CVEs published July 21, 2017
35 CVEs were published on July 21, 2017: 0 critical, 0 high.
- Published
- 35
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 35
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- IBM TRIRIGA Application Platform
- 4
- contao/contao · contao/core-bundle +1
- 1
- IBM Security Guardium
- 1
- IBM WebSphere Application Server
- 1
- Linux kernel versions up to and including
- 1
- org.wildfly:wildfly-parent
- 1
- Red Hat cygwin
- 1
- Red Hat rkhunter
- 1
- Red Hat rubygem-safemode · safemode
- 1
- yiisoft/yii2-dev · yiisoft/yii2
- 1
Medium, low and unrated 35
- CVE-2017-7480rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remotRed Hat rkhunter
- CVE-2017-7523Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow vulnerability in wcsxfrm/wcsxfrm_l functions resulting intRed Hat cygwin
- CVE-2017-7540rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax.Red Hat rubygem-safemode · safemode
- CVE-2017-11519passwd_recovery.lua on the TP-Link Archer C9(UN)_V2_160517 allows an attacker to reset the admin password by leveraging a predictable random
- CVE-2017-11517Stack-based buffer overflow in GCoreServer.exe in the server in Geutebrueck Gcore 1.3.8.42 and 1.4.2.37 allows remote attackers to execute a
- CVE-2017-1267IBM Security Guardium 10.0 and 10.1 processes patches, image backups and other updates without sufficiently verifying the origin and integriIBM Security Guardium
- CVE-2017-1371Builder tools running in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated uIBM TRIRIGA Application Platform
- CVE-2017-1372IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 is vulnerable to cross-site scripting.IBM TRIRIGA Application Platform
- CVE-2017-1373Reports executed in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated user tIBM TRIRIGA Application Platform
- CVE-2017-1374Sensitive data can be exposed in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 that can lead to an attacker gaining unauthorized acIBM TRIRIGA Application Platform
- CVE-2017-1381IBM WebSphere Application Server Proxy Server or On-demand-router (ODR) 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensitIBM WebSphere Application Server
- CVE-2017-11516An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug yiisoft/yii2-dev · yiisoft/yii2
- CVE-2017-11505The ReadOneJNGImage function in coders/png.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denia
- CVE-2017-7542The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local users to cause a denial of servicLinux kernel versions up to and including
- CVE-2015-1323The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged
- CVE-2015-3170selinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by cre
- CVE-2015-3198The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSPorg.wildfly:wildfly-parent
- CVE-2015-3421The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart"
- CVE-2015-3638phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary PHP code by injectin
- CVE-2015-3639phpMyBackupPro 2.5 and earlier does not properly sanitize input strings, which allows remote authenticated users to execute arbitrary PHP co
- CVE-2015-3640phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote authenticated users wit
- CVE-2015-3886libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown
- CVE-2015-3931Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:
- CVE-2015-3932Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Ob
- CVE-2015-4639Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x befor
- CVE-2015-5194The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd cr
- CVE-2015-5195ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted stati
- CVE-2015-5219The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which
- CVE-2015-5300The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseco
- CVE-2017-9415Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack th
- CVE-2017-10993Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter icontao/contao · contao/core-bundle +1
- CVE-2017-9930Cross-Site Request Forgery (CSRF) exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by a request to aja
- CVE-2017-9931Cross-Site Scripting (XSS) exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by the action parameter to
- CVE-2017-9932Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of admin for the admin account.
- CVE-2017-9980In Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, the "PING" (aka tag_ipPing) feature within the web interface allows performi