CVEs published August 2, 2017
68 CVEs were published on August 2, 2017: 0 critical, 0 high.
- Published
- 68
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 67
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- IBM InfoSphere Information Server
- 4
- I-O DATA DEVICE WN-AX1167GR
- 3
- WAM!NET Japan K.K. GigaCC OFFICE
- 2
- Claybird LhaForge
- 1
- Frogman Office CS-Cart Japanese Edition · Frogman Office CS…
- 1
- I-O DATA DEVICE WN-G300R3
- 1
- IBM Security AppScan Enterprise
- 1
- IBM WebSphere MQ
- 1
- IID RBB SPEED TEST App for Android · IID RBB SPEED TEST App…
- 1
- Kiri Tween
- 1
Medium, low and unrated 68
- CVE-2017-11383SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x1b07 due to lack of proper user input
- CVE-2017-11384SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due to lack of proper user input
- CVE-2017-11385SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x6b1b due to lack of proper user input
- CVE-2017-11386SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input
- CVE-2017-11387Authentication Bypass in Trend Micro Control Manager 6.0 causes Information Disclosure when authentication validation is not done for functi
- CVE-2017-11388SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate u
- CVE-2017-11389Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files
- CVE-2017-11390XML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lead to information disclosure.
- CVE-2012-5030Cisco IOS before 15.2(4)S6 does not initialize an unspecified variable, which might allow remote authenticated users to cause a denial of se
- CVE-2014-8903IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10 and 6.0.5 before 6.0.5.6 allows remote authenticated use
- CVE-2015-0194XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote a
- CVE-2015-0839The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) makes it easier for man-in-the-middle attackers to execute arbitrary code by
- CVE-2015-1174Session fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and earlier allows remote attackers to hijack we
- CVE-2015-2560Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an a
- CVE-2015-2690Multiple cross-site scripting (XSS) vulnerabilities in views/add-license-form.php in the Digium Addons module (digiumaddoninstaller) before
- CVE-2015-3642The TLS and DTLS processing functionality in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway devices with firmw
- CVE-2015-5203Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (cr
- CVE-2015-7891Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with Android L(5.0/5.1) al
- CVE-2015-8264Untrusted search path vulnerability in F-Secure Online Scanner allows remote attackers to execute arbitrary code and conduct DLL hijacking a
- CVE-2017-10664qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by
- CVE-2017-10806Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU
- CVE-2017-11334The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of
- CVE-2017-11355Multiple cross-site scripting (XSS) vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web scri
- CVE-2017-11356The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privil
- CVE-2017-11437GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a proj
- CVE-2017-11438GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create
- CVE-2017-7642The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local users to gain root priv
- CVE-2017-7890The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.
- CVE-2017-8390The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attacke
- CVE-2017-9244Cross-site scripting (XSS) vulnerability in the Trello app before 4.0.8 for iOS might allow remote attackers to inject arbitrary web script
- CVE-2017-9247Multiple unquoted service path vulnerabilities in Sierra Wireless Windows Mobile Broadband Driver Package (MBDP) with build ID < 4657 allows
- CVE-2017-9459Cross-site scripting (XSS) vulnerability in the management web interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.
- CVE-2017-9467Cross-site scripting (XSS) vulnerability in the GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.
- CVE-2017-9769A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a
- CVE-2017-9770A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse that can cause an out of bounds read operation to occur due
- CVE-2016-9981IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session.IBM Security AppScan Enterprise
- CVE-2017-1118IBM WebSphere MQ Internet Pass-Thru 2.0 and 2.1 could allow n attacker to cause the MQIPT to stop responding due to an incorrectly configureIBM WebSphere MQ
- CVE-2017-1383IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML dataIBM InfoSphere Information Server
- CVE-2017-1467A network layer security vulnerability in InfoSphere Information Server 9.1, 11.3, and 11.5 can lead to privilege escalation or unauthorizedIBM InfoSphere Information Server
- CVE-2017-1468IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a local user to gain elevated privileges by placing arbitrary files in insIBM InfoSphere Information Server
- CVE-2017-1495IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a privileged user to cause a memory dump that could contain highly sensitiIBM InfoSphere Information Server
- CVE-2016-7812The Bank of Tokyo-Mitsubishi UFJ, Ltd.The Bank of Tokyo-Mitsubishi UFJ, Ltd. App for Android
- CVE-2016-7844GigaCC OFFICE ver.2.3 and earlier allows remote attackers to execute arbitrary OS commands via specially crafted mail template.WAM!NET Japan K.K. GigaCC OFFICE
- CVE-2016-7845GigaCC OFFICE ver.2.3 and earlier allows remote attackers to upload arbitrary files as a user profile image, which may be exploited for unauWAM!NET Japan K.K. GigaCC OFFICE
- CVE-2017-2138Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor JFrogman Office CS-Cart Japanese Edition · Frogman Office CS…
- CVE-2017-2278The RBB SPEED TEST App for Android version 2.0.3 and earlier, RBB SPEED TEST App for iOS version 2.1.0 and earlier does not verify X.509 cerIID RBB SPEED TEST App for Android · IID RBB SPEED TEST App…
- CVE-2017-2279Untrusted search path vulnerability in Tween Ver1.6.6.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspeKiri Tween
- CVE-2017-2280WN-AX1167GR firmware version 3.00 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute aI-O DATA DEVICE WN-AX1167GR
- CVE-2017-2281WN-AX1167GR firmware version 3.00 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.I-O DATA DEVICE WN-AX1167GR
- CVE-2017-2282Buffer overflow in WN-AX1167GR firmware version 3.00 and earlier allows an attacker to execute arbitrary commands via unspecified vectors.I-O DATA DEVICE WN-AX1167GR
- CVE-2017-2283WN-G300R3 firmware version 1.0.2 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute arI-O DATA DEVICE WN-G300R3
- CVE-2017-2284Cross-site scripting vulnerability in Popup Maker prior to version 1.6.5 allows remote attackers to inject arbitrary web script or HTML via Popup Maker
- CVE-2017-2285Cross-site scripting vulnerability in Simple Custom CSS and JS prior to version 3.4 allows remote attackers to inject arbitrary web script oSilkyPress Simple Custom CSS and JS
- CVE-2017-2286Untrusted search path vulnerability in NFC Port Software Version 5.5.0.6 and earlier (for RC-S310, RC-S320, RC-S330, RC-S370, RC-S380, RC-S3Sony NFC Port Software · Sony PC/SC Activator for Type B +2
- CVE-2017-2287Untrusted search path vulnerability in NFC Port Software remover Ver.1.3.0.1 and earlier allows an attacker to gain privileges via a Trojan Sony NFC Port Software remover
- CVE-2017-2288Untrusted search path vulnerability in LhaForge Ver.1.6.5 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unsClaybird LhaForge
- CVE-2017-11364The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain
- CVE-2017-11494SQL injection vulnerability in SOL.Connect ISET-mpp meter 1.2.4.2 and earlier allows remote attackers to execute arbitrary SQL commands via
- CVE-2017-12138XOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter.
- CVE-2017-12139XOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php.
- CVE-2017-12140The ReadDCMImage function in coders\dcm.c in ImageMagick 7.0.6-1 has an integer signedness error leading to excessive memory consumption via
- CVE-2017-12141In ytnef 1.9.2, a heap-based buffer overflow vulnerability was found in the function TNEFFillMapi in ytnef.c, which allows attackers to caus
- CVE-2017-12142In ytnef 1.9.2, an invalid memory read vulnerability was found in the function SwapDWord in ytnef.c, which allows attackers to cause a denia
- CVE-2017-12143In libquicktime 1.2.4, an allocation failure was found in the function quicktime_read_info in lqt_quicktime.c, which allows attackers to cau
- CVE-2017-12144In ytnef 1.9.2, an allocation failure was found in the function TNEFFillMapi in ytnef.c, which allows attackers to cause a denial of service
- CVE-2017-12145In libquicktime 1.2.4, an allocation failure was found in the function quicktime_read_ftyp in ftyp.c, which allows attackers to cause a deni
- CVE-2017-12199The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue
- CVE-2017-12200The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component.