# CVEs published 2017-07-13

92 CVEs were published on July 13, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-1000001](https://cve.now/CVE-2017-1000001.md): FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on. (no CVSS, fedmsg)
- [CVE-2017-1000002](https://cve.now/CVE-2017-1000002.md): ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting (no CVSS)
- [CVE-2017-1000003](https://cve.now/CVE-2017-1000003.md): ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application component resu (no CVSS)
- [CVE-2017-1000004](https://cve.now/CVE-2017-1000004.md): ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, (no CVSS)
- [CVE-2017-1000005](https://cve.now/CVE-2017-1000005.md): PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases, tables and columns resulting in potential account take (no CVSS)
- [CVE-2017-1000006](https://cve.now/CVE-2017-1000006.md): Plotly, Inc. (no CVSS, plotly.js)
- [CVE-2017-1000007](https://cve.now/CVE-2017-1000007.md): txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information di (no CVSS, txaws)
- [CVE-2017-1000008](https://cve.now/CVE-2017-1000008.md): Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged i (no CVSS)
- [CVE-2017-1000009](https://cve.now/CVE-2017-1000009.md): Akeneo PIM CE and EE \<1.6.6, \<1.5.15, \<1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution. (no CVSS, akeneo/pim-community-dev)
- [CVE-2017-1000010](https://cve.now/CVE-2017-1000010.md): Audacity 2.1.2 through 2.3.2 is vulnerable to Dll HIjacking in the avformat-55.dll resulting arbitrary code execution. (no CVSS)
- [CVE-2017-1000011](https://cve.now/CVE-2017-1000011.md): MyWebSQL version 3.6 is vulnerable to stored XSS in the database manager component resulting in account takeover or stealing of information (no CVSS)
- [CVE-2017-1000012](https://cve.now/CVE-2017-1000012.md): MySQL Dumper version 1.24 is vulnerable to stored XSS when displaying the data in the database to the user (no CVSS)
- [CVE-2017-1000013](https://cve.now/CVE-2017-1000013.md): phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2017-1000014](https://cve.now/CVE-2017-1000014.md): phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2017-1000015](https://cve.now/CVE-2017-1000015.md): phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2017-1000016](https://cve.now/CVE-2017-1000016.md): A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2017-1000017](https://cve.now/CVE-2017-1000017.md): phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2017-1000018](https://cve.now/CVE-2017-1000018.md): phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2017-1000020](https://cve.now/CVE-2017-1000020.md): SYN Flood or FIN Flood attack in ECos 1 and other versions embedded devices results in web Authentication Bypass. (no CVSS)
- [CVE-2017-1000021](https://cve.now/CVE-2017-1000021.md): LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents. (no CVSS)
- [CVE-2017-1000022](https://cve.now/CVE-2017-1000022.md): LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalation. (no CVSS)
- [CVE-2017-1000023](https://cve.now/CVE-2017-1000023.md): LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document. (no CVSS)
- [CVE-2017-1000024](https://cve.now/CVE-2017-1000024.md): Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting (no CVSS)
- [CVE-2017-1000025](https://cve.now/CVE-2017-1000025.md): GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulnerable to a (no CVSS)
- [CVE-2017-1000026](https://cve.now/CVE-2017-1000026.md): Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbit (no CVSS, mixlib-archive)
- [CVE-2017-1000027](https://cve.now/CVE-2017-1000027.md): Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user web login function re (no CVSS)
- [CVE-2017-1000028](https://cve.now/CVE-2017-1000028.md): Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, (no CVSS)
- [CVE-2017-1000029](https://cve.now/CVE-2017-1000029.md): Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible to (no CVSS)
- [CVE-2017-1000030](https://cve.now/CVE-2017-1000030.md): Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure vulnerability, that makes (no CVSS)
- [CVE-2017-1000031](https://cve.now/CVE-2017-1000031.md): SQL injection vulnerability in graph\_templates\_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2017-1000032](https://cve.now/CVE-2017-1000032.md): Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parent\_id p (no CVSS)
- [CVE-2017-1000033](https://cve.now/CVE-2017-1000033.md): Wordpress Plugin Vospari Forms version \< 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascrip (no CVSS)
- [CVE-2017-1000034](https://cve.now/CVE-2017-1000034.md): Akka versions \<=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code executi (no CVSS, com.typesafe.akka:akka-actor)
- [CVE-2017-1000035](https://cve.now/CVE-2017-1000035.md): Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack (no CVSS)
- [CVE-2017-1000037](https://cve.now/CVE-2017-1000037.md): RVM automatically loads environment variables from files in $PWD resulting in command execution RVM vulnerable to command injection when aut (no CVSS)
- [CVE-2017-1000038](https://cve.now/CVE-2017-1000038.md): WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affect (no CVSS)
- [CVE-2017-1000039](https://cve.now/CVE-2017-1000039.md): Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution (no CVSS)
- [CVE-2017-1000042](https://cve.now/CVE-2017-1000042.md): Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scena (no CVSS, mapbox.js · mapbox-rails)
- [CVE-2017-1000043](https://cve.now/CVE-2017-1000043.md): Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scena (no CVSS, mapbox.js · mapbox-rails)
- [CVE-2017-1000044](https://cve.now/CVE-2017-1000044.md): gtk-vnc 0.4.2 and older doesn't check framebuffer boundaries correctly when updating framebuffer which may lead to memory corruption when re (no CVSS)
- [CVE-2017-1000046](https://cve.now/CVE-2017-1000046.md): Mautic 2.6.1 and earlier fails to set flags on session cookies (no CVSS, mautic/core)
- [CVE-2017-1000047](https://cve.now/CVE-2017-1000047.md): rbenv (all current versions) is vulnerable to Directory Traversal in the specification of Ruby version resulting in arbitrary code execution (no CVSS)
- [CVE-2017-1000048](https://cve.now/CVE-2017-1000048.md): the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. (no CVSS, qs)
- [CVE-2017-1000050](https://cve.now/CVE-2017-1000050.md): JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2\_encode which failed to check to see if the image contained at le (no CVSS)
- [CVE-2017-1000051](https://cve.now/CVE-2017-1000051.md): Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2017-1000052](https://cve.now/CVE-2017-1000052.md): Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow user (no CVSS)
- [CVE-2017-1000053](https://cve.now/CVE-2017-1000053.md): Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Sess (no CVSS)
- [CVE-2017-1000054](https://cve.now/CVE-2017-1000054.md): Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages. (no CVSS)
- [CVE-2017-1000056](https://cve.now/CVE-2017-1000056.md): Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to (no CVSS, k8s.io/kubernetes)
- [CVE-2017-1000058](https://cve.now/CVE-2017-1000058.md): Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data parser. (no CVSS)
- [CVE-2017-1000059](https://cve.now/CVE-2017-1000059.md): Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any (no CVSS)
- [CVE-2017-1000060](https://cve.now/CVE-2017-1000060.md): EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root (no CVSS)
- [CVE-2017-1000061](https://cve.now/CVE-2017-1000061.md): xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible informat (no CVSS)
- [CVE-2017-1000062](https://cve.now/CVE-2017-1000062.md): kittoframework kitto 0.5.1 is vulnerable to directory traversal in the router resulting in remote code execution (no CVSS)
- [CVE-2017-1000063](https://cve.now/CVE-2017-1000063.md): kittoframework kitto version 0.5.1 is vulnerable to an XSS in the 404 page resulting in information disclosure (no CVSS)
- [CVE-2017-1000064](https://cve.now/CVE-2017-1000064.md): kittoframework kitto version 0.5.1 is vulnerable to memory exhaustion in the router resulting in DoS (no CVSS)
- [CVE-2017-1000065](https://cve.now/CVE-2017-1000065.md): Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Management(Users) functionalit (no CVSS)
- [CVE-2017-1000066](https://cve.now/CVE-2017-1000066.md): The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in the (no CVSS)
- [CVE-2017-1000067](https://cve.now/CVE-2017-1000067.md): MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in a (no CVSS, modx/revolution)
- [CVE-2017-1000068](https://cve.now/CVE-2017-1000068.md): TestTrack Server versions 1.0 and earlier are vulnerable to an authentication flaw in the split disablement feature resulting in the ability (no CVSS)
- [CVE-2017-1000069](https://cve.now/CVE-2017-1000069.md): CSRF in Bitly oauth2\_proxy 2.1 during authentication flow (no CVSS, github.com/bitly/oauth2\_proxy)
- [CVE-2017-1000070](https://cve.now/CVE-2017-1000070.md): The Bitly oauth2\_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-l (no CVSS, github.com/bitly/oauth2\_proxy)
- [CVE-2017-1000071](https://cve.now/CVE-2017-1000071.md): Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against a (no CVSS)
- [CVE-2017-1000072](https://cve.now/CVE-2017-1000072.md): Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravity\_value resulting potentially leading to modification of unexpected mem (no CVSS)
- [CVE-2017-1000073](https://cve.now/CVE-2017-1000073.md): Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary code execution. (no CVSS)
- [CVE-2017-1000074](https://cve.now/CVE-2017-1000074.md): Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the string\_repeat() function. (no CVSS)
- [CVE-2017-1000075](https://cve.now/CVE-2017-1000075.md): Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the memcmp function (no CVSS)
- [CVE-2017-1000078](https://cve.now/CVE-2017-1000078.md): Linux foundation ONOS 1.9 is vulnerable to XSS in the device. (no CVSS)
- [CVE-2017-1000079](https://cve.now/CVE-2017-1000079.md): Linux foundation ONOS 1.9.0 is vulnerable to a DoS. (no CVSS)
- [CVE-2017-1000080](https://cve.now/CVE-2017-1000080.md): Linux foundation ONOS 1.9.0 allows unauthenticated use of websockets. (no CVSS)
- [CVE-2017-1000081](https://cve.now/CVE-2017-1000081.md): Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code execution. (no CVSS)
- [CVE-2017-1000362](https://cve.now/CVE-2017-1000362.md): The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS\_HOME with a new key. (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2017-1000363](https://cve.now/CVE-2017-1000363.md): Linux drivers/char/lp.c Out-of-Bounds Write. (no CVSS)
- [CVE-2017-11311](https://cve.now/CVE-2017-11311.md): soundlib/Load\_psm.cpp in OpenMPT through 1.26.12.00 and libopenmpt before 0.2.8461-beta26 has a heap buffer overflow with the potential for (no CVSS)
- [CVE-2017-11310](https://cve.now/CVE-2017-11310.md): The read\_user\_chunk\_callback function in coders\\png.c in ImageMagick 7.0.6-1 Q16 2017-06-21 (beta) has memory leak vulnerabilities via craft (no CVSS)
- [CVE-2017-6249](https://cve.now/CVE-2017-6249.md): An elevation of privilege vulnerability in the NVIDIA sound driver could enable a local malicious application to execute arbitrary code with (no CVSS, Android)
- [CVE-2017-9788](https://cve.now/CVE-2017-9788.md): In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in \[Proxy-\]Authorization headers of type 'Digest' was not initi (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2017-9789](https://cve.now/CVE-2017-9789.md): When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has been (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2016-6019](https://cve.now/CVE-2016-6019.md): IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site scripting. (no CVSS, IBM Emptoris Strategic Supply Management)
- [CVE-2016-8951](https://cve.now/CVE-2016-8951.md): IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to a denial of service attack. (no CVSS, IBM Emptoris Strategic Supply Management)
- [CVE-2016-8952](https://cve.now/CVE-2016-8952.md): IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site scripting. (no CVSS, IBM Emptoris Strategic Supply Management)
- [CVE-2016-8964](https://cve.now/CVE-2016-8964.md): IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials (no CVSS, IBM BigFix Inventory)
- [CVE-2017-1308](https://cve.now/CVE-2017-1308.md): IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not h (no CVSS, IBM Daeja ViewONE)
- [CVE-2017-7672](https://cve.now/CVE-2017-7672.md): If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will (no CVSS, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2017-9787](https://cve.now/CVE-2017-9787.md): When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. (no CVSS, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2017-11103](https://cve.now/CVE-2017-11103.md): Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in (no CVSS)
- [CVE-2017-7529](https://cve.now/CVE-2017-7529.md): Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resultin (no CVSS, nginx)
- [CVE-2017-11173](https://cve.now/CVE-2017-11173.md): Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. (no CVSS, rack-cors)
- [CVE-2017-11198](https://cve.now/CVE-2017-11198.md): Cross-site scripting (XSS) vulnerability in /application/lib/ajax/get\_image.php in FineCMS through 2017-07-12 allows remote attackers to inj (no CVSS)
- [CVE-2017-11200](https://cve.now/CVE-2017-11200.md): SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitor\_ip parameter. (no CVSS)
- [CVE-2017-11201](https://cve.now/CVE-2017-11201.md): application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to conduct XSS attacks by uploading (no CVSS)
- [CVE-2017-11202](https://cve.now/CVE-2017-11202.md): FineCMS through 2017-07-12 allows XSS in visitors.php because JavaScript in visited URLs is not restricted either during logging or during t (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-07-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.