# CVEs published 2017-07-17

58 CVEs were published on July 17, 2017: 0 critical, 9 high. 8 are now in CISA KEV. Days are UTC.

- [CVE-2017-6736](https://cve.now/CVE-2017-6736.md): The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow (CVSS 8.8, KEV, Cisco IOS · IntelliShield Universal Product)
- [CVE-2017-6737](https://cve.now/CVE-2017-6737.md): A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to r (CVSS 8.8, KEV, Cisco IOS)
- [CVE-2017-6738](https://cve.now/CVE-2017-6738.md): The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow (CVSS 8.8, KEV, Cisco IOS)
- [CVE-2017-6739](https://cve.now/CVE-2017-6739.md): A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to r (CVSS 8.8, KEV, IntelliShield Universal Product)
- [CVE-2017-6740](https://cve.now/CVE-2017-6740.md): The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow (CVSS 8.8, KEV, Cisco IOS · IntelliShield Universal Product)
- [CVE-2017-6741](https://cve.now/CVE-2017-6741.md): A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to r (CVSS 8.8, Cisco IOS XE Software · IntelliShield Universal Product)
- [CVE-2017-6742](https://cve.now/CVE-2017-6742.md): A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to r (CVSS 8.8, KEV, Cisco IOS XE Software · IntelliShield Universal Product)
- [CVE-2017-6743](https://cve.now/CVE-2017-6743.md): The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow (CVSS 8.8, KEV, Cisco IOS · IntelliShield Universal Product)
- [CVE-2017-6744](https://cve.now/CVE-2017-6744.md): The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow (CVSS 8.8, KEV, Cisco IOS · IntelliShield Universal Product)
- [CVE-2017-7947](https://cve.now/CVE-2017-7947.md): NetApp Clustered Data ONTAP before 8.3.2P11, 9.0 before P4, and 9.1 before P5 allow attackers to obtain sensitive password information by le (no CVSS)
- [CVE-2017-8896](https://cve.now/CVE-2017-8896.md): ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by inj (no CVSS)
- [CVE-2017-9338](https://cve.now/CVE-2017-9338.md): Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6 (no CVSS)
- [CVE-2017-9339](https://cve.now/CVE-2017-9339.md): A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. (no CVSS)
- [CVE-2017-9340](https://cve.now/CVE-2017-9340.md): An attacker is logged in as a normal user and can somehow make admin to delete shared folders in ownCloud Server before 10.0.2. (no CVSS)
- [CVE-2017-9609](https://cve.now/CVE-2017-9609.md): Cross-site scripting (XSS) vulnerability in Blackcat CMS 1.2 allows remote authenticated users to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2017-9669](https://cve.now/CVE-2017-9669.md): A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution by (no CVSS)
- [CVE-2017-9671](https://cve.now/CVE-2017-9671.md): A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution, by (no CVSS)
- [CVE-2017-9810](https://cve.now/CVE-2017-9810.md): There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Crit (no CVSS)
- [CVE-2017-9811](https://cve.now/CVE-2017-9811.md): The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critic (no CVSS)
- [CVE-2017-9812](https://cve.now/CVE-2017-9812.md): The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server (no CVSS)
- [CVE-2017-9813](https://cve.now/CVE-2017-9813.md): In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptName parameter of the (no CVSS)
- [CVE-2017-9933](https://cve.now/CVE-2017-9933.md): Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents. (no CVSS)
- [CVE-2017-9934](https://cve.now/CVE-2017-9934.md): Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability. (no CVSS)
- [CVE-2017-11127](https://cve.now/CVE-2017-11127.md): Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header. (no CVSS, bolt/bolt)
- [CVE-2017-11128](https://cve.now/CVE-2017-11128.md): Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry. (no CVSS, bolt/bolt)
- [CVE-2017-11399](https://cve.now/CVE-2017-11399.md): Integer overflow in the ape\_decode\_frame function in libavcodec/apedec.c in FFmpeg 2.4 through 3.3.2 allows remote attackers to cause a deni (no CVSS)
- [CVE-2017-3742](https://cve.now/CVE-2017-3742.md): In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two sy (no CVSS, Lenovo Group Lenovo Connect2)
- [CVE-2017-3754](https://cve.now/CVE-2017-3754.md): Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. (no CVSS, Lenovo Group Lenovo Notebook BIOS)
- [CVE-2017-9639](https://cve.now/CVE-2017-9639.md): An issue was discovered in Fuji Electric V-Server Version 3.3.22.0 and prior. (no CVSS, Fuji Electric V-Server)
- [CVE-2017-10978](https://cve.now/CVE-2017-10978.md): An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make\_secret()" and a denial of ser (no CVSS)
- [CVE-2017-10979](https://cve.now/CVE-2017-10979.md): An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in rad\_coalesce()" - this allows remote attackers to cause a denia (no CVSS)
- [CVE-2017-10980](https://cve.now/CVE-2017-10980.md): An FR-GV-203 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in decode\_tlv()" and a denial of service. (no CVSS)
- [CVE-2017-10981](https://cve.now/CVE-2017-10981.md): An FR-GV-204 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in fr\_dhcp\_decode()" and a denial of service. (no CVSS)
- [CVE-2017-10982](https://cve.now/CVE-2017-10982.md): An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr\_dhcp\_decode\_options()" and a denial of service. (no CVSS)
- [CVE-2017-10983](https://cve.now/CVE-2017-10983.md): An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "DHCP - Read overflow when decoding option 63" and a denial (no CVSS)
- [CVE-2017-10984](https://cve.now/CVE-2017-10984.md): An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in data2vp\_wimax()" - this allows remote attackers to cause a deni (no CVSS)
- [CVE-2017-10985](https://cve.now/CVE-2017-10985.md): An FR-GV-302 issue in FreeRADIUS 3.x before 3.0.15 allows "Infinite loop and memory exhaustion with 'concat' attributes" and a denial of ser (no CVSS)
- [CVE-2017-10986](https://cve.now/CVE-2017-10986.md): An FR-GV-303 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Infinite read in dhcp\_attr2vp()" and a denial of service. (no CVSS)
- [CVE-2017-10987](https://cve.now/CVE-2017-10987.md): An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Buffer over-read in fr\_dhcp\_decode\_suboptions()" and a denial of service. (no CVSS)
- [CVE-2017-11361](https://cve.now/CVE-2017-11361.md): Inteno routers have a JUCI ACL misconfiguration that allows the "user" account to read files, write to files, and add root SSH keys via JSON (no CVSS)
- [CVE-2017-2642](https://cve.now/CVE-2017-2642.md): Moodle 3.x has user fullname disclosure on the user preferences page. (no CVSS, moodle/moodle)
- [CVE-2017-7531](https://cve.now/CVE-2017-7531.md): In Moodle 3.3, the course overview block reveals activities in hidden courses. (no CVSS, moodle/moodle)
- [CVE-2017-7532](https://cve.now/CVE-2017-7532.md): In Moodle 3.x, course creators are able to change system default settings for courses. (no CVSS, moodle/moodle)
- [CVE-2017-8000](https://cve.now/CVE-2017-8000.md): In EMC RSA Authentication Manager 8.2 SP1 and earlier, a malicious RSA Security Console Administrator could craft a token profile and store (no CVSS, RSA Authentication Manager 8.2 SP1 and earlier)
- [CVE-2017-8004](https://cve.now/CVE-2017-8004.md): The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance and RSA IMG products (RSA Identity Governance and Lifecycle (no CVSS, RSA Identity Governance and Lifecycle, RSA Via Lifecycle an…)
- [CVE-2017-8005](https://cve.now/CVE-2017-8005.md): The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG products (RSA Identity Governance and Lifecycle (no CVSS, RSA Identity Governance and Lifecycle, RSA Via Lifecycle an…)
- [CVE-2017-8006](https://cve.now/CVE-2017-8006.md): In EMC RSA Authentication Manager 8.2 SP1 Patch 1 and earlier, a malicious user logged into the Self-Service Console of RSA Authentication M (no CVSS, RSA Authentication Manager 8.2 SP1 Patch 1 and earlier)
- [CVE-2017-8011](https://cve.now/CVE-2017-8011.md): EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX (no CVSS, EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R)
- [CVE-2017-8034](https://cve.now/CVE-2017-8034.md): The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, C (no CVSS, Cloud Foundry)
- [CVE-2017-11367](https://cve.now/CVE-2017-11367.md): The shoco\_decompress function in the API in shoco through 2017-07-17 allows remote attackers to cause a denial of service (buffer over-read (no CVSS)
- [CVE-2017-11354](https://cve.now/CVE-2017-11354.md): Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/app\_article/sys\_article.php via the name parameter in editing or adding a t (no CVSS)
- [CVE-2017-11360](https://cve.now/CVE-2017-11360.md): The ReadRLEImage function in coders\\rle.c in ImageMagick 7.0.6-1 has a large loop vulnerability via a crafted rle file that triggers a huge (no CVSS)
- [CVE-2017-11362](https://cve.now/CVE-2017-11362.md): In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformat\_parse.c does not restrict the locale length, which allows remo (no CVSS)
- [CVE-2017-9951](https://cve.now/CVE-2017-9951.md): The try\_read\_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation f (no CVSS)
- [CVE-2017-11352](https://cve.now/CVE-2017-11352.md): In ImageMagick before 7.0.5-10, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c. (no CVSS)
- [CVE-2017-11353](https://cve.now/CVE-2017-11353.md): yadm (yet another dotfile manager) 1.10.0 has a race condition (related to the behavior of git commands in setting permissions for new files (no CVSS)
- [CVE-2017-11348](https://cve.now/CVE-2017-11348.md): In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted (no CVSS)
- [CVE-2017-11349](https://cve.now/CVE-2017-11349.md): dataTaker DT8x dEX 1.72.007 allows remote attackers to compose programs or schedules, for purposes such as sending e-mail messages or making (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-07-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.