# CVEs published 2017-07-24

37 CVEs were published on July 24, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-6118](https://cve.now/CVE-2016-6118.md): IBM Emptoris Supplier Lifecycle Management 10.1.0.x is vulnerable to cross-site scripting. (no CVSS, IBM Emptoris Supplier Lifecycle Management)
- [CVE-2016-8975](https://cve.now/CVE-2016-8975.md): IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Rhapsody Design Manager)
- [CVE-2017-1245](https://cve.now/CVE-2017-1245.md): IBM Rational Software Architect Design Manager 5.0 and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Rhapsody Design Manager)
- [CVE-2017-1249](https://cve.now/CVE-2017-1249.md): IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Rhapsody Design Manager)
- [CVE-2017-1287](https://cve.now/CVE-2017-1287.md): IBM Rhapsody DM 5.0 and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (no CVSS, IBM Rational Rhapsody Design Manager)
- [CVE-2017-1380](https://cve.now/CVE-2017-1380.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. (no CVSS, IBM WebSphere Application Server)
- [CVE-2017-1382](https://cve.now/CVE-2017-1382.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 might create files using the default permissions instead of the customized permissio (no CVSS, IBM WebSphere Application Server)
- [CVE-2017-9553](https://cve.now/CVE-2017-9553.md): A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to bypass the encrypti (no CVSS)
- [CVE-2017-9554](https://cve.now/CVE-2017-9554.md): An information exposure vulnerability in forget\_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers (no CVSS)
- [CVE-2017-8036](https://cve.now/CVE-2017-8036.md): An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 (only). (no CVSS, Cloud Controller API CAPI-release)
- [CVE-2015-1847](https://cve.now/CVE-2015-1847.md): Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally i (no CVSS)
- [CVE-2015-2279](https://cve.now/CVE-2015-2279.md): cgi\_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to (no CVSS)
- [CVE-2015-2280](https://cve.now/CVE-2015-2280.md): snwrite.cgi in AirLink101 SkyIPCam1620W Wireless N MPEG4 3GPP network camera with firmware FW\_AIC1620W\_1.1.0-12\_20120709\_r1192.pck allows re (no CVSS)
- [CVE-2015-7703](https://cve.now/CVE-2015-7703.md): The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote c (no CVSS)
- [CVE-2017-10711](https://cve.now/CVE-2017-10711.md): In SimpleRisk 20170614-001, a CSRF attack on reset.php (aka the Send Password Reset Email form) can insert XSS sequences via the user parame (no CVSS)
- [CVE-2017-11324](https://cve.now/CVE-2017-11324.md): An issue was discovered in Tilde CMS 1.0.1. (no CVSS)
- [CVE-2017-11325](https://cve.now/CVE-2017-11325.md): An issue was discovered in Tilde CMS 1.0.1. (no CVSS)
- [CVE-2017-11326](https://cve.now/CVE-2017-11326.md): An issue was discovered in Tilde CMS 1.0.1. (no CVSS)
- [CVE-2017-11327](https://cve.now/CVE-2017-11327.md): An issue was discovered in Tilde CMS 1.0.1. (no CVSS)
- [CVE-2017-11422](https://cve.now/CVE-2017-11422.md): Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. (no CVSS, statamic/cms)
- [CVE-2017-11608](https://cve.now/CVE-2017-11608.md): There is a heap-based buffer over-read in the Sass::Prelexer::re\_linebreak function in lexer.cpp in LibSass 3.4.5. (no CVSS)
- [CVE-2017-11600](https://cve.now/CVE-2017-11600.md): net/xfrm/xfrm\_policy.c in the Linux kernel through 4.12.3, when CONFIG\_XFRM\_MIGRATE is enabled, does not ensure that the dir value of xfrm\_u (no CVSS)
- [CVE-2017-11605](https://cve.now/CVE-2017-11605.md): There is a heap based buffer over-read in LibSass 3.4.5, related to address 0xb4803ea1. (no CVSS)
- [CVE-2017-11590](https://cve.now/CVE-2017-11590.md): There is a NULL pointer dereference in the caseless\_hash function in gxps-archive.c in libgxps 0.2.5. (no CVSS)
- [CVE-2017-11592](https://cve.now/CVE-2017-11592.md): There is a Mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote (no CVSS)
- [CVE-2017-11593](https://cve.now/CVE-2017-11593.md): Cross-site scripting (XSS) vulnerability in the Markdown Preview Plus extension before 0.5.7 for Chrome allows remote attackers to inject ar (no CVSS)
- [CVE-2017-11594](https://cve.now/CVE-2017-11594.md): Cross-site scripting (XSS) vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2017-11581](https://cve.now/CVE-2017-11581.md): dayrui FineCms 5.0.9 has Cross Site Scripting (XSS) in admin/Login.php via a payload in the username field that does not begin with a '\<' ch (no CVSS)
- [CVE-2017-11582](https://cve.now/CVE-2017-11582.md): dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php. (no CVSS)
- [CVE-2017-11583](https://cve.now/CVE-2017-11583.md): dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php. (no CVSS)
- [CVE-2017-11584](https://cve.now/CVE-2017-11584.md): dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to (no CVSS)
- [CVE-2017-11585](https://cve.now/CVE-2017-11585.md): dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval In (no CVSS)
- [CVE-2017-11586](https://cve.now/CVE-2017-11586.md): dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php. (no CVSS)
- [CVE-2017-11587](https://cve.now/CVE-2017-11587.md): On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-Ann (no CVSS)
- [CVE-2017-11588](https://cve.now/CVE-2017-11588.md): On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-Ann (no CVSS)
- [CVE-2017-11589](https://cve.now/CVE-2017-11589.md): On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-Ann (no CVSS)
- [CVE-2017-11591](https://cve.now/CVE-2017-11591.md): There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via c (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-07-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.