# CVEs published 2017-08-02

68 CVEs were published on August 2, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-11383](https://cve.now/CVE-2017-11383.md): SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x1b07 due to lack of proper user input (no CVSS)
- [CVE-2017-11384](https://cve.now/CVE-2017-11384.md): SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due to lack of proper user input (no CVSS)
- [CVE-2017-11385](https://cve.now/CVE-2017-11385.md): SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x6b1b due to lack of proper user input (no CVSS)
- [CVE-2017-11386](https://cve.now/CVE-2017-11386.md): SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input (no CVSS)
- [CVE-2017-11387](https://cve.now/CVE-2017-11387.md): Authentication Bypass in Trend Micro Control Manager 6.0 causes Information Disclosure when authentication validation is not done for functi (no CVSS)
- [CVE-2017-11388](https://cve.now/CVE-2017-11388.md): SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate u (no CVSS)
- [CVE-2017-11389](https://cve.now/CVE-2017-11389.md): Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files (no CVSS)
- [CVE-2017-11390](https://cve.now/CVE-2017-11390.md): XML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lead to information disclosure. (no CVSS)
- [CVE-2012-5030](https://cve.now/CVE-2012-5030.md): Cisco IOS before 15.2(4)S6 does not initialize an unspecified variable, which might allow remote authenticated users to cause a denial of se (no CVSS)
- [CVE-2014-8903](https://cve.now/CVE-2014-8903.md): IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10 and 6.0.5 before 6.0.5.6 allows remote authenticated use (no CVSS)
- [CVE-2015-0194](https://cve.now/CVE-2015-0194.md): XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote a (no CVSS)
- [CVE-2015-0839](https://cve.now/CVE-2015-0839.md): The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) makes it easier for man-in-the-middle attackers to execute arbitrary code by (no CVSS)
- [CVE-2015-1174](https://cve.now/CVE-2015-1174.md): Session fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and earlier allows remote attackers to hijack we (no CVSS)
- [CVE-2015-2560](https://cve.now/CVE-2015-2560.md): Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an a (no CVSS)
- [CVE-2015-2690](https://cve.now/CVE-2015-2690.md): Multiple cross-site scripting (XSS) vulnerabilities in views/add-license-form.php in the Digium Addons module (digiumaddoninstaller) before (no CVSS)
- [CVE-2015-3642](https://cve.now/CVE-2015-3642.md): The TLS and DTLS processing functionality in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway devices with firmw (no CVSS)
- [CVE-2015-5203](https://cve.now/CVE-2015-5203.md): Double free vulnerability in the jasper\_image\_stop\_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (cr (no CVSS)
- [CVE-2015-7891](https://cve.now/CVE-2015-7891.md): Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with Android L(5.0/5.1) al (no CVSS)
- [CVE-2015-8264](https://cve.now/CVE-2015-8264.md): Untrusted search path vulnerability in F-Secure Online Scanner allows remote attackers to execute arbitrary code and conduct DLL hijacking a (no CVSS)
- [CVE-2017-10664](https://cve.now/CVE-2017-10664.md): qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by (no CVSS)
- [CVE-2017-10806](https://cve.now/CVE-2017-10806.md): Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU (no CVSS)
- [CVE-2017-11334](https://cve.now/CVE-2017-11334.md): The address\_space\_write\_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of (no CVSS)
- [CVE-2017-11355](https://cve.now/CVE-2017-11355.md): Multiple cross-site scripting (XSS) vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2017-11356](https://cve.now/CVE-2017-11356.md): The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privil (no CVSS)
- [CVE-2017-11437](https://cve.now/CVE-2017-11437.md): GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a proj (no CVSS)
- [CVE-2017-11438](https://cve.now/CVE-2017-11438.md): GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create (no CVSS)
- [CVE-2017-7642](https://cve.now/CVE-2017-7642.md): The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local users to gain root priv (no CVSS)
- [CVE-2017-7890](https://cve.now/CVE-2017-7890.md): The GIF decoding function gdImageCreateFromGifCtx in gd\_gif\_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7. (no CVSS)
- [CVE-2017-8390](https://cve.now/CVE-2017-8390.md): The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attacke (no CVSS)
- [CVE-2017-9244](https://cve.now/CVE-2017-9244.md): Cross-site scripting (XSS) vulnerability in the Trello app before 4.0.8 for iOS might allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2017-9247](https://cve.now/CVE-2017-9247.md): Multiple unquoted service path vulnerabilities in Sierra Wireless Windows Mobile Broadband Driver Package (MBDP) with build ID \< 4657 allows (no CVSS)
- [CVE-2017-9459](https://cve.now/CVE-2017-9459.md): Cross-site scripting (XSS) vulnerability in the management web interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1. (no CVSS)
- [CVE-2017-9467](https://cve.now/CVE-2017-9467.md): Cross-site scripting (XSS) vulnerability in the GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0. (no CVSS)
- [CVE-2017-9769](https://cve.now/CVE-2017-9769.md): A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a (no CVSS)
- [CVE-2017-9770](https://cve.now/CVE-2017-9770.md): A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse that can cause an out of bounds read operation to occur due (no CVSS)
- [CVE-2016-9981](https://cve.now/CVE-2016-9981.md): IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. (no CVSS, IBM Security AppScan Enterprise)
- [CVE-2017-1118](https://cve.now/CVE-2017-1118.md): IBM WebSphere MQ Internet Pass-Thru 2.0 and 2.1 could allow n attacker to cause the MQIPT to stop responding due to an incorrectly configure (no CVSS, IBM WebSphere MQ)
- [CVE-2017-1383](https://cve.now/CVE-2017-1383.md): IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data (no CVSS, IBM InfoSphere Information Server)
- [CVE-2017-1467](https://cve.now/CVE-2017-1467.md): A network layer security vulnerability in InfoSphere Information Server 9.1, 11.3, and 11.5 can lead to privilege escalation or unauthorized (no CVSS, IBM InfoSphere Information Server)
- [CVE-2017-1468](https://cve.now/CVE-2017-1468.md): IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a local user to gain elevated privileges by placing arbitrary files in ins (no CVSS, IBM InfoSphere Information Server)
- [CVE-2017-1495](https://cve.now/CVE-2017-1495.md): IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a privileged user to cause a memory dump that could contain highly sensiti (no CVSS, IBM InfoSphere Information Server)
- [CVE-2016-7812](https://cve.now/CVE-2016-7812.md): The Bank of Tokyo-Mitsubishi UFJ, Ltd. (no CVSS, The Bank of Tokyo-Mitsubishi UFJ, Ltd. App for Android)
- [CVE-2016-7844](https://cve.now/CVE-2016-7844.md): GigaCC OFFICE ver.2.3 and earlier allows remote attackers to execute arbitrary OS commands via specially crafted mail template. (no CVSS, WAM!NET Japan K.K. GigaCC OFFICE)
- [CVE-2016-7845](https://cve.now/CVE-2016-7845.md): GigaCC OFFICE ver.2.3 and earlier allows remote attackers to upload arbitrary files as a user profile image, which may be exploited for unau (no CVSS, WAM!NET Japan K.K. GigaCC OFFICE)
- [CVE-2017-2138](https://cve.now/CVE-2017-2138.md): Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor J (no CVSS, Frogman Office CS-Cart Japanese Edition · Frogman Office CS…)
- [CVE-2017-2278](https://cve.now/CVE-2017-2278.md): The RBB SPEED TEST App for Android version 2.0.3 and earlier, RBB SPEED TEST App for iOS version 2.1.0 and earlier does not verify X.509 cer (no CVSS, IID RBB SPEED TEST App for Android · IID RBB SPEED TEST App…)
- [CVE-2017-2279](https://cve.now/CVE-2017-2279.md): Untrusted search path vulnerability in Tween Ver1.6.6.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspe (no CVSS, Kiri Tween)
- [CVE-2017-2280](https://cve.now/CVE-2017-2280.md): WN-AX1167GR firmware version 3.00 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute a (no CVSS, I-O DATA DEVICE WN-AX1167GR)
- [CVE-2017-2281](https://cve.now/CVE-2017-2281.md): WN-AX1167GR firmware version 3.00 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors. (no CVSS, I-O DATA DEVICE WN-AX1167GR)
- [CVE-2017-2282](https://cve.now/CVE-2017-2282.md): Buffer overflow in WN-AX1167GR firmware version 3.00 and earlier allows an attacker to execute arbitrary commands via unspecified vectors. (no CVSS, I-O DATA DEVICE WN-AX1167GR)
- [CVE-2017-2283](https://cve.now/CVE-2017-2283.md): WN-G300R3 firmware version 1.0.2 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute ar (no CVSS, I-O DATA DEVICE WN-G300R3)
- [CVE-2017-2284](https://cve.now/CVE-2017-2284.md): Cross-site scripting vulnerability in Popup Maker prior to version 1.6.5 allows remote attackers to inject arbitrary web script or HTML via (no CVSS, Popup Maker)
- [CVE-2017-2285](https://cve.now/CVE-2017-2285.md): Cross-site scripting vulnerability in Simple Custom CSS and JS prior to version 3.4 allows remote attackers to inject arbitrary web script o (CVSS 6.1, SilkyPress Simple Custom CSS and JS)
- [CVE-2017-2286](https://cve.now/CVE-2017-2286.md): Untrusted search path vulnerability in NFC Port Software Version 5.5.0.6 and earlier (for RC-S310, RC-S320, RC-S330, RC-S370, RC-S380, RC-S3 (no CVSS, Sony NFC Port Software · Sony PC/SC Activator for Type B +2)
- [CVE-2017-2287](https://cve.now/CVE-2017-2287.md): Untrusted search path vulnerability in NFC Port Software remover Ver.1.3.0.1 and earlier allows an attacker to gain privileges via a Trojan (no CVSS, Sony NFC Port Software remover)
- [CVE-2017-2288](https://cve.now/CVE-2017-2288.md): Untrusted search path vulnerability in LhaForge Ver.1.6.5 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an uns (no CVSS, Claybird LhaForge)
- [CVE-2017-11364](https://cve.now/CVE-2017-11364.md): The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain (no CVSS)
- [CVE-2017-11494](https://cve.now/CVE-2017-11494.md): SQL injection vulnerability in SOL.Connect ISET-mpp meter 1.2.4.2 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2017-12138](https://cve.now/CVE-2017-12138.md): XOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter. (no CVSS)
- [CVE-2017-12139](https://cve.now/CVE-2017-12139.md): XOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php. (no CVSS)
- [CVE-2017-12140](https://cve.now/CVE-2017-12140.md): The ReadDCMImage function in coders\\dcm.c in ImageMagick 7.0.6-1 has an integer signedness error leading to excessive memory consumption via (no CVSS)
- [CVE-2017-12141](https://cve.now/CVE-2017-12141.md): In ytnef 1.9.2, a heap-based buffer overflow vulnerability was found in the function TNEFFillMapi in ytnef.c, which allows attackers to caus (no CVSS)
- [CVE-2017-12142](https://cve.now/CVE-2017-12142.md): In ytnef 1.9.2, an invalid memory read vulnerability was found in the function SwapDWord in ytnef.c, which allows attackers to cause a denia (no CVSS)
- [CVE-2017-12143](https://cve.now/CVE-2017-12143.md): In libquicktime 1.2.4, an allocation failure was found in the function quicktime\_read\_info in lqt\_quicktime.c, which allows attackers to cau (no CVSS)
- [CVE-2017-12144](https://cve.now/CVE-2017-12144.md): In ytnef 1.9.2, an allocation failure was found in the function TNEFFillMapi in ytnef.c, which allows attackers to cause a denial of service (no CVSS)
- [CVE-2017-12145](https://cve.now/CVE-2017-12145.md): In libquicktime 1.2.4, an allocation failure was found in the function quicktime\_read\_ftyp in ftyp.c, which allows attackers to cause a deni (no CVSS)
- [CVE-2017-12199](https://cve.now/CVE-2017-12199.md): The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue (no CVSS)
- [CVE-2017-12200](https://cve.now/CVE-2017-12200.md): The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-08-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.