# CVEs published 2017-07-25

54 CVEs were published on July 25, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-11624](https://cve.now/CVE-2017-11624.md): A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file (no CVSS)
- [CVE-2017-11625](https://cve.now/CVE-2017-11625.md): A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file (no CVSS)
- [CVE-2017-11626](https://cve.now/CVE-2017-11626.md): A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file (no CVSS)
- [CVE-2017-11627](https://cve.now/CVE-2017-11627.md): A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file (no CVSS)
- [CVE-2017-11628](https://cve.now/CVE-2017-11628.md): In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend\_ini\_do\_op() function in Zend/zend (no CVSS)
- [CVE-2016-6133](https://cve.now/CVE-2016-6133.md): Cross-site scripting (XSS) vulnerability in Ektron Content Management System before 9.1.0.184SP3(9.1.0.184.3.127) allows remote attackers to (no CVSS)
- [CVE-2017-9233](https://cve.now/CVE-2017-9233.md): XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite (no CVSS)
- [CVE-2017-6612](https://cve.now/CVE-2017-6612.md): A vulnerability in the gateway GPRS support node (GGSN) of Cisco ASR 5000 Series Aggregation Services Routers 17.3.9.62033 through 21.1.2 co (no CVSS, Cisco ASR 5000 Series Aggregation Services Routers)
- [CVE-2017-6672](https://cve.now/CVE-2017-6672.md): A vulnerability in certain filtering mechanisms of access control lists (ACLs) for Cisco ASR 5000 Series Aggregation Services Routers throug (no CVSS, Cisco ASR 5000 Series Aggregation Services Routers)
- [CVE-2017-6746](https://cve.now/CVE-2017-6746.md): A vulnerability in the web interface of the Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform comm (no CVSS, Cisco Web Security Appliance)
- [CVE-2017-6748](https://cve.now/CVE-2017-6748.md): A vulnerability in the CLI parser of the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to perform command (no CVSS, Cisco Web Security Appliance)
- [CVE-2017-6749](https://cve.now/CVE-2017-6749.md): A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to (no CVSS, Cisco Web Security Appliance)
- [CVE-2017-6750](https://cve.now/CVE-2017-6750.md): A vulnerability in AsyncOS for the Cisco Web Security Appliance (WSA) could allow an unauthenticated, local attacker to log in to the device (no CVSS, Cisco Web Security Appliance)
- [CVE-2017-6751](https://cve.now/CVE-2017-6751.md): A vulnerability in the web proxy functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to (no CVSS, Cisco Web Security Appliance)
- [CVE-2017-6753](https://cve.now/CVE-2017-6753.md): A vulnerability in Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated, remote attacker to e (no CVSS, Cisco WebEx Browser Extension)
- [CVE-2017-6755](https://cve.now/CVE-2017-6755.md): A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning (PCP) Tool could allow an unauthenticated, remote attacker t (no CVSS, Cisco Prime Collaboration Provisioning Tool)
- [CVE-2015-0674](https://cve.now/CVE-2015-0674.md): Cross-site scripting (XSS) vulnerability in the Alert Service of Cisco Cloud Web Security base revision allows remote attackers to inject ar (no CVSS)
- [CVE-2015-0904](https://cve.now/CVE-2015-0904.md): The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote attackers to obtain sen (no CVSS)
- [CVE-2015-1332](https://cve.now/CVE-2015-1332.md): The oxide::JavaScriptDialogManager function in oxide-qt before 1.9.1 as packaged in Ubuntu 15.04 and Ubuntu 14.04 allows remote attackers to (no CVSS)
- [CVE-2015-1417](https://cve.now/CVE-2015-1417.md): The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x before 9.3-STABLE, 9 (no CVSS)
- [CVE-2015-1438](https://cve.now/CVE-2015-1438.md): Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary code with kernel pri (no CVSS)
- [CVE-2015-2798](https://cve.now/CVE-2015-2798.md): SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2015-3149](https://cve.now/CVE-2015-3149.md): The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symli (no CVSS)
- [CVE-2015-3171](https://cve.now/CVE-2015-3171.md): sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive (no CVSS, sosreport)
- [CVE-2015-3243](https://cve.now/CVE-2015-3243.md): rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by reading files in /var/lo (no CVSS)
- [CVE-2015-3278](https://cve.now/CVE-2015-3278.md): The cipherstring parsing code in nss\_compat\_ossl while in multi-keyword mode does not match the expected set of ciphers for a given cipher c (no CVSS)
- [CVE-2015-4035](https://cve.now/CVE-2015-4035.md): scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote (no CVSS)
- [CVE-2015-4462](https://cve.now/CVE-2015-4462.md): Absolute path traversal vulnerability in the file\_manager component of eFront CMS before 3.6.15.5 allows remote authenticated users to read (no CVSS)
- [CVE-2015-4463](https://cve.now/CVE-2015-4463.md): The file\_manager component in eFront CMS before 3.6.15.5 allows remote authenticated users to bypass intended file-upload restrictions by ap (no CVSS)
- [CVE-2015-5187](https://cve.now/CVE-2015-5187.md): Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of excessive web traffi (no CVSS)
- [CVE-2015-5221](https://cve.now/CVE-2015-5221.md): Use-after-free vulnerability in the mif\_process\_cmpt function in libjasper/mif/mif\_cod.c in the JasPer JPEG-2000 library before 1.900.2 allo (no CVSS)
- [CVE-2015-5594](https://cve.now/CVE-2015-5594.md): The sanitize\_string function in ZenPhoto before 1.4.9 utilized the html\_entity\_decode function after input sanitation, which might allow rem (no CVSS)
- [CVE-2015-6585](https://cve.now/CVE-2015-6585.md): hwpapp.dll in Hangul Word Processor allows remote attackers to execute arbitrary code via a crafted heap spray, and by leveraging a "type co (no CVSS)
- [CVE-2015-8013](https://cve.now/CVE-2015-8013.md): s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass a (no CVSS, openpgp)
- [CVE-2016-10401](https://cve.now/CVE-2016-10401.md): ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root accou (no CVSS)
- [CVE-2017-11434](https://cve.now/CVE-2017-11434.md): The dhcp\_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-boun (no CVSS)
- [CVE-2017-11457](https://cve.now/CVE-2017-11457.md): XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrar (no CVSS)
- [CVE-2017-11458](https://cve.now/CVE-2017-11458.md): Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject (no CVSS)
- [CVE-2017-11459](https://cve.now/CVE-2017-11459.md): SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files and consequently execu (no CVSS)
- [CVE-2017-11460](https://cve.now/CVE-2017-11460.md): Cross-site scripting (XSS) vulnerability in the DataArchivingService servlet in SAP NetWeaver Portal 7.4 allows remote attackers to inject a (no CVSS)
- [CVE-2017-8919](https://cve.now/CVE-2017-8919.md): NetApp OnCommand API Services before 1.2P3 logs the LDAP BIND password when a user attempts to log in using the REST API, which allows remot (no CVSS)
- [CVE-2017-9413](https://cve.now/CVE-2017-9413.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the aut (no CVSS)
- [CVE-2017-11614](https://cve.now/CVE-2017-11614.md): MEDHOST Connex contains hard-coded credentials that are used for customer database access. (no CVSS)
- [CVE-2017-11617](https://cve.now/CVE-2017-11617.md): Cross-site scripting (XSS) vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML w (no CVSS)
- [CVE-2017-11566](https://cve.now/CVE-2017-11566.md): AppUse 4.0 allows shell command injection via a proxy field. (no CVSS)
- [CVE-2015-7543](https://cve.now/CVE-2015-7543.md): aRts 1.5.10 and kdelibs3 3.5.10 and earlier do not properly create temporary directories, which allows local users to hijack the IPC by pre- (no CVSS)
- [CVE-2015-8009](https://cve.now/CVE-2015-8009.md): The MWOAuthDataStore::lookup\_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 (no CVSS)
- [CVE-2016-7539](https://cve.now/CVE-2016-7539.md): Memory leak in AcquireVirtualMemory in ImageMagick before 7 allows remote attackers to cause a denial of service (memory consumption) via un (no CVSS)
- [CVE-2017-7980](https://cve.now/CVE-2017-7980.md): Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute (no CVSS)
- [CVE-2017-9457](https://cve.now/CVE-2017-9457.md): Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. (no CVSS)
- [CVE-2017-11499](https://cve.now/CVE-2017-11499.md): Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to ha (no CVSS)
- [CVE-2017-7541](https://cve.now/CVE-2017-7541.md): The brcmf\_cfg80211\_mgmt\_tx function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.12.3 allows (no CVSS, Linux kernel before)
- [CVE-2017-8033](https://cve.now/CVE-2017-8033.md): An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0 and cf-release versio (no CVSS, Cloud Controller API CAPI-release versions prior to v1.35.0…)
- [CVE-2017-8035](https://cve.now/CVE-2017-8035.md): An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and (no CVSS, Cloud Controller)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-07-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.