iCodeChecker allows an attacker to inject arbitrary web script or HINFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) Source…
- CVE-2017-2208Untrusted search path vulnerability in Installer of Electronic tendering and bid opening system available prior to June 12, 2017 allows an aAcquisition, Technology & Logistics Agency Installer of ele…
- CVE-2017-2215Untrusted search path vulnerability in Installer of "Setup file of advance preparation" (jizen_setup.exe) (The version which was available oNational Tax Agency Installer of "Setup file of advance pre…
- CVE-2017-2216Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web scrW3 Eden WordPress Download Manager
- CVE-2017-2217Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary webW3 Eden WordPress Download Manager
- CVE-2017-2218Untrusted search path vulnerability in Installer of QuickTime for Windows allows an attacker to gain privileges via a Trojan horse DLL in anApple Installer of QuickTime for Windows
- CVE-2017-2220Untrusted search path vulnerability in Installer of CASL II simulator (self-extract format) allows an attacker to gain privileges via a TrojINFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) Instal…
- CVE-2017-2222Cross-site scripting vulnerability in WP-Members prior to version 3.1.8 allows remote attackers to inject arbitrary web script or HTML via uChad Butler WP-Members
- CVE-2017-2223Cross-site request forgery (CSRF) vulnerability in TS-WPTCAM, TS-PTCAM, TS-PTCAM/POE, TS-WLC2, TS-WLCE, TS-WRLC firmware version 1.19 and eaI-O DATA DEVICE TS-WPTCAM · I-O DATA DEVICE TS-PTCAM +5
- CVE-2017-2224Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTWeb-Dorado Event Calendar WD
- CVE-2017-2225Untrusted search path vulnerability in EbidSettingChecker.exe (version 1.0.0.0) allows an attacker to gain privileges via a Trojan horse DLLMinistry of Education, Culture, Sports, Science and Technol…
- CVE-2017-2226Untrusted search path vulnerability in Setup file of advance preparation for e-Tax software (WEB version) (1.17.1) and earlier allows an attNational Tax Agency Setup file of advance preparation for e…
- CVE-2017-2227Untrusted search path vulnerability in The installer of Charamin OMP Version 1.1.7.4 and earlier, Version 1.2.0.0 Beta and earlier allows anCharamin steering committee The installer of Charamin OMP
- CVE-2017-2229Untrusted search path vulnerability in Douroshisetu Kihon Data Sakusei System Ver1.0.2 and earlier allows an attacker to gain privileges viaNational Institute for Land and Infrastructure Management D…
- CVE-2017-2230Untrusted search path vulnerability in Douro Kouji Kanseizutou Check Program Ver3.1 (cdrw_checker_3.1.0.lzh) and earlier allows remote attacNational Institute for Land and Infrastructure Management D…
- CVE-2017-2231Untrusted search path vulnerability in The installer of MLIT DenshiSeikabutsuSakuseiShienKensa system Ver3.02 and earlier, distributed till Ministry of Land, Infrastructure, Transport and Tourism, Ja…
- CVE-2017-2232Untrusted search path vulnerability in Installer of Shinseiyo Sogo Soft (4.8A) and earlier allows an attacker to gain privileges via a TrojaThe Ministry of Justice Installer of Shinseiyo Sogo Soft
- CVE-2017-2233Untrusted search path vulnerability in Installer of PDF Digital Signature Plugin (G2.30) and earlier, distributed till June 29, 2017 allows The Ministry of Justice Installer of PDF Digital Signature…
- CVE-2017-2234Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier, Toshiba Home gateway HEM-GW26A firmware HEM-GW26A-FW-V1.2.0 and earToshiba Lighting & Technology Toshiba Home gateway HEM-GW16…
- CVE-2017-2235Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier.Toshiba Lighting & Technology Toshiba Home gateway HEM-GW16…
- CVE-2017-2236Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier, Toshiba Home gateway HEM-GW26A firmware HEM-GW26A-FW-V1.2.0 and earToshiba Lighting & Technology Toshiba Home gateway HEM-GW16…
- CVE-2017-2237Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier.Toshiba Lighting & Technology Toshiba Home gateway HEM-GW16…
- CVE-2017-2238Cross-site request forgery (CSRF) vulnerability in Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier and Toshiba Home Toshiba Lighting & Technology Toshiba Home gateway HEM-GW16…
- CVE-2017-2239Marp versions v0.0.10 and earlier may allow an attacker to access local resources and files using JavaScript.Yuki Hattori Marp
- CVE-2017-2243Cross-site scripting vulnerability in Responsive Lightbox prior to version 1.7.2 allows an attacker to inject arbitrary web script or HTML vdFactory Responsive Lightbox
- CVE-2017-2244Cross-site request forgery (CSRF) vulnerability in MFC-J960DWN firmware ver.D and earlier allows remote attackers to hijack the authenticatiBROTHER INDUSTRIES MFC-J960DWN
- CVE-2017-2245Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspeciVladimir Anokhin Shortcodes Ultimate
- CVE-2017-10989The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blob
- CVE-2017-7404On the D-Link DIR-615 before v20.12PTb04, if a victim logged in to the Router's Web Interface visits a malicious site from another Browser t
- CVE-2017-7405On the D-Link DIR-615 before v20.12PTb04, once authenticated, this device identifies the user based on the IP address of his machine.
- CVE-2017-7406The D-Link DIR-615 device before v20.12PTb04 doesn't use SSL for any of the authenticated pages.
- CVE-2017-10968In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "<?php" i
- CVE-2017-10974Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080.
- CVE-2017-7950Nitro Pro 11.0.3 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted PCX file.
- CVE-2017-4998EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is potentially affected by a cross-site request forgery vulnerability.RSA Archer
- CVE-2017-4999EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an authorization bypass through user-controlled key vulneRSA Archer
- CVE-2017-5000EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an information exposure through an error message vulnerabRSA Archer
- CVE-2017-5001EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an information exposure through an error message vulnerabRSA Archer
- CVE-2017-5002EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an open redirect vulnerability.RSA Archer