# CVEs published 2017-07-14

72 CVEs were published on July 14, 2017: 5 critical, 12 high. Days are UTC.

- [CVE-2015-0249](https://cve.now/CVE-2015-0249.md): The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute (no CVSS)
- [CVE-2015-5152](https://cve.now/CVE-2015-5152.md): Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require\_ssl setting is set to true, which allows re (no CVSS)
- [CVE-2016-0764](https://cve.now/CVE-2016-0764.md): Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red (no CVSS)
- [CVE-2016-4982](https://cve.now/CVE-2016-4982.md): authd sets weak permissions for /etc/ident.key, which allows local users to obtain the key by leveraging a race condition between the creati (no CVSS)
- [CVE-2016-4984](https://cve.now/CVE-2016-4984.md): /usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to (no CVSS)
- [CVE-2016-4996](https://cve.now/CVE-2016-4996.md): discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in t (no CVSS)
- [CVE-2016-6312](https://cve.now/CVE-2016-6312.md): The mod\_dontdothat component of the mod\_dav\_svn Apache module in Subversion as packaged in Red Hat Enterprise Linux 5.11 does not properly d (no CVSS)
- [CVE-2016-6793](https://cve.now/CVE-2016-6793.md): The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infi (no CVSS)
- [CVE-2017-0028](https://cve.now/CVE-2017-0028.md): A remote code execution vulnerability exists when Microsoft scripting engine improperly accesses objects in memory. (no CVSS, Microsoft ChakraCore)
- [CVE-2017-0152](https://cve.now/CVE-2017-0152.md): A remote code execution vulnerability exists in the way affected Microsoft scripting engine render when handling objects in memory in Micros (no CVSS, Microsoft ChakraCore)
- [CVE-2017-0196](https://cve.now/CVE-2017-0196.md): An information disclosure vulnerability in Microsoft scripting engine allows remote attackers to obtain sensitive information from process m (no CVSS, Microsoft ChakraCore)
- [CVE-2016-10398](https://cve.now/CVE-2016-10398.md): Android 6.0 has an authentication bypass for attackers with root and physical access. (no CVSS)
- [CVE-2017-11329](https://cve.now/CVE-2017-11329.md): GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity\_restrict parameter that is not a list of inte (no CVSS)
- [CVE-2017-2240](https://cve.now/CVE-2017-2240.md): Directory traversal vulnerability in AssetView for MacOS Ver.9.2.0 and earlier versions allows remote attackers to read arbitrary files via (no CVSS, Hammock AssetView for MacOS)
- [CVE-2017-2241](https://cve.now/CVE-2017-2241.md): SQL injection vulnerability in the AssetView for MacOS Ver.9.2.0 and earlier versions allows remote attackers to execute arbitrary SQL comma (no CVSS, Hammock AssetView for MacOS)
- [CVE-2017-2246](https://cve.now/CVE-2017-2246.md): Untrusted search path vulnerability in Installer of Lhaz version 2.4.0 and earlier allows an attacker to gain privileges via a Trojan horse (no CVSS, Chitora soft Installer of Lhaz)
- [CVE-2017-2247](https://cve.now/CVE-2017-2247.md): Untrusted search path vulnerability in Self-extracting archive files created by Lhaz version 2.4.0 and earlier allows an attacker to gain pr (no CVSS, Chitora soft Self-extracting archive files created by Lhaz)
- [CVE-2017-2248](https://cve.now/CVE-2017-2248.md): Untrusted search path vulnerability in Installer of Lhaz+ version 3.4.0 and earlier allows an attacker to gain privileges via a Trojan horse (no CVSS, Chitora soft Installer of Lhaz+)
- [CVE-2017-2249](https://cve.now/CVE-2017-2249.md): Untrusted search path vulnerability in Self-extracting archive files created by Lhaz+ version 3.4.0 and earlier allows an attacker to gain p (no CVSS, Chitora soft Self-extracting archive files created by Lhaz+)
- [CVE-2017-2252](https://cve.now/CVE-2017-2252.md): Untrusted search path vulnerability in self-extracting archive files created by File Compact Ver.5 version 5.10 and earlier, Ver.6 version 6 (no CVSS, SOURCENEXT Self-extracting archive files created by File Co…)
- [CVE-2017-2253](https://cve.now/CVE-2017-2253.md): Untrusted search path vulnerability in Installer of Yahoo! Toolbar (for Internet explorer) v8.0.0.6 and earlier, with its timestamp prior to (no CVSS, Yahoo Japan Installer of Yahoo! Toolbar)
- [CVE-2017-2265](https://cve.now/CVE-2017-2265.md): Untrusted search path vulnerability in FileCapsule Deluxe Portable Ver.1.0.4.1 and earlier allows an attacker to gain privileges via a Troja (no CVSS, Tomoki Fuke FileCapsule Deluxe Portable)
- [CVE-2017-2266](https://cve.now/CVE-2017-2266.md): Untrusted search path vulnerability in Encrypted files in self-decryption format created by FileCapsule Deluxe Portable Ver.1.0.4.1 and earl (no CVSS, Tomoki Fuke Encrypted files in self-decryption format creat…)
- [CVE-2017-2267](https://cve.now/CVE-2017-2267.md): Untrusted search path vulnerability in FileCapsule Deluxe Portable Ver.1.0.5.1 and earlier allows an attacker to gain privileges via a Troja (no CVSS, Tomoki Fuke FileCapsule Deluxe Portable)
- [CVE-2017-2268](https://cve.now/CVE-2017-2268.md): Untrusted search path vulnerability in Encrypted files in self-decryption format created by FileCapsule Deluxe Portable Ver.1.0.5.1 and earl (no CVSS, Tomoki Fuke Encrypted files in self-decryption format creat…)
- [CVE-2017-2269](https://cve.now/CVE-2017-2269.md): Untrusted search path vulnerability in FileCapsule Deluxe Portable Ver.2.0.9 and earlier allows an attacker to gain privileges via a Trojan (no CVSS, Tomoki Fuke FileCapsule Deluxe Portable)
- [CVE-2017-2270](https://cve.now/CVE-2017-2270.md): Untrusted search path vulnerability in Encrypted files in self-decryption format created by FileCapsule Deluxe Portable Ver.2.0.9 and earlie (no CVSS, Tomoki Fuke Encrypted files in self-decryption format creat…)
- [CVE-2017-2271](https://cve.now/CVE-2017-2271.md): Untrusted search path vulnerability in Self-extracting encrypted files created by AttacheCase ver.2.8.3.0 and earlier allows an attacker to (no CVSS, HiBARA Software Self-extracting encrypted files created by…)
- [CVE-2017-2272](https://cve.now/CVE-2017-2272.md): Untrusted search path vulnerability in Self-extracting encrypted files created by AttacheCase ver.3.2.2.6 and earlier allows an attacker to (no CVSS, HiBARA Software Self-extracting encrypted files created by…)
- [CVE-2017-7663](https://cve.now/CVE-2017-7663.md): Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0. (no CVSS, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2017-7664](https://cve.now/CVE-2017-7664.md): Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0. (no CVSS, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2017-7666](https://cve.now/CVE-2017-7666.md): Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks. (no CVSS, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2017-7673](https://cve.now/CVE-2017-7673.md): Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and au (no CVSS, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2017-7680](https://cve.now/CVE-2017-7680.md): Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. (no CVSS, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2017-7681](https://cve.now/CVE-2017-7681.md): Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. (no CVSS, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2017-7682](https://cve.now/CVE-2017-7682.md): Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas. (no CVSS, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2017-7683](https://cve.now/CVE-2017-7683.md): Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure. (no CVSS, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2017-7684](https://cve.now/CVE-2017-7684.md): Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. (no CVSS, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2017-7685](https://cve.now/CVE-2017-7685.md): Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH. (no CVSS, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2017-7688](https://cve.now/CVE-2017-7688.md): Apache OpenMeetings 1.0.0 updates user password in insecure manner. (no CVSS, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2017-10601](https://cve.now/CVE-2017-10601.md): Junos OS: Insufficient authentication for user login when a specific system configuration error occurs. (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2017-10602](https://cve.now/CVE-2017-10602.md): Junos OS: buffer overflow vulnerability in Junos CLI (CVSS 7.0, Juniper Networks Junos OS)
- [CVE-2017-10603](https://cve.now/CVE-2017-10603.md): Junos OS: Local XML Injection through CLI command can lead to privilege escalation (CVSS 7.0, Juniper Networks Junos OS)
- [CVE-2017-10604](https://cve.now/CVE-2017-10604.md): Junos OS: SRX Series: Cluster configuration sync failures occur if the root user account is locked out (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2017-10605](https://cve.now/CVE-2017-10605.md): Junos: SRX Series denial of service vulnerability in flowd due to crafted DHCP packet (CVSS 8.6, Juniper Networks Junos OS)
- [CVE-2017-2314](https://cve.now/CVE-2017-2314.md): Junos: RPD crash due to malformed BGP OPEN message (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2017-2335](https://cve.now/CVE-2017-2335.md): ScreenOS: XSS vulnerability in ScreenOS Firewall (CVSS 8.4, Juniper Networks ScreenOS)
- [CVE-2017-2336](https://cve.now/CVE-2017-2336.md): ScreenOS: XSS vulnerability in ScreenOS Firewall (CVSS 9.6, Juniper Networks ScreenOS)
- [CVE-2017-2337](https://cve.now/CVE-2017-2337.md): ScreenOS: XSS vulnerability in ScreenOS Firewall (CVSS 8.4, Juniper Networks ScreenOS)
- [CVE-2017-2338](https://cve.now/CVE-2017-2338.md): ScreenOS: XSS vulnerability in ScreenOS Firewall (CVSS 8.4, Juniper Networks ScreenOS)
- [CVE-2017-2339](https://cve.now/CVE-2017-2339.md): ScreenOS: XSS vulnerability in ScreenOS Firewall (CVSS 8.4, Juniper Networks ScreenOS)
- [CVE-2017-2341](https://cve.now/CVE-2017-2341.md): Junos OS: VM to host privilege escalation in platforms with Junos OS running in a virtualized environment. (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2017-2342](https://cve.now/CVE-2017-2342.md): SRX Series: MACsec failure to report errors (CVSS 8.1, Juniper Networks Junos OS)
- [CVE-2017-2343](https://cve.now/CVE-2017-2343.md): SRX Series: Hardcoded credentials in Integrated UserFW feature. (CVSS 10.0, Juniper Networks Junos OS)
- [CVE-2017-2344](https://cve.now/CVE-2017-2344.md): Junos: Buffer overflow in sockets library (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2017-2345](https://cve.now/CVE-2017-2345.md): Junos: snmpd denial of service upon receipt of crafted SNMP packet (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2017-2346](https://cve.now/CVE-2017-2346.md): MS-MPC or MS-MIC crash when passing large fragmented traffic through an ALG (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2017-2347](https://cve.now/CVE-2017-2347.md): Junos: Denial of Service vulnerability in rpd daemon (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2017-2348](https://cve.now/CVE-2017-2348.md): Junos OS: jdhcpd daemon crash due to invalid IPv6 UDP packets (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2017-2349](https://cve.now/CVE-2017-2349.md): SRX Series: Command injection vulnerability in SRX IDP feature. (CVSS 9.9, Juniper Networks Junos OS)
- [CVE-2017-1181](https://cve.now/CVE-2017-1181.md): IBM Tivoli Monitoring Portal V6 client could allow a local attacker to gain elevated privileges for IBM Tivoli Monitoring, caused by the def (no CVSS, IBM Tivoli Monitoring)
- [CVE-2017-1182](https://cve.now/CVE-2017-1182.md): IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to execute arbitrary commands on the system, when default cl (no CVSS, IBM Tivoli Monitoring)
- [CVE-2017-1183](https://cve.now/CVE-2017-1183.md): IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to modify SQL commands to the Portal Server, when default cl (no CVSS, IBM Tivoli Monitoring)
- [CVE-2017-11318](https://cve.now/CVE-2017-11318.md): Cobian Backup 11 client allows man-in-the-middle attackers to add and execute new backup tasks when the master server is spoofed. (no CVSS)
- [CVE-2017-11328](https://cve.now/CVE-2017-11328.md): Heap buffer overflow in the yr\_object\_array\_set\_item() function in object.c in YARA 3.x allows a denial-of-service attack by scanning a craf (no CVSS)
- [CVE-2017-3080](https://cve.now/CVE-2017-3080.md): Adobe Flash Player versions 26.0.0.131 and earlier have a security bypass vulnerability related to the Flash API used by Internet Explorer. (no CVSS, Adobe Flash Player 26.0.0.131 and earlier.)
- [CVE-2017-3099](https://cve.now/CVE-2017-3099.md): Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 3 raster data mo (no CVSS, Adobe Flash Player 26.0.0.131 and earlier.)
- [CVE-2017-3100](https://cve.now/CVE-2017-3100.md): Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData cla (no CVSS, Adobe Flash Player 26.0.0.131 and earlier.)
- [CVE-2017-3101](https://cve.now/CVE-2017-3101.md): Adobe Connect versions 9.6.1 and earlier have a clickjacking vulnerability. (no CVSS, Adobe Connect 9.6.1 and earlier.)
- [CVE-2017-3102](https://cve.now/CVE-2017-3102.md): Adobe Connect versions 9.6.1 and earlier have a reflected cross-site scripting vulnerability. (no CVSS, Adobe Connect 9.6.1 and earlier.)
- [CVE-2017-3103](https://cve.now/CVE-2017-3103.md): Adobe Connect versions 9.6.1 and earlier have a stored cross-site scripting vulnerability. (no CVSS, Adobe Connect 9.6.1 and earlier.)
- [CVE-2017-9814](https://cve.now/CVE-2017-9814.md): cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) because of mis (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-07-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.