CVEs published August 7, 2017
118 CVEs were published on August 7, 2017: 0 critical, 2 high. 2 are now in CISA KEV.
- Published
- 118
- Critical
- 0
- High
- 2
- Medium
- 1
- Low
- 0
- Unrated
- 115
- Now in CISA KEV
- 2
- Fix available
- 19
Most affected products
- opencv-python · opencv-contrib-python
- 6
- com.liferay.portal:release.portal.bom
- 4
- opencv-contrib-python · opencv-python
- 4
- Cisco Adaptive Security Appliance
- 3
- ABB VSN300 WiFi Logger Card
- 2
- Cisco IOS and IOS XE
- 2
- Cisco Prime Collaboration Provisioning Tool
- 2
- Cisco Unified Communications Manager
- 2
- Continental AG Infineon S-Gold
- 2
- NXP i.MX Product Family
- 2
High 2
- CVE-2017-12637Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows
- CVE-2017-9633An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in the Continental AG Infineon S-Gold 2 (PMBContinental AG Infineon S-Gold
Medium, low and unrated 116
- CVE-2017-6866A vulnerability was discovered in Siemens XHQ server 4 and 5 (4 before V4.7.1.3 and 5 before V5.0.0.2) that could allow an authenticated lowXHQ 4 (All versions before V4.7.1.3), XHQ
- CVE-2017-12662ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePDFImage in coders/pdf.c.
- CVE-2017-12663ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteMAPImage in coders/map.c.
- CVE-2017-12664ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePALMImage in coders/palm.c.
- CVE-2017-12665ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePICTImage in coders/pict.c.
- CVE-2017-12666ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteINLINEImage in coders/inline.c.
- CVE-2017-12667ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMATImage in coders\mat.c.
- CVE-2017-12668ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePCXImage in coders/pcx.c.
- CVE-2017-12669ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteCALSImage in coders/cals.c.
- CVE-2017-12670In ImageMagick 7.0.6-3, missing validation was found in coders/mat.c, leading to an assertion failure in the function DestroyImage in Magick
- CVE-2017-12671In ImageMagick 7.0.6-3, a missing NULL assignment was found in coders/png.c, leading to an invalid free in the function RelinquishMagickMemo
- CVE-2017-12672In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause
- CVE-2017-12673In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneMNGImage in coders/png.c, which allows attackers to cau
- CVE-2017-12674In ImageMagick 7.0.6-2, a CPU exhaustion vulnerability was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cau
- CVE-2017-12675In ImageMagick 7.0.6-3, a missing check for multidimensional data was found in coders/mat.c, leading to a memory leak in the function ReadIm
- CVE-2017-12676In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c, which allows attackers to cau
- CVE-2014-1235Stack-based buffer overflow in the "yyerror" function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial
- CVE-2014-3462The ".encfs6.xml" configuration file in encfs before 1.7.5 allows remote attackers to access sensitive data by setting "blockMACBytes" to 0
- CVE-2014-9827coders/xpm.c in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file.
- CVE-2014-9828coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file.
- CVE-2014-9830coders/sun.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted sun file.
- CVE-2014-9831coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted wpg file.
- CVE-2015-5244The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.
- CVE-2015-5946Incomplete blacklist vulnerability in SuiteCRM 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an
- CVE-2015-7571Unrestricted file upload vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary code by uploading a file with an exe
- CVE-2015-7691The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (
- CVE-2015-7692The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (
- CVE-2015-7701Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a den
- CVE-2015-7702The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (
- CVE-2015-7704The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of craft
- CVE-2015-7705The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large n
- CVE-2015-7849Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly exec
- CVE-2015-7850ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or c
- CVE-2015-7852ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 re
- CVE-2015-7853The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitra
- CVE-2015-7854Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated us
- CVE-2015-7855The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service
- CVE-2015-7871Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
- CVE-2016-3113Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML.
- CVE-2016-6220Information Disclosure vulnerability in the Dashboard and Error Pages in Trend Micro Control Manager SP3 6.0.
- CVE-2016-7976The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.
- CVE-2017-12655Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the query parameter to log.php in a dailylog action.
- CVE-2017-12653360 Total Security 9.0.0.1202 before 2017-07-07 allows Privilege Escalation via a Trojan horse Shcore.dll file in any directory in the PATH,
- CVE-2017-12654The ReadPICTImage function in coders/pict.c in ImageMagick 7.0.6-3 allows attackers to cause a denial of service (memory leak) via a crafted
- CVE-2009-5145Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.zope2
- CVE-2011-5325Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside th
- CVE-2014-9260The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every Word
- CVE-2014-9262The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files.
- CVE-2015-1378cmdlineopts.clp in grml-debootstrap in Debian 0.54, 0.68.x before 0.68.1, 0.7x before 0.78 is sourced without checking that the local direct
- CVE-2015-1555Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions withou
- CVE-2015-3839The updateMessageStatus function in Android 5.1.1 and earlier allows local users to cause a denial of service (NULL pointer exception and pr
- CVE-2015-7561Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.k8s.io/kubernetes
- CVE-2015-7875ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins tha
- CVE-2015-7887NetApp SnapCenter Server 1.0 allows remote authenticated users to list and delete backups.
- CVE-2015-8621t-coffee before 11.00.8cbe486-2 allows local users to write to ~/.t_coffee globally.
- CVE-2017-12650SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header.
- CVE-2017-12651Cross Site Request Forgery (CSRF) exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordP
- CVE-2016-10404XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to modules/apps/foundation/frontend-js/frontend-js-spa-web/src/mcom.liferay.portal:release.portal.bom
- CVE-2017-12567SQL injection exists in Quest KACE Asset Management Appliance 6.4.120822 through 7.2, Systems Management Appliance 6.4.120822 through 7.2.10
- CVE-2017-12645XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.com.liferay.portal:release.portal.bom
- CVE-2017-12646XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.com.liferay.portal:release.portal.bom · com.liferay:com.… +1
- CVE-2017-12647XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title.com.liferay.portal:release.portal.bom
- CVE-2017-12648XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL.com.liferay.portal:release.portal.bom · com.liferay:com.lif…
- CVE-2017-12649XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display.com.liferay.portal:release.portal.bom
- CVE-2017-12477It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue in
- CVE-2017-12478It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameter
- CVE-2017-12479It was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable du
- CVE-2017-12640ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c.
- CVE-2017-12641ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadOneJNGImage in coders\png.c.
- CVE-2017-12642ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMPCImage in coders\mpc.c.
- CVE-2017-12643ImageMagick 7.0.6-1 has a memory exhaustion vulnerability in ReadOneJNGImage in coders\png.c.
- CVE-2017-12644ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadDCMImage in coders\dcm.c.
- CVE-2017-9801When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitraApache Software Foundation Apache Commons Email · org.apach…
- CVE-2017-7916A Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFABB VSN300 WiFi Logger Card
- CVE-2017-7920An Improper Authentication issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for ReABB VSN300 WiFi Logger Card
- CVE-2017-7928An Improper Access Control issue was discovered in Schweitzer Engineering Laboratories (SEL) SEL-3620 and SEL-3622 Security Gateway VersionsSchweitzer Engineering Laboratories, Inc. SEL-3620 and SEL-…
- CVE-2017-7932An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, VNXP i.MX Product Family
- CVE-2017-7936A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DuNXP i.MX Product Family
- CVE-2017-9630An Improper Authentication issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, PDQ Manufacturing, Inc. LaserWash, Laser Jet and ProTouch
- CVE-2017-9632A Missing Encryption of Sensitive Data issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, alPDQ Manufacturing, Inc. LaserWash, Laser Jet and ProTouch
- CVE-2017-9647A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models producedContinental AG Infineon S-Gold
- CVE-2011-4650Cisco Data Center Network Manager is affected by Excessive Logging During a TCP Flood on Java Ports.
- CVE-2017-6663A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacentCisco IOS and IOS XE
- CVE-2017-6664A vulnerability in the Autonomic Networking feature of Cisco IOS XE Software could allow an unauthenticated, remote, autonomic node to accesCisco IOS XE
- CVE-2017-6665A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacentCisco IOS and IOS XE
- CVE-2017-6745A vulnerability in the cache server within Cisco Videoscape Distribution Suite (VDS) for Television 3.2(5)ES1 could allow an unauthenticatedCisco Videoscape Distribution Suite Cache Server
- CVE-2017-6747A vulnerability in the authentication module of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypaCisco Identity Services Engine
- CVE-2017-6752A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) 9.3(3) and 9.6(2) could allow an unauthenticated, remoteCisco Adaptive Security Appliance
- CVE-2017-6754A vulnerability in the web-based management interface of the Cisco Smart Net Total Care (SNTC) Software Collector Appliance 3.11 could allowCisco Smart Net Total Care Software Collector Appliance
- CVE-2017-6756A vulnerability in the Web UI Application of the Cisco Prime Collaboration Provisioning Tool through 12.2 could allow an unauthenticated, reCisco Prime Collaboration Provisioning Tool
- CVE-2017-6757A vulnerability in Cisco Unified Communications Manager 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6) could allow an authenticated,Cisco Unified Communications Manager
- CVE-2017-6758A vulnerability in the web framework of Cisco Unified Communications Manager 11.5(1.10000.6) could allow an authenticated, remote attacker tCisco Unified Communications Manager
- CVE-2017-6759A vulnerability in the UpgradeManager of the Cisco Prime Collaboration Provisioning Tool 12.1 could allow an authenticated, remote attacker Cisco Prime Collaboration Provisioning Tool
- CVE-2017-6761A vulnerability in the web-based management interface of Cisco Finesse 10.6(1) and 11.5(1) could allow an unauthenticated, remote attacker tCisco Finesse
- CVE-2017-6762A vulnerability in the web-based management interface of Cisco Jabber Guest Server 10.6(9), 11.0(0), and 11.0(1) could allow an unauthenticaCisco Jabber Guest Server
- CVE-2017-6763A vulnerability in the implementation of the H.264 protocol in Cisco Meeting Server (CMS) 2.1.4 could allow an unauthenticated, remote attacCisco Meeting Server
- CVE-2017-6764A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.5(1) could allow an authenticated, remoteCisco Adaptive Security Appliance
- CVE-2017-6765A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.1(6.11) and 9.4(1.2) could allow an unautCisco Adaptive Security Appliance
- CVE-2017-6766A vulnerability in the Secure Sockets Layer (SSL) Decryption and Inspection feature of Cisco Firepower System Software 5.4.0, 5.4.1, 6.0.0, Cisco Firepower System Software
- CVE-2017-6769A vulnerability in the web-based management interface of the Cisco Secure Access Control System (ACS) could allow an authenticated, remote aCisco Access Control System
- CVE-2017-6770Cisco IOS 12.0 through 15.6, Adaptive Security Appliance (ASA) Software 7.0.1 through 9.7.1.2, NX-OS 4.0 through 12.0, and IOS XE 3.6 througMultiple Cisco Products
- CVE-2006-3635The ia64 subsystem in the Linux kernel before 2.6.26 allows local users to cause a denial of service (stack consumption and system crash) vi
- CVE-2017-6418libclamav/message.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message.
- CVE-2017-6419mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overf
- CVE-2017-6420The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (use-after-free) via a c
- CVE-2017-12596In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp during exrmaketiled ex
- CVE-2017-12597OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reopencv-python · opencv-contrib-python
- CVE-2017-12598OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modulopencv-python · opencv-contrib-python
- CVE-2017-12599OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R when readiopencv-python · opencv-contrib-python
- CVE-2017-12600OpenCV (Open Source Computer Vision Library) through 3.3 has a denial of service (CPU consumption) issue, as demonstrated by the 11-opencv-dopencv-python · opencv-contrib-python
- CVE-2017-12601OpenCV (Open Source Computer Vision Library) through 3.3 has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecsopencv-contrib-python · opencv-python
- CVE-2017-12602OpenCV (Open Source Computer Vision Library) through 3.3 has a denial of service (memory consumption) issue, as demonstrated by the 10-opencopencv-python · opencv-contrib-python
- CVE-2017-12603OpenCV (Open Source Computer Vision Library) through 3.3 has an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecopencv-contrib-python · opencv-python
- CVE-2017-12604OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the FillUniColor function in utils.cpp when reaopencv-python · opencv-contrib-python
- CVE-2017-12605OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the FillColorRow8 function in utils.cpp when reopencv-contrib-python · opencv-python
- CVE-2017-12606OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the function FillColorRow4 in utils.cpp when reopencv-contrib-python · opencv-python