CVEs published August 9, 2017
84 CVEs were published on August 9, 2017: 0 critical, 1 high. 1 is now in CISA KEV.
- Published
- 84
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 83
- Now in CISA KEV
- 1
- Fix available
- 7
Most affected products
- Google Android
- 35
- IBM Emptoris Supplier Lifecycle Management
- 3
- Apache Software Foundation Apache Storm · org.apache.storm:…
- 1
- BlackBerry Workspaces Server; WatchDox by BlackBerry Server
- 1
- express
- 1
- IBM Maximo Asset Management
- 1
- Intel Solid-State Drive Consumer, Professional, Embedded, D…
- 1
- Intel Solid-State Drive Professional
- 1
- lemur
- 1
- Lenovo Group Lenovo and IBM Switch Products
- 1
High 1
Medium, low and unrated 83
- CVE-2017-0712A elevation of privilege vulnerability in the Android framework (wi-fi service).Google Android
- CVE-2017-0713A remote code execution vulnerability in the Android libraries (sfntly).Google Android
- CVE-2017-0714A remote code execution vulnerability in the Android media framework (h263 decoder).Google Android
- CVE-2017-0715A remote code execution vulnerability in the Android media framework (libavc).Google Android
- CVE-2017-0716A remote code execution vulnerability in the Android media framework (libmpeg2).Google Android
- CVE-2017-0718A remote code execution vulnerability in the Android media framework (mpeg2 decoder).Google Android
- CVE-2017-0719A remote code execution vulnerability in the Android media framework (mpeg2 decoder).Google Android
- CVE-2017-0720A remote code execution vulnerability in the Android media framework (libhevc).Google Android
- CVE-2017-0721A remote code execution vulnerability in the Android media framework (libmpeg2).Google Android
- CVE-2017-0722A remote code execution vulnerability in the Android media framework (h263 decoder).Google Android
- CVE-2017-0723A remote code execution vulnerability in the Android media framework (libavc).Google Android
- CVE-2017-0724A denial of service vulnerability in the Android media framework (libmpeg2).Google Android
- CVE-2017-0725A denial of service vulnerability in the Android media framework (libskia).Google Android
- CVE-2017-0726A denial of service vulnerability in the Android media framework (libstagefright).Google Android
- CVE-2017-0727A elevation of privilege vulnerability in the Android media framework (libgui).Google Android
- CVE-2017-0728A denial of service vulnerability in the Android media framework (hevc decoder).Google Android
- CVE-2017-0729A elevation of privilege vulnerability in the Android media framework (mediadrmserver).Google Android
- CVE-2017-0730A denial of service vulnerability in the Android media framework (h264 decoder).Google Android
- CVE-2017-0731A elevation of privilege vulnerability in the Android media framework (mpeg4 encoder).Google Android
- CVE-2017-0732A elevation of privilege vulnerability in the Android media framework (libstagefright).Google Android
- CVE-2017-0733A denial of service vulnerability in the Android media framework (libmediaplayerservice).Google Android
- CVE-2017-0734A denial of service vulnerability in the Android media framework (libavc).Google Android
- CVE-2017-0735A denial of service vulnerability in the Android media framework (libavc).Google Android
- CVE-2017-0736A denial of service vulnerability in the Android media framework (libavc).Google Android
- CVE-2017-0737A elevation of privilege vulnerability in the Android media framework (libstagefright).Google Android
- CVE-2017-0738A information disclosure vulnerability in the Android media framework (audioserver).Google Android
- CVE-2017-0739A information disclosure vulnerability in the Android media framework (libhevc).Google Android
- CVE-2017-0740A remote code execution vulnerability in the Broadcom networking driver.Google Android
- CVE-2017-0741A elevation of privilege vulnerability in the MediaTek gpu driver.Google Android
- CVE-2017-0742A elevation of privilege vulnerability in the MediaTek video driver.Google Android
- CVE-2017-0745A remote code execution vulnerability in the Android media framework (avc decoder).Google Android
- CVE-2017-0746A elevation of privilege vulnerability in the Qualcomm ipa driver.Google Android
- CVE-2017-0747A elevation of privilege vulnerability in the Qualcomm proprietary component.Google Android
- CVE-2017-0749A elevation of privilege vulnerability in the Upstream Linux linux kernel.Google Android
- CVE-2017-0750A elevation of privilege vulnerability in the Upstream Linux file system.Google Android
- CVE-2017-12756Command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the userfile[0] parameter.
- CVE-2017-12762In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check
- CVE-2017-12774finecms in 1.9.5\controllers\member\ContentController.php allows remote attackers to operate website database
- CVE-2017-12777Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via some parameter to usersearch.php.
- CVE-2017-3752An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on somLenovo Group Lenovo and IBM Switch Products
- CVE-2017-9799It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possApache Software Foundation Apache Storm · org.apache.storm:…
- CVE-2012-2771Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2773, CVE-2
- CVE-2012-2773Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2
- CVE-2012-2778Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2
- CVE-2012-2780Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2
- CVE-2012-2781Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2
- CVE-2014-5144Cross-site scripting (XSS) vulnerability in Telescope before 0.9.3 allows remote authenticated users to inject arbitrary web script or HTML
- CVE-2014-6393The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 leexpress
- CVE-2014-9701Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary
- CVE-2015-0780SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) al
- CVE-2015-0781Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management (ZCM) allows remote a
- CVE-2015-0782SQL injection vulnerability in the ScheduleQuery method of the schedule class in Novell ZENworks Configuration Management (ZCM) allows remot
- CVE-2015-0783The FileViewer class in Novell ZENworks Configuration Management (ZCM) allows remote authenticated users to read arbitrary files via the fil
- CVE-2015-0784Rtrlet.class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to obtain Session IDs of logged in users via a value
- CVE-2015-0785com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks Configuration Management (ZCM) allows remote attackers to read
- CVE-2015-0786Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management (ZCM) all
- CVE-2015-1820REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie irest-client
- CVE-2015-2310Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of ser
- CVE-2015-2311Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or
- CVE-2015-2312Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service (CPU and possibly general res
- CVE-2015-2313Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows
- CVE-2015-2674Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the defaultrestkit
- CVE-2015-2687OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normallnova
- CVE-2015-3277The mod_nss module before 1.0.11 in Fedora allows remote attackers to obtain cipher lists due to incorrect parsing of multi-keyword cipherst
- CVE-2015-6498Alcatel-Lucent Home Device Manager before 4.1.10, 4.2.x before 4.2.2 allows remote attackers to spoof and make calls as target devices.
- CVE-2015-6816ganglia-web before 3.7.1 allows remote attackers to bypass authentication.
- CVE-2015-7894The DCMProvider service in Samsung LibQjpeg on a Samsung SM-G925V device running build number LRX22G.G925VVRU1AOE2 allows remote attackers t
- CVE-2016-6121IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x is vulnerable to cross-site scripting.IBM Emptoris Supplier Lifecycle Management
- CVE-2016-8949IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redireIBM Emptoris Supplier Lifecycle Management
- CVE-2017-11368In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2P
- CVE-2017-1357IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to cIBM Maximo Asset Management
- CVE-2017-1448IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redireIBM Emptoris Supplier Lifecycle Management
- CVE-2017-9370An information disclosure / elevation of privilege vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker whoBlackBerry Workspaces Server; WatchDox by BlackBerry Server
- CVE-2015-3405ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machin
- CVE-2015-4165The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code froorg.elasticsearch:elasticsearch
- CVE-2015-5619Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates f
- CVE-2015-6941win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in desalt
- CVE-2015-7764Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.lemur
- CVE-2017-12754Stack buffer overflow in httpd in Asuswrt-Merlin firmware 380.67_0RT-AC5300 and earlier for ASUS devices and ASUS firmware for ASUS RT-AC530
- CVE-2016-5716The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code exPuppet Enterprise
- CVE-2017-5694Data corruption vulnerability in firmware in Intel Solid-State Drive Professional PSF104P, PSF109P allows local users to cause a denial of sIntel Solid-State Drive Professional
- CVE-2017-5695Data corruption vulnerability in firmware in Intel Solid-State Drive Consumer, Professional, Embedded, Data Center affected firmware versionIntel Solid-State Drive Consumer, Professional, Embedded, D…
- CVE-2017-11506When linking a Nessus scanner or agent to Tenable.io or other manager, Nessus 6.x before 6.11 does not verify the manager's TLS certificate Tenable Nessus