CVEs published July 13, 2017
92 CVEs were published on July 13, 2017: 0 critical, 0 high.
- Published
- 92
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 92
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- phpmyadmin/phpmyadmin
- 6
- IBM Emptoris Strategic Supply Management
- 3
- Apache Software Foundation Apache HTTP Server
- 2
- Apache Software Foundation Apache Struts · org.apache.strut…
- 2
- github.com/bitly/oauth2_proxy
- 2
- mapbox.js · mapbox-rails
- 2
- akeneo/pim-community-dev
- 1
- Android
- 1
- com.typesafe.akka:akka-actor
- 1
- fedmsg
- 1
Medium, low and unrated 92
- CVE-2017-1000001FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on.fedmsg
- CVE-2017-1000002ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting
- CVE-2017-1000003ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application component resu
- CVE-2017-1000004ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email,
- CVE-2017-1000005PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases, tables and columns resulting in potential account take
- CVE-2017-1000006Plotly, Inc.plotly.js
- CVE-2017-1000007txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information ditxaws
- CVE-2017-1000008Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged i
- CVE-2017-1000009Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution.akeneo/pim-community-dev
- CVE-2017-1000010Audacity 2.1.2 through 2.3.2 is vulnerable to Dll HIjacking in the avformat-55.dll resulting arbitrary code execution.
- CVE-2017-1000011MyWebSQL version 3.6 is vulnerable to stored XSS in the database manager component resulting in account takeover or stealing of information
- CVE-2017-1000012MySQL Dumper version 1.24 is vulnerable to stored XSS when displaying the data in the database to the user
- CVE-2017-1000013phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weaknessphpmyadmin/phpmyadmin
- CVE-2017-1000014phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionalityphpmyadmin/phpmyadmin
- CVE-2017-1000015phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parametersphpmyadmin/phpmyadmin
- CVE-2017-1000016A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies.phpmyadmin/phpmyadmin
- CVE-2017-1000017phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL phpmyadmin/phpmyadmin
- CVE-2017-1000018phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table namephpmyadmin/phpmyadmin
- CVE-2017-1000020SYN Flood or FIN Flood attack in ECos 1 and other versions embedded devices results in web Authentication Bypass.
- CVE-2017-1000021LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents.
- CVE-2017-1000022LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalation.
- CVE-2017-1000023LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document.
- CVE-2017-1000024Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting
- CVE-2017-1000025GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulnerable to a
- CVE-2017-1000026Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitmixlib-archive
- CVE-2017-1000027Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user web login function re
- CVE-2017-1000028Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability,
- CVE-2017-1000029Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible to
- CVE-2017-1000030Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure vulnerability, that makes
- CVE-2017-1000031SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the
- CVE-2017-1000032Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parent_id p
- CVE-2017-1000033Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascrip
- CVE-2017-1000034Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code executicom.typesafe.akka:akka-actor
- CVE-2017-1000035Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack
- CVE-2017-1000037RVM automatically loads environment variables from files in $PWD resulting in command execution RVM vulnerable to command injection when aut
- CVE-2017-1000038WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affect
- CVE-2017-1000039Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution
- CVE-2017-1000042Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenamapbox.js · mapbox-rails
- CVE-2017-1000043Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenamapbox.js · mapbox-rails
- CVE-2017-1000044gtk-vnc 0.4.2 and older doesn't check framebuffer boundaries correctly when updating framebuffer which may lead to memory corruption when re
- CVE-2017-1000046Mautic 2.6.1 and earlier fails to set flags on session cookiesmautic/core
- CVE-2017-1000047rbenv (all current versions) is vulnerable to Directory Traversal in the specification of Ruby version resulting in arbitrary code execution
- CVE-2017-1000048the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS.qs
- CVE-2017-1000050JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at le
- CVE-2017-1000051Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attackers to inject arbitrary web s
- CVE-2017-1000052Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow user
- CVE-2017-1000053Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Sess
- CVE-2017-1000054Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.
- CVE-2017-1000056Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability tok8s.io/kubernetes
- CVE-2017-1000058Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data parser.
- CVE-2017-1000059Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any
- CVE-2017-1000060EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root
- CVE-2017-1000061xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible informat
- CVE-2017-1000062kittoframework kitto 0.5.1 is vulnerable to directory traversal in the router resulting in remote code execution
- CVE-2017-1000063kittoframework kitto version 0.5.1 is vulnerable to an XSS in the 404 page resulting in information disclosure
- CVE-2017-1000064kittoframework kitto version 0.5.1 is vulnerable to memory exhaustion in the router resulting in DoS
- CVE-2017-1000065Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Management(Users) functionalit
- CVE-2017-1000066The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in the
- CVE-2017-1000067MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in amodx/revolution
- CVE-2017-1000068TestTrack Server versions 1.0 and earlier are vulnerable to an authentication flaw in the split disablement feature resulting in the ability
- CVE-2017-1000069CSRF in Bitly oauth2_proxy 2.1 during authentication flowgithub.com/bitly/oauth2_proxy
- CVE-2017-1000070The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-lgithub.com/bitly/oauth2_proxy
- CVE-2017-1000071Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against a
- CVE-2017-1000072Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravity_value resulting potentially leading to modification of unexpected mem
- CVE-2017-1000073Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary code execution.
- CVE-2017-1000074Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the string_repeat() function.
- CVE-2017-1000075Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the memcmp function
- CVE-2017-1000078Linux foundation ONOS 1.9 is vulnerable to XSS in the device.
- CVE-2017-1000079Linux foundation ONOS 1.9.0 is vulnerable to a DoS.
- CVE-2017-1000080Linux foundation ONOS 1.9.0 allows unauthenticated use of websockets.
- CVE-2017-1000081Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code execution.
- CVE-2017-1000362The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key.org.jenkins-ci.main:jenkins-core
- CVE-2017-1000363Linux drivers/char/lp.c Out-of-Bounds Write.
- CVE-2017-11311soundlib/Load_psm.cpp in OpenMPT through 1.26.12.00 and libopenmpt before 0.2.8461-beta26 has a heap buffer overflow with the potential for
- CVE-2017-11310The read_user_chunk_callback function in coders\png.c in ImageMagick 7.0.6-1 Q16 2017-06-21 (beta) has memory leak vulnerabilities via craft
- CVE-2017-6249An elevation of privilege vulnerability in the NVIDIA sound driver could enable a local malicious application to execute arbitrary code withAndroid
- CVE-2017-9788In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initiApache Software Foundation Apache HTTP Server
- CVE-2017-9789When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has beenApache Software Foundation Apache HTTP Server
- CVE-2016-6019IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site scripting.IBM Emptoris Strategic Supply Management
- CVE-2016-8951IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to a denial of service attack.IBM Emptoris Strategic Supply Management
- CVE-2016-8952IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site scripting.IBM Emptoris Strategic Supply Management
- CVE-2016-8964IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentialsIBM BigFix Inventory
- CVE-2017-1308IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not hIBM Daeja ViewONE
- CVE-2017-7672If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will Apache Software Foundation Apache Struts · org.apache.strut…
- CVE-2017-9787When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack.Apache Software Foundation Apache Struts · org.apache.strut…
- CVE-2017-11103Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in
- CVE-2017-7529Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resultinnginx
- CVE-2017-11173Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests.rack-cors
- CVE-2017-11198Cross-site scripting (XSS) vulnerability in /application/lib/ajax/get_image.php in FineCMS through 2017-07-12 allows remote attackers to inj
- CVE-2017-11200SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitor_ip parameter.
- CVE-2017-11201application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to conduct XSS attacks by uploading
- CVE-2017-11202FineCMS through 2017-07-12 allows XSS in visitors.php because JavaScript in visited URLs is not restricted either during logging or during t