CVEs published July 25, 2017
54 CVEs were published on July 25, 2017: 0 critical, 0 high.
- Published
- 54
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 54
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Cisco Web Security Appliance
- 5
- Cisco ASR 5000 Series Aggregation Services Routers
- 2
- Cisco Prime Collaboration Provisioning Tool
- 1
- Cisco WebEx Browser Extension
- 1
- Cloud Controller
- 1
- Cloud Controller API CAPI-release versions prior to v1.35.0…
- 1
- Linux kernel before
- 1
- openpgp
- 1
- sosreport
- 1
Medium, low and unrated 54
- CVE-2017-11624A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file
- CVE-2017-11625A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file
- CVE-2017-11626A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file
- CVE-2017-11627A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file
- CVE-2017-11628In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend
- CVE-2016-6133Cross-site scripting (XSS) vulnerability in Ektron Content Management System before 9.1.0.184SP3(9.1.0.184.3.127) allows remote attackers to
- CVE-2017-9233XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite
- CVE-2017-6612A vulnerability in the gateway GPRS support node (GGSN) of Cisco ASR 5000 Series Aggregation Services Routers 17.3.9.62033 through 21.1.2 coCisco ASR 5000 Series Aggregation Services Routers
- CVE-2017-6672A vulnerability in certain filtering mechanisms of access control lists (ACLs) for Cisco ASR 5000 Series Aggregation Services Routers througCisco ASR 5000 Series Aggregation Services Routers
- CVE-2017-6746A vulnerability in the web interface of the Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform commCisco Web Security Appliance
- CVE-2017-6748A vulnerability in the CLI parser of the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to perform command Cisco Web Security Appliance
- CVE-2017-6749A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker toCisco Web Security Appliance
- CVE-2017-6750A vulnerability in AsyncOS for the Cisco Web Security Appliance (WSA) could allow an unauthenticated, local attacker to log in to the deviceCisco Web Security Appliance
- CVE-2017-6751A vulnerability in the web proxy functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to Cisco Web Security Appliance
- CVE-2017-6753A vulnerability in Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated, remote attacker to eCisco WebEx Browser Extension
- CVE-2017-6755A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning (PCP) Tool could allow an unauthenticated, remote attacker tCisco Prime Collaboration Provisioning Tool
- CVE-2015-0674Cross-site scripting (XSS) vulnerability in the Alert Service of Cisco Cloud Web Security base revision allows remote attackers to inject ar
- CVE-2015-0904The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote attackers to obtain sen
- CVE-2015-1332The oxide::JavaScriptDialogManager function in oxide-qt before 1.9.1 as packaged in Ubuntu 15.04 and Ubuntu 14.04 allows remote attackers to
- CVE-2015-1417The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x before 9.3-STABLE, 9
- CVE-2015-1438Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary code with kernel pri
- CVE-2015-2798SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary SQL commands via the
- CVE-2015-3149The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symli
- CVE-2015-3171sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive sosreport
- CVE-2015-3243rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by reading files in /var/lo
- CVE-2015-3278The cipherstring parsing code in nss_compat_ossl while in multi-keyword mode does not match the expected set of ciphers for a given cipher c
- CVE-2015-4035scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote
- CVE-2015-4462Absolute path traversal vulnerability in the file_manager component of eFront CMS before 3.6.15.5 allows remote authenticated users to read
- CVE-2015-4463The file_manager component in eFront CMS before 3.6.15.5 allows remote authenticated users to bypass intended file-upload restrictions by ap
- CVE-2015-5187Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of excessive web traffi
- CVE-2015-5221Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allo
- CVE-2015-5594The sanitize_string function in ZenPhoto before 1.4.9 utilized the html_entity_decode function after input sanitation, which might allow rem
- CVE-2015-6585hwpapp.dll in Hangul Word Processor allows remote attackers to execute arbitrary code via a crafted heap spray, and by leveraging a "type co
- CVE-2015-8013s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass aopenpgp
- CVE-2016-10401ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root accou
- CVE-2017-11434The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-boun
- CVE-2017-11457XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrar
- CVE-2017-11458Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject
- CVE-2017-11459SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files and consequently execu
- CVE-2017-11460Cross-site scripting (XSS) vulnerability in the DataArchivingService servlet in SAP NetWeaver Portal 7.4 allows remote attackers to inject a
- CVE-2017-8919NetApp OnCommand API Services before 1.2P3 logs the LDAP BIND password when a user attempts to log in using the REST API, which allows remot
- CVE-2017-9413Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the aut
- CVE-2017-11614MEDHOST Connex contains hard-coded credentials that are used for customer database access.
- CVE-2017-11617Cross-site scripting (XSS) vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML w
- CVE-2017-11566AppUse 4.0 allows shell command injection via a proxy field.
- CVE-2015-7543aRts 1.5.10 and kdelibs3 3.5.10 and earlier do not properly create temporary directories, which allows local users to hijack the IPC by pre-
- CVE-2015-8009The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11
- CVE-2016-7539Memory leak in AcquireVirtualMemory in ImageMagick before 7 allows remote attackers to cause a denial of service (memory consumption) via un
- CVE-2017-7980Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute
- CVE-2017-9457Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware.
- CVE-2017-11499Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to ha
- CVE-2017-7541The brcmf_cfg80211_mgmt_tx function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.12.3 allows Linux kernel before
- CVE-2017-8033An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0 and cf-release versioCloud Controller API CAPI-release versions prior to v1.35.0…
- CVE-2017-8035An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and Cloud Controller