# CVEs published 2017-07-21

35 CVEs were published on July 21, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-7480](https://cve.now/CVE-2017-7480.md): rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remot (no CVSS, Red Hat rkhunter)
- [CVE-2017-7523](https://cve.now/CVE-2017-7523.md): Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow vulnerability in wcsxfrm/wcsxfrm\_l functions resulting int (no CVSS, Red Hat cygwin)
- [CVE-2017-7540](https://cve.now/CVE-2017-7540.md): rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. (no CVSS, Red Hat rubygem-safemode · safemode)
- [CVE-2017-11519](https://cve.now/CVE-2017-11519.md): passwd\_recovery.lua on the TP-Link Archer C9(UN)\_V2\_160517 allows an attacker to reset the admin password by leveraging a predictable random (no CVSS)
- [CVE-2017-11517](https://cve.now/CVE-2017-11517.md): Stack-based buffer overflow in GCoreServer.exe in the server in Geutebrueck Gcore 1.3.8.42 and 1.4.2.37 allows remote attackers to execute a (no CVSS)
- [CVE-2017-1267](https://cve.now/CVE-2017-1267.md): IBM Security Guardium 10.0 and 10.1 processes patches, image backups and other updates without sufficiently verifying the origin and integri (no CVSS, IBM Security Guardium)
- [CVE-2017-1371](https://cve.now/CVE-2017-1371.md): Builder tools running in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated u (no CVSS, IBM TRIRIGA Application Platform)
- [CVE-2017-1372](https://cve.now/CVE-2017-1372.md): IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 is vulnerable to cross-site scripting. (no CVSS, IBM TRIRIGA Application Platform)
- [CVE-2017-1373](https://cve.now/CVE-2017-1373.md): Reports executed in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated user t (no CVSS, IBM TRIRIGA Application Platform)
- [CVE-2017-1374](https://cve.now/CVE-2017-1374.md): Sensitive data can be exposed in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 that can lead to an attacker gaining unauthorized ac (no CVSS, IBM TRIRIGA Application Platform)
- [CVE-2017-1381](https://cve.now/CVE-2017-1381.md): IBM WebSphere Application Server Proxy Server or On-demand-router (ODR) 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensit (no CVSS, IBM WebSphere Application Server)
- [CVE-2017-11516](https://cve.now/CVE-2017-11516.md): An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug (no CVSS, yiisoft/yii2-dev · yiisoft/yii2)
- [CVE-2017-11505](https://cve.now/CVE-2017-11505.md): The ReadOneJNGImage function in coders/png.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denia (no CVSS)
- [CVE-2017-7542](https://cve.now/CVE-2017-7542.md): The ip6\_find\_1stfragopt function in net/ipv6/output\_core.c in the Linux kernel through 4.12.3 allows local users to cause a denial of servic (no CVSS, Linux kernel versions up to and including)
- [CVE-2015-1323](https://cve.now/CVE-2015-1323.md): The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged (no CVSS)
- [CVE-2015-3170](https://cve.now/CVE-2015-3170.md): selinux-policy when sysctl fs.protected\_hardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by cre (no CVSS)
- [CVE-2015-3198](https://cve.now/CVE-2015-3198.md): The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP (no CVSS, org.wildfly:wildfly-parent)
- [CVE-2015-3421](https://cve.now/CVE-2015-3421.md): The eshop\_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" (no CVSS)
- [CVE-2015-3638](https://cve.now/CVE-2015-3638.md): phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary PHP code by injectin (no CVSS)
- [CVE-2015-3639](https://cve.now/CVE-2015-3639.md): phpMyBackupPro 2.5 and earlier does not properly sanitize input strings, which allows remote authenticated users to execute arbitrary PHP co (no CVSS)
- [CVE-2015-3640](https://cve.now/CVE-2015-3640.md): phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote authenticated users wit (no CVSS)
- [CVE-2015-3886](https://cve.now/CVE-2015-3886.md): libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown (no CVSS)
- [CVE-2015-3931](https://cve.now/CVE-2015-3931.md): Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds: (no CVSS)
- [CVE-2015-3932](https://cve.now/CVE-2015-3932.md): Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Ob (no CVSS)
- [CVE-2015-4639](https://cve.now/CVE-2015-4639.md): Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x befor (no CVSS)
- [CVE-2015-5194](https://cve.now/CVE-2015-5194.md): The log\_config\_command function in ntp\_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd cr (no CVSS)
- [CVE-2015-5195](https://cve.now/CVE-2015-5195.md): ntp\_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted stati (no CVSS)
- [CVE-2015-5219](https://cve.now/CVE-2015-5219.md): The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which (no CVSS)
- [CVE-2015-5300](https://cve.now/CVE-2015-5300.md): The panic\_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseco (no CVSS)
- [CVE-2017-9415](https://cve.now/CVE-2017-9415.md): Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack th (no CVSS)
- [CVE-2017-10993](https://cve.now/CVE-2017-10993.md): Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter i (no CVSS, contao/contao · contao/core-bundle +1)
- [CVE-2017-9930](https://cve.now/CVE-2017-9930.md): Cross-Site Request Forgery (CSRF) exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by a request to aja (no CVSS)
- [CVE-2017-9931](https://cve.now/CVE-2017-9931.md): Cross-Site Scripting (XSS) exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by the action parameter to (no CVSS)
- [CVE-2017-9932](https://cve.now/CVE-2017-9932.md): Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of admin for the admin account. (no CVSS)
- [CVE-2017-9980](https://cve.now/CVE-2017-9980.md): In Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, the "PING" (aka tag\_ipPing) feature within the web interface allows performi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-07-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.