# CVEs published 2017-07-28 30 CVEs were published on July 28, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-4919](https://cve.now/CVE-2017-4919.md): VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operati (no CVSS, VMware vCenter Server) - [CVE-2015-5191](https://cve.now/CVE-2015-5191.md): VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. (no CVSS, VMware Tools) - [CVE-2017-6251](https://cve.now/CVE-2017-6251.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler where a missing permissions check may allow user (no CVSS, NVIDIA Windows GPU Display Driver) - [CVE-2017-6252](https://cve.now/CVE-2017-6252.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler where a NULL pointer dereference may lead to a d (no CVSS, NVIDIA Windows GPU Display Driver) - [CVE-2017-6253](https://cve.now/CVE-2017-6253.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size (no CVSS) - [CVE-2017-6254](https://cve.now/CVE-2017-6254.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer (no CVSS, NVIDIA Windows GPU Display Driver) - [CVE-2017-6255](https://cve.now/CVE-2017-6255.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where an improp (no CVSS, NVIDIA Windows GPU Display Driver) - [CVE-2017-6256](https://cve.now/CVE-2017-6256.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value p (no CVSS, NVIDIA Windows GPU Display Driver) - [CVE-2017-6257](https://cve.now/CVE-2017-6257.md): NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where a NULL pointer dereference may lead to denial of s (no CVSS, NVIDIA GPU Display Driver) - [CVE-2017-6259](https://cve.now/CVE-2017-6259.md): NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where an incorrect detection and recovery from an invali (no CVSS, NVIDIA GPU Display Driver) - [CVE-2017-6260](https://cve.now/CVE-2017-6260.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer helper function where an incorrect calculation of string (no CVSS, NVIDIA Windows GPU Display Driver) - [CVE-2017-11720](https://cve.now/CVE-2017-11720.md): There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file. (no CVSS) - [CVE-2017-11693](https://cve.now/CVE-2017-11693.md): MEDHOST Document Management System contains hard-coded credentials that are used for customer database access. (no CVSS) - [CVE-2017-11694](https://cve.now/CVE-2017-11694.md): MEDHOST Document Management System contains hard-coded credentials that are used for Apache Solr access. (no CVSS) - [CVE-2017-11722](https://cve.now/CVE-2017-11722.md): The WriteOnePNGImage function in coders/png.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (out-of-bounds r (no CVSS) - [CVE-2017-11183](https://cve.now/CVE-2017-11183.md): front/backup.php in GLPI before 9.1.5 allows remote authenticated administrators to delete arbitrary files via a crafted file parameter. (no CVSS) - [CVE-2017-11184](https://cve.now/CVE-2017-11184.md): SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter. (no CVSS) - [CVE-2017-11645](https://cve.now/CVE-2017-11645.md): NetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 do not require authentication for logfile.html (no CVSS) - [CVE-2017-11646](https://cve.now/CVE-2017-11646.md): NetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 are vulnerable to CSRF attacks, as demonstrate (no CVSS) - [CVE-2017-11647](https://cve.now/CVE-2017-11647.md): NetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 are vulnerable to stored cross-site scripting (no CVSS) - [CVE-2017-11703](https://cve.now/CVE-2017-11703.md): A memory leak vulnerability was found in the function parseSWF\_DOACTION in util/parser.c in Ming 0.4.8, which allows attackers to cause a de (no CVSS) - [CVE-2017-11704](https://cve.now/CVE-2017-11704.md): A heap-based buffer over-read was found in the function decompileIF in util/decompile.c in Ming 0.4.8, which allows attackers to cause a den (no CVSS) - [CVE-2017-11705](https://cve.now/CVE-2017-11705.md): A memory leak was found in the function parseSWF\_SHAPEWITHSTYLE in util/parser.c in Ming 0.4.8, which allows attackers to cause a denial of (no CVSS) - [CVE-2017-11706](https://cve.now/CVE-2017-11706.md): The Boozt Fashion application before 2.3.4 for Android allows remote attackers to read login credentials by sniffing the network and leverag (no CVSS) - [CVE-2017-11714](https://cve.now/CVE-2017-11714.md): psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a deni (no CVSS) - [CVE-2017-11715](https://cve.now/CVE-2017-11715.md): job/uploadfile\_save.php in MetInfo through 5.3.17 blocks the .php extension but not related extensions, which might allow remote authenticat (no CVSS) - [CVE-2017-11716](https://cve.now/CVE-2017-11716.md): MetInfo through 5.3.17 allows stored XSS via HTML Edit Mode. (no CVSS) - [CVE-2017-11717](https://cve.now/CVE-2017-11717.md): MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended chal (no CVSS) - [CVE-2017-11718](https://cve.now/CVE-2017-11718.md): There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php. (no CVSS) - [CVE-2017-11719](https://cve.now/CVE-2017-11719.md): The dnxhd\_decode\_header function in libavcodec/dnxhddec.c in FFmpeg 3.0 through 3.3.2 allows remote attackers to cause a denial of service ( (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-07-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.