CVEs published July 14, 2017
72 CVEs were published on July 14, 2017: 5 critical, 12 high.
- Published
- 72
- Critical
- 5
- High
- 12
- Medium
- 3
- Low
- 0
- Unrated
- 52
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Juniper Networks Junos OS
- 15
- Apache Software Foundation Apache OpenMeetings · org.apache…
- 11
- Juniper Networks ScreenOS
- 5
- Adobe Connect 9.6.1 and earlier.
- 3
- Adobe Flash Player 26.0.0.131 and earlier.
- 3
- IBM Tivoli Monitoring
- 3
- Microsoft ChakraCore
- 3
- Tomoki Fuke Encrypted files in self-decryption format creat…
- 3
- Tomoki Fuke FileCapsule Deluxe Portable
- 3
- Hammock AssetView for MacOS
- 2
Critical 5
- CVE-2017-10601Junos OS: Insufficient authentication for user login when a specific system configuration error occurs.Juniper Networks Junos OS
- CVE-2017-2336ScreenOS: XSS vulnerability in ScreenOS FirewallJuniper Networks ScreenOS
- CVE-2017-2343SRX Series: Hardcoded credentials in Integrated UserFW feature.Juniper Networks Junos OS
- CVE-2017-2345Junos: snmpd denial of service upon receipt of crafted SNMP packetJuniper Networks Junos OS
- CVE-2017-2349SRX Series: Command injection vulnerability in SRX IDP feature.Juniper Networks Junos OS
High 12
- CVE-2017-10602Junos OS: buffer overflow vulnerability in Junos CLIJuniper Networks Junos OS
- CVE-2017-10603Junos OS: Local XML Injection through CLI command can lead to privilege escalationJuniper Networks Junos OS
- CVE-2017-10605Junos: SRX Series denial of service vulnerability in flowd due to crafted DHCP packetJuniper Networks Junos OS
- CVE-2017-2314Junos: RPD crash due to malformed BGP OPEN messageJuniper Networks Junos OS
- CVE-2017-2335ScreenOS: XSS vulnerability in ScreenOS FirewallJuniper Networks ScreenOS
- CVE-2017-2337ScreenOS: XSS vulnerability in ScreenOS FirewallJuniper Networks ScreenOS
- CVE-2017-2338ScreenOS: XSS vulnerability in ScreenOS FirewallJuniper Networks ScreenOS
- CVE-2017-2339ScreenOS: XSS vulnerability in ScreenOS FirewallJuniper Networks ScreenOS
- CVE-2017-2341Junos OS: VM to host privilege escalation in platforms with Junos OS running in a virtualized environment.Juniper Networks Junos OS
- CVE-2017-2342SRX Series: MACsec failure to report errorsJuniper Networks Junos OS
- CVE-2017-2344Junos: Buffer overflow in sockets libraryJuniper Networks Junos OS
- CVE-2017-2348Junos OS: jdhcpd daemon crash due to invalid IPv6 UDP packetsJuniper Networks Junos OS
Medium, low and unrated 55
- CVE-2015-0249The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute
- CVE-2015-5152Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows re
- CVE-2016-0764Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red
- CVE-2016-4982authd sets weak permissions for /etc/ident.key, which allows local users to obtain the key by leveraging a race condition between the creati
- CVE-2016-4984/usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to
- CVE-2016-4996discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in t
- CVE-2016-6312The mod_dontdothat component of the mod_dav_svn Apache module in Subversion as packaged in Red Hat Enterprise Linux 5.11 does not properly d
- CVE-2016-6793The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infi
- CVE-2017-0028A remote code execution vulnerability exists when Microsoft scripting engine improperly accesses objects in memory.Microsoft ChakraCore
- CVE-2017-0152A remote code execution vulnerability exists in the way affected Microsoft scripting engine render when handling objects in memory in MicrosMicrosoft ChakraCore
- CVE-2017-0196An information disclosure vulnerability in Microsoft scripting engine allows remote attackers to obtain sensitive information from process mMicrosoft ChakraCore
- CVE-2016-10398Android 6.0 has an authentication bypass for attackers with root and physical access.
- CVE-2017-11329GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of inte
- CVE-2017-2240Directory traversal vulnerability in AssetView for MacOS Ver.9.2.0 and earlier versions allows remote attackers to read arbitrary files via Hammock AssetView for MacOS
- CVE-2017-2241SQL injection vulnerability in the AssetView for MacOS Ver.9.2.0 and earlier versions allows remote attackers to execute arbitrary SQL commaHammock AssetView for MacOS
- CVE-2017-2246Untrusted search path vulnerability in Installer of Lhaz version 2.4.0 and earlier allows an attacker to gain privileges via a Trojan horse Chitora soft Installer of Lhaz
- CVE-2017-2247Untrusted search path vulnerability in Self-extracting archive files created by Lhaz version 2.4.0 and earlier allows an attacker to gain prChitora soft Self-extracting archive files created by Lhaz
- CVE-2017-2248Untrusted search path vulnerability in Installer of Lhaz+ version 3.4.0 and earlier allows an attacker to gain privileges via a Trojan horseChitora soft Installer of Lhaz+
- CVE-2017-2249Untrusted search path vulnerability in Self-extracting archive files created by Lhaz+ version 3.4.0 and earlier allows an attacker to gain pChitora soft Self-extracting archive files created by Lhaz+
- CVE-2017-2252Untrusted search path vulnerability in self-extracting archive files created by File Compact Ver.5 version 5.10 and earlier, Ver.6 version 6SOURCENEXT Self-extracting archive files created by File Co…
- CVE-2017-2253Untrusted search path vulnerability in Installer of Yahoo! Toolbar (for Internet explorer) v8.0.0.6 and earlier, with its timestamp prior toYahoo Japan Installer of Yahoo! Toolbar
- CVE-2017-2265Untrusted search path vulnerability in FileCapsule Deluxe Portable Ver.1.0.4.1 and earlier allows an attacker to gain privileges via a TrojaTomoki Fuke FileCapsule Deluxe Portable
- CVE-2017-2266Untrusted search path vulnerability in Encrypted files in self-decryption format created by FileCapsule Deluxe Portable Ver.1.0.4.1 and earlTomoki Fuke Encrypted files in self-decryption format creat…
- CVE-2017-2267Untrusted search path vulnerability in FileCapsule Deluxe Portable Ver.1.0.5.1 and earlier allows an attacker to gain privileges via a TrojaTomoki Fuke FileCapsule Deluxe Portable
- CVE-2017-2268Untrusted search path vulnerability in Encrypted files in self-decryption format created by FileCapsule Deluxe Portable Ver.1.0.5.1 and earlTomoki Fuke Encrypted files in self-decryption format creat…
- CVE-2017-2269Untrusted search path vulnerability in FileCapsule Deluxe Portable Ver.2.0.9 and earlier allows an attacker to gain privileges via a Trojan Tomoki Fuke FileCapsule Deluxe Portable
- CVE-2017-2270Untrusted search path vulnerability in Encrypted files in self-decryption format created by FileCapsule Deluxe Portable Ver.2.0.9 and earlieTomoki Fuke Encrypted files in self-decryption format creat…
- CVE-2017-2271Untrusted search path vulnerability in Self-extracting encrypted files created by AttacheCase ver.2.8.3.0 and earlier allows an attacker to HiBARA Software Self-extracting encrypted files created by…
- CVE-2017-2272Untrusted search path vulnerability in Self-extracting encrypted files created by AttacheCase ver.3.2.2.6 and earlier allows an attacker to HiBARA Software Self-extracting encrypted files created by…
- CVE-2017-7663Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0.Apache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2017-7664Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0.Apache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2017-7666Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks.Apache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2017-7673Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auApache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2017-7680Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file.Apache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2017-7681Apache OpenMeetings 1.0.0 is vulnerable to SQL injection.Apache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2017-7682Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas.Apache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2017-7683Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure.Apache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2017-7684Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded.Apache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2017-7685Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH.Apache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2017-7688Apache OpenMeetings 1.0.0 updates user password in insecure manner.Apache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2017-10604Junos OS: SRX Series: Cluster configuration sync failures occur if the root user account is locked outJuniper Networks Junos OS
- CVE-2017-2346MS-MPC or MS-MIC crash when passing large fragmented traffic through an ALGJuniper Networks Junos OS
- CVE-2017-2347Junos: Denial of Service vulnerability in rpd daemonJuniper Networks Junos OS
- CVE-2017-1181IBM Tivoli Monitoring Portal V6 client could allow a local attacker to gain elevated privileges for IBM Tivoli Monitoring, caused by the defIBM Tivoli Monitoring
- CVE-2017-1182IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to execute arbitrary commands on the system, when default clIBM Tivoli Monitoring
- CVE-2017-1183IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to modify SQL commands to the Portal Server, when default clIBM Tivoli Monitoring
- CVE-2017-11318Cobian Backup 11 client allows man-in-the-middle attackers to add and execute new backup tasks when the master server is spoofed.
- CVE-2017-11328Heap buffer overflow in the yr_object_array_set_item() function in object.c in YARA 3.x allows a denial-of-service attack by scanning a craf
- CVE-2017-3080Adobe Flash Player versions 26.0.0.131 and earlier have a security bypass vulnerability related to the Flash API used by Internet Explorer.Adobe Flash Player 26.0.0.131 and earlier.
- CVE-2017-3099Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 3 raster data moAdobe Flash Player 26.0.0.131 and earlier.
- CVE-2017-3100Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData claAdobe Flash Player 26.0.0.131 and earlier.
- CVE-2017-3101Adobe Connect versions 9.6.1 and earlier have a clickjacking vulnerability.Adobe Connect 9.6.1 and earlier.
- CVE-2017-3102Adobe Connect versions 9.6.1 and earlier have a reflected cross-site scripting vulnerability.Adobe Connect 9.6.1 and earlier.
- CVE-2017-3103Adobe Connect versions 9.6.1 and earlier have a stored cross-site scripting vulnerability.Adobe Connect 9.6.1 and earlier.
- CVE-2017-9814cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) because of mis