# CVEs published 2017-07-12 39 CVEs were published on July 12, 2017: 0 critical, 4 high. Days are UTC. - [CVE-2017-11174](https://cve.now/CVE-2017-11174.md): In install/page\_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL (no CVSS) - [CVE-2017-11193](https://cve.now/CVE-2017-11193.md): Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. (no CVSS) - [CVE-2017-11194](https://cve.now/CVE-2017-11194.md): Pulse Connect Secure 8.3R1 has Reflected XSS in adminservercacertdetails.cgi. (no CVSS) - [CVE-2017-11195](https://cve.now/CVE-2017-11195.md): Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. (no CVSS) - [CVE-2017-11196](https://cve.now/CVE-2017-11196.md): Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. (no CVSS) - [CVE-2016-6114](https://cve.now/CVE-2016-6114.md): IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. (no CVSS, IBM Emptoris Sourcing) - [CVE-2016-8946](https://cve.now/CVE-2016-8946.md): IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. (no CVSS, IBM Emptoris Sourcing) - [CVE-2016-8947](https://cve.now/CVE-2016-8947.md): IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (no CVSS, IBM Emptoris Sourcing) - [CVE-2016-8948](https://cve.now/CVE-2016-8948.md): IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. (no CVSS, IBM Emptoris Sourcing) - [CVE-2016-8950](https://cve.now/CVE-2016-8950.md): IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. (no CVSS, IBM Emptoris Sourcing) - [CVE-2016-8953](https://cve.now/CVE-2016-8953.md): IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (no CVSS, IBM Emptoris Sourcing) - [CVE-2017-1285](https://cve.now/CVE-2017-1285.md): IBM WebSphere MQ 9.0.1 and 9.0.2 could allow an authenticated user with authority to send a specially crafted message that would cause a cha (no CVSS, IBM MQ) - [CVE-2017-1321](https://cve.now/CVE-2017-1321.md): IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to cross-site scripting. (no CVSS, IBM InfoSphere Information Server) - [CVE-2017-2814](https://cve.now/CVE-2017-2814.md): An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. (CVSS 7.5, Poppler) - [CVE-2017-2818](https://cve.now/CVE-2017-2818.md): An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. (CVSS 7.5, Poppler) - [CVE-2017-2820](https://cve.now/CVE-2017-2820.md): An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. (CVSS 8.8, Poppler) - [CVE-2017-2863](https://cve.now/CVE-2017-2863.md): An out-of-bounds write vulnerability exists in the PDF parsing functionality of Infix 7.1.5. (CVSS 8.8, Iceni Infix) - [CVE-2017-11189](https://cve.now/CVE-2017-11189.md): unrarlib.c in unrar-free 0.0.1 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash), w (no CVSS) - [CVE-2017-11190](https://cve.now/CVE-2017-11190.md): unrarlib.c in unrar-free 0.0.1, when \_DEBUG\_LOG mode is enabled, might allow remote attackers to cause a denial of service (stack-based buff (no CVSS) - [CVE-2017-9843](https://cve.now/CVE-2017-9843.md): SAP NetWeaver AS ABAP 7.40 allows remote authenticated users with certain privileges to cause a denial of service (process crash) via vector (no CVSS) - [CVE-2017-9844](https://cve.now/CVE-2017-9844.md): SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serial (no CVSS) - [CVE-2017-9845](https://cve.now/CVE-2017-9845.md): disp+work 7400.12.21.30308 in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted D (no CVSS) - [CVE-2017-9977](https://cve.now/CVE-2017-9977.md): AVG AntiVirus for MacOS with scan engine before 4668 might allow remote attackers to bypass malware detection by leveraging failure to scan (no CVSS) - [CVE-2017-11188](https://cve.now/CVE-2017-11188.md): The ReadDPXImage function in coders\\dpx.c in ImageMagick 7.0.6-0 has a large loop vulnerability that can cause CPU exhaustion via a crafted (no CVSS) - [CVE-2017-4052](https://cve.now/CVE-2017-4052.md): Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthent (no CVSS, McAfee Advanced Threat Defense) - [CVE-2017-4053](https://cve.now/CVE-2017-4053.md): Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticat (no CVSS, McAfee Advanced Threat Defense) - [CVE-2017-4054](https://cve.now/CVE-2017-4054.md): Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated (no CVSS, McAfee Advanced Threat Defense) - [CVE-2017-4055](https://cve.now/CVE-2017-4055.md): Exploitation of Authentication vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote (no CVSS, McAfee Advanced Threat Defense) - [CVE-2017-4057](https://cve.now/CVE-2017-4057.md): Privilege Escalation vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authentica (no CVSS, McAfee Advanced Threat Defense) - [CVE-2017-11187](https://cve.now/CVE-2017-11187.md): phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly. (no CVSS) - [CVE-2016-8638](https://cve.now/CVE-2016-8638.md): A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log (no CVSS, ipsilon) - [CVE-2017-11167](https://cve.now/CVE-2017-11167.md): FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', s (no CVSS) - [CVE-2017-7678](https://cve.now/CVE-2017-7678.md): In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a (no CVSS, org.apache.spark:spark-core\_2.11 · org.apache.spark:spark-c…) - [CVE-2017-11165](https://cve.now/CVE-2017-11165.md): dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for th (no CVSS) - [CVE-2017-11178](https://cve.now/CVE-2017-11178.md): In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents an (no CVSS) - [CVE-2017-11179](https://cve.now/CVE-2017-11179.md): FineCMS through 2017-07-11 has stored XSS in route=admin when modifying user information, and in route=register when registering a user acco (no CVSS) - [CVE-2017-11180](https://cve.now/CVE-2017-11180.md): FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in (1) the User-Agent header of an (no CVSS) - [CVE-2017-11181](https://cve.now/CVE-2017-11181.md): In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the Messaging section. (no CVSS) - [CVE-2017-11182](https://cve.now/CVE-2017-11182.md): In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the My Profile section. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-07-12 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.