CVEs published July 24, 2017
37 CVEs were published on July 24, 2017: 0 critical, 0 high.
- Published
- 37
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 37
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- IBM Rational Rhapsody Design Manager
- 4
- IBM WebSphere Application Server
- 2
- Cloud Controller API CAPI-release
- 1
- IBM Emptoris Supplier Lifecycle Management
- 1
- statamic/cms
- 1
Medium, low and unrated 37
- CVE-2016-6118IBM Emptoris Supplier Lifecycle Management 10.1.0.x is vulnerable to cross-site scripting.IBM Emptoris Supplier Lifecycle Management
- CVE-2016-8975IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting.IBM Rational Rhapsody Design Manager
- CVE-2017-1245IBM Rational Software Architect Design Manager 5.0 and 6.0 is vulnerable to cross-site scripting.IBM Rational Rhapsody Design Manager
- CVE-2017-1249IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting.IBM Rational Rhapsody Design Manager
- CVE-2017-1287IBM Rhapsody DM 5.0 and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM Rational Rhapsody Design Manager
- CVE-2017-1380IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting.IBM WebSphere Application Server
- CVE-2017-1382IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 might create files using the default permissions instead of the customized permissioIBM WebSphere Application Server
- CVE-2017-9553A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to bypass the encrypti
- CVE-2017-9554An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers
- CVE-2017-8036An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 (only).Cloud Controller API CAPI-release
- CVE-2015-1847Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally i
- CVE-2015-2279cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to
- CVE-2015-2280snwrite.cgi in AirLink101 SkyIPCam1620W Wireless N MPEG4 3GPP network camera with firmware FW_AIC1620W_1.1.0-12_20120709_r1192.pck allows re
- CVE-2015-7703The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote c
- CVE-2017-10711In SimpleRisk 20170614-001, a CSRF attack on reset.php (aka the Send Password Reset Email form) can insert XSS sequences via the user parame
- CVE-2017-11324An issue was discovered in Tilde CMS 1.0.1.
- CVE-2017-11325An issue was discovered in Tilde CMS 1.0.1.
- CVE-2017-11326An issue was discovered in Tilde CMS 1.0.1.
- CVE-2017-11327An issue was discovered in Tilde CMS 1.0.1.
- CVE-2017-11422Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called.statamic/cms
- CVE-2017-11608There is a heap-based buffer over-read in the Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.4.5.
- CVE-2017-11600net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_u
- CVE-2017-11605There is a heap based buffer over-read in LibSass 3.4.5, related to address 0xb4803ea1.
- CVE-2017-11590There is a NULL pointer dereference in the caseless_hash function in gxps-archive.c in libgxps 0.2.5.
- CVE-2017-11592There is a Mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote
- CVE-2017-11593Cross-site scripting (XSS) vulnerability in the Markdown Preview Plus extension before 0.5.7 for Chrome allows remote attackers to inject ar
- CVE-2017-11594Cross-site scripting (XSS) vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web scrip
- CVE-2017-11581dayrui FineCms 5.0.9 has Cross Site Scripting (XSS) in admin/Login.php via a payload in the username field that does not begin with a '<' ch
- CVE-2017-11582dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php.
- CVE-2017-11583dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php.
- CVE-2017-11584dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to
- CVE-2017-11585dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval In
- CVE-2017-11586dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php.
- CVE-2017-11587On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-Ann
- CVE-2017-11588On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-Ann
- CVE-2017-11589On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-Ann
- CVE-2017-11591There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via c