CVEs published July 19, 2017
30 CVEs were published on July 19, 2017: 0 critical, 0 high.
- Published
- 30
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- IBM BigFix family
- 5
- Apache Software Foundation Apache Sling · org.apache.sli… +1
- 2
- IBM Emptoris Contract Management
- 1
- IBM InfoSphere Master Data Management
- 1
Medium, low and unrated 30
- CVE-2017-11464A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file,
- CVE-2017-11465The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possi
- CVE-2016-6018IBM Emptoris Contract Management 10.0 and 10.1 reveals detailed error messages in certain features that could cause an attacker to gain addiIBM Emptoris Contract Management
- CVE-2017-1203IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications is vulnerable to cross-site scripting.IBM BigFix family
- CVE-2017-1218IBM Tivoli Endpoint Manager is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized IBM BigFix family
- CVE-2017-1219IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data.IBM BigFix family
- CVE-2017-1223IBM Tivoli Endpoint Manager could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM BigFix family
- CVE-2017-1224IBM Tivoli Endpoint Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive infoIBM BigFix family
- CVE-2017-1309IBM InfoSphere Master Data Management Server 11.0 - 11.6 stores user credentials in plain in clear text which can be read by a local user.IBM InfoSphere Master Data Management
- CVE-2017-7977The Screensavercc component in eLux RP before 5.5.0 allows attackers to bypass intended configuration restrictions and execute arbitrary com
- CVE-2016-5394In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictivApache Software Foundation Apache Sling · org.apache.sli… +1
- CVE-2016-6798In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the inpApache Software Foundation Apache Sling · org.apache.sli… +1
- CVE-2016-7507Cross-Site Request Forgery (CSRF) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to
- CVE-2016-7509Cross-site scripting (XSS) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by atta
- CVE-2017-9764Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP
- CVE-2017-10801phpSocial (formerly phpDolphin) before 3.0.1 has XSS in the PATH_INFO to the search/tag/ URI.
- CVE-2017-11435The Humax Wi-Fi Router model HG100R-* 2.0.6 is prone to an authentication bypass vulnerability via specially crafted requests to the managem
- CVE-2017-11436D-Link DIR-615 before v20.12PTb04 has a second admin account with a 0x1 BACKDOOR value, which might allow remote attackers to obtain access
- CVE-2017-11439In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter.
- CVE-2017-11440In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx
- CVE-2017-11441The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33
- CVE-2017-11444Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
- CVE-2017-11445Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.
- CVE-2017-11446The ReadPESImage function in coders\pes.c in ImageMagick 7.0.6-1 has an infinite loop vulnerability that can cause CPU exhaustion via a craf
- CVE-2017-11447The ReadSCREENSHOTImage function in coders/screenshot.c in ImageMagick before 7.0.6-1 has memory leaks, causing denial of service.
- CVE-2017-11448The ReadJPEGImage function in coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to obtain sensitive information from unini
- CVE-2017-11449coders/mpc.c in ImageMagick before 7.0.6-1 does not enable seekable streams and thus cannot validate blob sizes, which allows remote attacke
- CVE-2017-11450coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to cause a denial of service (application crash) or possibly have unspec
- CVE-2017-11456Geneko GWR routers allow directory traversal sequences starting with a /../ substring, as demonstrated by unauthenticated read access to the
- CVE-2017-9245The Google News and Weather application before 3.3.1 for Android allows remote attackers to read OAuth tokens by sniffing the network and le