# CVEs published 2017-07-10

33 CVEs were published on July 10, 2017: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-5640](https://cve.now/CVE-2017-5640.md): It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemo (no CVSS, Apache Software Foundation Apache Impala)
- [CVE-2017-5652](https://cve.now/CVE-2017-5652.md): During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext e (no CVSS, Apache Software Foundation Apache Impala)
- [CVE-2017-6726](https://cve.now/CVE-2017-6726.md): A vulnerability in the CLI of the Cisco Prime Network Gateway could allow an authenticated, local attacker to retrieve system process inform (no CVSS, Cisco Prime Network Gateway)
- [CVE-2017-6727](https://cve.now/CVE-2017-6727.md): A vulnerability in the Server Message Block (SMB) protocol of Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, re (no CVSS, Cisco Wide Area Application Services)
- [CVE-2017-6728](https://cve.now/CVE-2017-6728.md): A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary code at the root privi (no CVSS, Cisco IOS XR)
- [CVE-2017-6729](https://cve.now/CVE-2017-6729.md): A vulnerability in the Border Gateway Protocol (BGP) processing functionality of the Cisco StarOS operating system for Cisco ASR 5000 Series (no CVSS, Cisco StarOS)
- [CVE-2017-6730](https://cve.now/CVE-2017-6730.md): A vulnerability in the web-based GUI of Cisco Wide Area Application Services (WAAS) Central Manager could allow an unauthenticated, remote a (no CVSS, Cisco Wide Area Application Services)
- [CVE-2017-6731](https://cve.now/CVE-2017-6731.md): A vulnerability in Multicast Source Discovery Protocol (MSDP) ingress packet processing for Cisco IOS XR Software could allow an unauthentic (no CVSS, Cisco IOS XR)
- [CVE-2017-6732](https://cve.now/CVE-2017-6732.md): A vulnerability in the installation procedure for Cisco Prime Network Software could allow an authenticated, local attacker to elevate their (no CVSS, Cisco Prime Network)
- [CVE-2017-6733](https://cve.now/CVE-2017-6733.md): A vulnerability in the web-based application interface of the Cisco Identity Services Engine (ISE) portal could allow an unauthenticated, re (no CVSS, Cisco Identity Services Engine)
- [CVE-2017-6734](https://cve.now/CVE-2017-6734.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote (no CVSS, Cisco Identity Services Engine)
- [CVE-2017-6735](https://cve.now/CVE-2017-6735.md): A vulnerability in the backup and restore functionality of Cisco FireSIGHT System Software could allow an authenticated, local attacker to e (no CVSS, Cisco FireSIGHT System Software)
- [CVE-2017-8032](https://cve.now/CVE-2017-8032.md): In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions (no CVSS, Cloud Foundry · org.cloudfoundry.identity:cloudfoundry-iden…)
- [CVE-2017-7175](https://cve.now/CVE-2017-7175.md): NfSen before 1.3.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the customfmt parameter (aka the "Cu (no CVSS)
- [CVE-2017-11163](https://cve.now/CVE-2017-11163.md): Cross-site scripting (XSS) vulnerability in aggregate\_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web s (no CVSS)
- [CVE-2017-11166](https://cve.now/CVE-2017-11166.md): The ReadXWDImage function in coders\\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a craf (no CVSS)
- [CVE-2017-7670](https://cve.now/CVE-2017-7670.md): The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. (no CVSS, Apache Software Foundation Apache Traffic Control · github.…)
- [CVE-2017-1284](https://cve.now/CVE-2017-1284.md): IBM WebSphere MQ 9.0.1 and 9.0.2 could allow a local user with ability to run or enable trace, to obtain sensitive information from WebSpher (no CVSS, IBM MQ)
- [CVE-2017-1337](https://cve.now/CVE-2017-1337.md): IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text. (no CVSS, IBM MQ)
- [CVE-2017-1398](https://cve.now/CVE-2017-1398.md): IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing (no CVSS, IBM WebSphere Commerce Enterprise)
- [CVE-2017-9791](https://cve.now/CVE-2017-9791.md): The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message t (CVSS 9.8, KEV, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2016-10397](https://cve.now/CVE-2016-10397.md): In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to byp (no CVSS)
- [CVE-2017-11142](https://cve.now/CVE-2017-11142.md): In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by (no CVSS)
- [CVE-2017-11143](https://cve.now/CVE-2017-11143.md): In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for de (no CVSS)
- [CVE-2017-11144](https://cve.now/CVE-2017-11144.md): In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of th (no CVSS)
- [CVE-2017-11145](https://cve.now/CVE-2017-11145.md): In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib\_meridian parsing code could be use (no CVSS)
- [CVE-2017-11147](https://cve.now/CVE-2017-11147.md): In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash t (no CVSS)
- [CVE-2017-11124](https://cve.now/CVE-2017-11124.md): libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar\_unserialize function in archive.c. (no CVSS)
- [CVE-2017-11125](https://cve.now/CVE-2017-11125.md): libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar\_get\_path function in util.c. (no CVSS)
- [CVE-2017-11126](https://cve.now/CVE-2017-11126.md): The III\_i\_stereo function in libmpg123/layer3.c in mpg123 through 1.25.1 allows remote attackers to cause a denial of service (buffer over-r (no CVSS)
- [CVE-2017-11139](https://cve.now/CVE-2017-11139.md): GraphicsMagick 1.3.26 has double free vulnerabilities in the ReadOneJNGImage() function in coders/png.c. (no CVSS)
- [CVE-2017-11140](https://cve.now/CVE-2017-11140.md): The ReadJPEGImage function in coders/jpeg.c in GraphicsMagick 1.3.26 creates a pixel cache before a successful read of a scanline, which all (no CVSS)
- [CVE-2017-11141](https://cve.now/CVE-2017-11141.md): The ReadMATImage function in coders\\mat.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a craf (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-07-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.