# CVEs published 2017-07-19

30 CVEs were published on July 19, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-11464](https://cve.now/CVE-2017-11464.md): A SIGFPE is raised in the function box\_blur\_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, (no CVSS)
- [CVE-2017-11465](https://cve.now/CVE-2017-11465.md): The parser\_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possi (no CVSS)
- [CVE-2016-6018](https://cve.now/CVE-2016-6018.md): IBM Emptoris Contract Management 10.0 and 10.1 reveals detailed error messages in certain features that could cause an attacker to gain addi (no CVSS, IBM Emptoris Contract Management)
- [CVE-2017-1203](https://cve.now/CVE-2017-1203.md): IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications is vulnerable to cross-site scripting. (no CVSS, IBM BigFix family)
- [CVE-2017-1218](https://cve.now/CVE-2017-1218.md): IBM Tivoli Endpoint Manager is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized (no CVSS, IBM BigFix family)
- [CVE-2017-1219](https://cve.now/CVE-2017-1219.md): IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. (no CVSS, IBM BigFix family)
- [CVE-2017-1223](https://cve.now/CVE-2017-1223.md): IBM Tivoli Endpoint Manager could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (no CVSS, IBM BigFix family)
- [CVE-2017-1224](https://cve.now/CVE-2017-1224.md): IBM Tivoli Endpoint Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info (no CVSS, IBM BigFix family)
- [CVE-2017-1309](https://cve.now/CVE-2017-1309.md): IBM InfoSphere Master Data Management Server 11.0 - 11.6 stores user credentials in plain in clear text which can be read by a local user. (no CVSS, IBM InfoSphere Master Data Management)
- [CVE-2017-7977](https://cve.now/CVE-2017-7977.md): The Screensavercc component in eLux RP before 5.5.0 allows attackers to bypass intended configuration restrictions and execute arbitrary com (no CVSS)
- [CVE-2016-5394](https://cve.now/CVE-2016-5394.md): In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictiv (no CVSS, Apache Software Foundation Apache Sling · org.apache.sli… +1)
- [CVE-2016-6798](https://cve.now/CVE-2016-6798.md): In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the inp (no CVSS, Apache Software Foundation Apache Sling · org.apache.sli… +1)
- [CVE-2016-7507](https://cve.now/CVE-2016-7507.md): Cross-Site Request Forgery (CSRF) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to (no CVSS)
- [CVE-2016-7509](https://cve.now/CVE-2016-7509.md): Cross-site scripting (XSS) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by atta (no CVSS)
- [CVE-2017-9764](https://cve.now/CVE-2017-9764.md): Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP (no CVSS)
- [CVE-2017-10801](https://cve.now/CVE-2017-10801.md): phpSocial (formerly phpDolphin) before 3.0.1 has XSS in the PATH\_INFO to the search/tag/ URI. (no CVSS)
- [CVE-2017-11435](https://cve.now/CVE-2017-11435.md): The Humax Wi-Fi Router model HG100R-\* 2.0.6 is prone to an authentication bypass vulnerability via specially crafted requests to the managem (no CVSS)
- [CVE-2017-11436](https://cve.now/CVE-2017-11436.md): D-Link DIR-615 before v20.12PTb04 has a second admin account with a 0x1 BACKDOOR value, which might allow remote attackers to obtain access (no CVSS)
- [CVE-2017-11439](https://cve.now/CVE-2017-11439.md): In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter. (no CVSS)
- [CVE-2017-11440](https://cve.now/CVE-2017-11440.md): In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx (no CVSS)
- [CVE-2017-11441](https://cve.now/CVE-2017-11441.md): The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33 (no CVSS)
- [CVE-2017-11444](https://cve.now/CVE-2017-11444.md): Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $\_GET array. (no CVSS)
- [CVE-2017-11445](https://cve.now/CVE-2017-11445.md): Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $\_POST array. (no CVSS)
- [CVE-2017-11446](https://cve.now/CVE-2017-11446.md): The ReadPESImage function in coders\\pes.c in ImageMagick 7.0.6-1 has an infinite loop vulnerability that can cause CPU exhaustion via a craf (no CVSS)
- [CVE-2017-11447](https://cve.now/CVE-2017-11447.md): The ReadSCREENSHOTImage function in coders/screenshot.c in ImageMagick before 7.0.6-1 has memory leaks, causing denial of service. (no CVSS)
- [CVE-2017-11448](https://cve.now/CVE-2017-11448.md): The ReadJPEGImage function in coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to obtain sensitive information from unini (no CVSS)
- [CVE-2017-11449](https://cve.now/CVE-2017-11449.md): coders/mpc.c in ImageMagick before 7.0.6-1 does not enable seekable streams and thus cannot validate blob sizes, which allows remote attacke (no CVSS)
- [CVE-2017-11450](https://cve.now/CVE-2017-11450.md): coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to cause a denial of service (application crash) or possibly have unspec (no CVSS)
- [CVE-2017-11456](https://cve.now/CVE-2017-11456.md): Geneko GWR routers allow directory traversal sequences starting with a /../ substring, as demonstrated by unauthenticated read access to the (no CVSS)
- [CVE-2017-9245](https://cve.now/CVE-2017-9245.md): The Google News and Weather application before 3.3.1 for Android allows remote attackers to read OAuth tokens by sniffing the network and le (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-07-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.