# CVEs published 2017-07-18 28 CVEs were published on July 18, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-11406](https://cve.now/CVE-2017-11406.md): In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the DOCSIS dissector could go into an infinite loop. (no CVSS) - [CVE-2017-11407](https://cve.now/CVE-2017-11407.md): In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the MQ dissector could crash. (no CVSS) - [CVE-2017-11408](https://cve.now/CVE-2017-11408.md): In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. (no CVSS) - [CVE-2017-11409](https://cve.now/CVE-2017-11409.md): In Wireshark 2.0.0 to 2.0.13, the GPRS LLC dissector could go into a large loop. (no CVSS) - [CVE-2017-11410](https://cve.now/CVE-2017-11410.md): In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an infinite loop, triggered by packet injection or a (no CVSS) - [CVE-2017-11411](https://cve.now/CVE-2017-11411.md): In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the openSAFETY dissector could crash or exhaust system memory. (no CVSS) - [CVE-2017-10708](https://cve.now/CVE-2017-10708.md): An issue was discovered in Apport through 2.20.x. (no CVSS) - [CVE-2017-11423](https://cve.now/CVE-2017-11423.md): The cabd\_read\_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers t (no CVSS) - [CVE-2017-11421](https://cve.now/CVE-2017-11421.md): gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the "Bad Taste" issue. (no CVSS) - [CVE-2017-5246](https://cve.now/CVE-2017-5246.md): Biscom Secure File Transfer is vulnerable to AngularJS expression injection in the Display Name field. (no CVSS, Biscom Secure File Transfer) - [CVE-2017-5247](https://cve.now/CVE-2017-5247.md): Biscom Secure File Transfer is vulnerable to cross-site scripting in the File Name field. (no CVSS, Biscom Secure File Transfer) - [CVE-2017-7506](https://cve.now/CVE-2017-7506.md): spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages from authenticated attac (no CVSS, The SPICE Project spice) - [CVE-2017-10961](https://cve.now/CVE-2017-10961.md): REDCap before 7.5.1 has CSRF in the deletion feature of the File Repository and File Upload components. (no CVSS) - [CVE-2017-10962](https://cve.now/CVE-2017-10962.md): REDCap before 7.5.1 has XSS via the query string. (no CVSS) - [CVE-2017-6320](https://cve.now/CVE-2017-6320.md): A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1 (no CVSS) - [CVE-2017-1318](https://cve.now/CVE-2017-1318.md): IBM MQ Appliance 8.0 and 9.0 could allow an authenticated messaging administrator to execute arbitrary commands on the system, caused by com (no CVSS, IBM MQ Appliance) - [CVE-2017-11412](https://cve.now/CVE-2017-11412.md): Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app\_comment/controller/comment\_status.php via $\_GET\['id'\]. (no CVSS) - [CVE-2017-11413](https://cve.now/CVE-2017-11413.md): Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app\_article/controller/comment\_status.php via $\_GET\['id'\]. (no CVSS) - [CVE-2017-11414](https://cve.now/CVE-2017-11414.md): Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app\_comment/sys\_comment.php via $\_POST\['comment'\], $\_POST\['name'\], $\_POST\['web'\], $\_POST\['ema (no CVSS) - [CVE-2017-11415](https://cve.now/CVE-2017-11415.md): Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app\_article/sys\_article.php via $\_POST\['parent\_id'\], $\_POST\['desc'\], $\_POST\['keys'\], and $\_PO (no CVSS) - [CVE-2017-11416](https://cve.now/CVE-2017-11416.md): Fiyo CMS 2.0.7 has SQL injection in /apps/app\_comment/controller/insert.php via the name parameter. (no CVSS) - [CVE-2017-11417](https://cve.now/CVE-2017-11417.md): Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app\_article/controller/article\_status.php via $\_GET\['id'\]. (no CVSS) - [CVE-2017-11418](https://cve.now/CVE-2017-11418.md): Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app\_article/controller/article\_list.php via $\_GET\['cat'\], $\_GET\['user'\], $\_GET\['level'\], and (no CVSS) - [CVE-2017-11419](https://cve.now/CVE-2017-11419.md): Fiyo CMS 2.0.7 has SQL injection in /apps/app\_article/controller/editor.php via $\_POST\['id'\] and $\_POST\['art\_title'\]. (no CVSS) - [CVE-2017-11420](https://cve.now/CVE-2017-11420.md): Stack-based buffer overflow in ASUS\_Discovery.c in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC53 (no CVSS) - [CVE-2017-11403](https://cve.now/CVE-2017-11403.md): The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 has an out-of-order CloseBlob call, resulting in a use-after-free via a c (no CVSS) - [CVE-2017-11404](https://cve.now/CVE-2017-11404.md): In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterfa (no CVSS) - [CVE-2017-11405](https://cve.now/CVE-2017-11405.md): In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/modulei (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-07-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.