# CVEs published 2017-07-27

29 CVEs were published on July 27, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-0736](https://cve.now/CVE-2016-0736.md): In Apache HTTP Server versions 2.4.0 to 2.4.23, mod\_session\_crypto was encrypting its data/cookie using the configured ciphers with possibly (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2016-2161](https://cve.now/CVE-2016-2161.md): In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod\_auth\_digest can cause the server to crash, and each instance continue (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2016-8743](https://cve.now/CVE-2016-8743.md): Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response li (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2016-10399](https://cve.now/CVE-2016-10399.md): Sendio versions before 8.2.1 were affected by a Local File Inclusion vulnerability that allowed an unauthenticated, remote attacker to read (no CVSS)
- [CVE-2017-8870](https://cve.now/CVE-2017-8870.md): Buffer overflow in AudioCoder 0.8.46 allows remote attackers to execute arbitrary code via a crafted .m3u file. (no CVSS)
- [CVE-2016-10402](https://cve.now/CVE-2016-10402.md): Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT AUTHORITY\\SYSTEM via a section header with a very large r (no CVSS)
- [CVE-2017-8869](https://cve.now/CVE-2017-8869.md): Buffer overflow in MediaCoder 0.8.48.5888 allows remote attackers to execute arbitrary code via a crafted .m3u file. (no CVSS)
- [CVE-2017-11665](https://cve.now/CVE-2017-11665.md): The ff\_amf\_get\_field\_value function in libavformat/rtmppkt.c in FFmpeg 3.3.2 allows remote RTMP servers to cause a denial of service (Segmen (no CVSS)
- [CVE-2017-11673](https://cve.now/CVE-2017-11673.md): Reporter.exe in Acunetix 8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malforme (no CVSS)
- [CVE-2017-11674](https://cve.now/CVE-2017-11674.md): Reporter.exe in Acunetix 8 allows remote attackers to cause a denial of service (application crash) via a malformed PRE file, related to a " (no CVSS)
- [CVE-2017-11675](https://cve.now/CVE-2017-11675.md): The traverseStrictSanitize function in admin\_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which (no CVSS, zencart/zencart)
- [CVE-2017-11677](https://cve.now/CVE-2017-11677.md): Cross-site scripting (XSS) vulnerability in Hashtopus 1.5g allows remote attackers to inject arbitrary web script or HTML via the query stri (no CVSS)
- [CVE-2017-11678](https://cve.now/CVE-2017-11678.md): SQL injection vulnerability in Hashtopus 1.5g allows remote authenticated users to execute arbitrary SQL commands via the format parameter i (no CVSS)
- [CVE-2017-11679](https://cve.now/CVE-2017-11679.md): Cross-Site Request Forgery (CSRF) exists in Hashtopus 1.5g via the password parameter to admin.php in an a=config action. (no CVSS)
- [CVE-2017-11680](https://cve.now/CVE-2017-11680.md): Cross-Site Request Forgery (CSRF) exists in Hashtopussy 0.4.0, allowing an admin password change via users.php. (no CVSS)
- [CVE-2017-11681](https://cve.now/CVE-2017-11681.md): Incorrect Access Control vulnerability in Hashtopussy 0.4.0 allows remote authenticated users to execute actions that should only be availab (no CVSS)
- [CVE-2017-11682](https://cve.now/CVE-2017-11682.md): Stored Cross-site scripting vulnerability in Hashtopussy 0.4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) ve (no CVSS)
- [CVE-2017-11684](https://cve.now/CVE-2017-11684.md): There is an illegal address access in the build\_table function in libavcodec/bitstream.c of Libav 12.1 that will lead to remote denial of se (no CVSS)
- [CVE-2017-11685](https://cve.now/CVE-2017-11685.md): Multiple Reflective cross-site scripting (XSS) vulnerabilities in search and display of event data in Zoho ManageEngine Event Log Analyzer 1 (no CVSS)
- [CVE-2017-11686](https://cve.now/CVE-2017-11686.md): Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allows remote attackers to obtain an authenticated user's password via XSS vulnerabilitie (no CVSS)
- [CVE-2017-11687](https://cve.now/CVE-2017-11687.md): Multiple Persistent cross-site scripting (XSS) vulnerabilities in Event log parsing and Display functions in Zoho ManageEngine Event Log Ana (no CVSS)
- [CVE-2017-11691](https://cve.now/CVE-2017-11691.md): Cross-site scripting (XSS) vulnerability in auth\_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2017-9258](https://cve.now/CVE-2017-9258.md): The TDStretch::processSamples function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2017-9259](https://cve.now/CVE-2017-9259.md): The TDStretch::acceptNewOverlapLength function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a den (no CVSS)
- [CVE-2017-9260](https://cve.now/CVE-2017-9260.md): The TDStretchSSE::calcCrossCorr function in source/SoundTouch/sse\_optimized.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denia (no CVSS)
- [CVE-2017-9412](https://cve.now/CVE-2017-9412.md): The unpack\_read\_samples function in frontend/get\_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory (no CVSS)
- [CVE-2017-9545](https://cve.now/CVE-2017-9545.md): The next\_text function in src/libmpg123/id3.c in mpg123 1.24.0 allows remote attackers to cause a denial of service (buffer over-read) via a (no CVSS)
- [CVE-2017-9614](https://cve.now/CVE-2017-9614.md): The fill\_input\_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service (invalid memory acc (no CVSS)
- [CVE-2017-11683](https://cve.now/CVE-2017-11683.md): There is a reachable assertion in the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp of Exiv2 0.26 that will lead to a rem (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-07-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.