# CVEs published 2017-08-09

84 CVEs were published on August 9, 2017: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-0712](https://cve.now/CVE-2017-0712.md): A elevation of privilege vulnerability in the Android framework (wi-fi service). (no CVSS, Google Android)
- [CVE-2017-0713](https://cve.now/CVE-2017-0713.md): A remote code execution vulnerability in the Android libraries (sfntly). (no CVSS, Google Android)
- [CVE-2017-0714](https://cve.now/CVE-2017-0714.md): A remote code execution vulnerability in the Android media framework (h263 decoder). (no CVSS, Google Android)
- [CVE-2017-0715](https://cve.now/CVE-2017-0715.md): A remote code execution vulnerability in the Android media framework (libavc). (no CVSS, Google Android)
- [CVE-2017-0716](https://cve.now/CVE-2017-0716.md): A remote code execution vulnerability in the Android media framework (libmpeg2). (no CVSS, Google Android)
- [CVE-2017-0718](https://cve.now/CVE-2017-0718.md): A remote code execution vulnerability in the Android media framework (mpeg2 decoder). (no CVSS, Google Android)
- [CVE-2017-0719](https://cve.now/CVE-2017-0719.md): A remote code execution vulnerability in the Android media framework (mpeg2 decoder). (no CVSS, Google Android)
- [CVE-2017-0720](https://cve.now/CVE-2017-0720.md): A remote code execution vulnerability in the Android media framework (libhevc). (no CVSS, Google Android)
- [CVE-2017-0721](https://cve.now/CVE-2017-0721.md): A remote code execution vulnerability in the Android media framework (libmpeg2). (no CVSS, Google Android)
- [CVE-2017-0722](https://cve.now/CVE-2017-0722.md): A remote code execution vulnerability in the Android media framework (h263 decoder). (no CVSS, Google Android)
- [CVE-2017-0723](https://cve.now/CVE-2017-0723.md): A remote code execution vulnerability in the Android media framework (libavc). (no CVSS, Google Android)
- [CVE-2017-0724](https://cve.now/CVE-2017-0724.md): A denial of service vulnerability in the Android media framework (libmpeg2). (no CVSS, Google Android)
- [CVE-2017-0725](https://cve.now/CVE-2017-0725.md): A denial of service vulnerability in the Android media framework (libskia). (no CVSS, Google Android)
- [CVE-2017-0726](https://cve.now/CVE-2017-0726.md): A denial of service vulnerability in the Android media framework (libstagefright). (no CVSS, Google Android)
- [CVE-2017-0727](https://cve.now/CVE-2017-0727.md): A elevation of privilege vulnerability in the Android media framework (libgui). (no CVSS, Google Android)
- [CVE-2017-0728](https://cve.now/CVE-2017-0728.md): A denial of service vulnerability in the Android media framework (hevc decoder). (no CVSS, Google Android)
- [CVE-2017-0729](https://cve.now/CVE-2017-0729.md): A elevation of privilege vulnerability in the Android media framework (mediadrmserver). (no CVSS, Google Android)
- [CVE-2017-0730](https://cve.now/CVE-2017-0730.md): A denial of service vulnerability in the Android media framework (h264 decoder). (no CVSS, Google Android)
- [CVE-2017-0731](https://cve.now/CVE-2017-0731.md): A elevation of privilege vulnerability in the Android media framework (mpeg4 encoder). (no CVSS, Google Android)
- [CVE-2017-0732](https://cve.now/CVE-2017-0732.md): A elevation of privilege vulnerability in the Android media framework (libstagefright). (no CVSS, Google Android)
- [CVE-2017-0733](https://cve.now/CVE-2017-0733.md): A denial of service vulnerability in the Android media framework (libmediaplayerservice). (no CVSS, Google Android)
- [CVE-2017-0734](https://cve.now/CVE-2017-0734.md): A denial of service vulnerability in the Android media framework (libavc). (no CVSS, Google Android)
- [CVE-2017-0735](https://cve.now/CVE-2017-0735.md): A denial of service vulnerability in the Android media framework (libavc). (no CVSS, Google Android)
- [CVE-2017-0736](https://cve.now/CVE-2017-0736.md): A denial of service vulnerability in the Android media framework (libavc). (no CVSS, Google Android)
- [CVE-2017-0737](https://cve.now/CVE-2017-0737.md): A elevation of privilege vulnerability in the Android media framework (libstagefright). (no CVSS, Google Android)
- [CVE-2017-0738](https://cve.now/CVE-2017-0738.md): A information disclosure vulnerability in the Android media framework (audioserver). (no CVSS, Google Android)
- [CVE-2017-0739](https://cve.now/CVE-2017-0739.md): A information disclosure vulnerability in the Android media framework (libhevc). (no CVSS, Google Android)
- [CVE-2017-0740](https://cve.now/CVE-2017-0740.md): A remote code execution vulnerability in the Broadcom networking driver. (no CVSS, Google Android)
- [CVE-2017-0741](https://cve.now/CVE-2017-0741.md): A elevation of privilege vulnerability in the MediaTek gpu driver. (no CVSS, Google Android)
- [CVE-2017-0742](https://cve.now/CVE-2017-0742.md): A elevation of privilege vulnerability in the MediaTek video driver. (no CVSS, Google Android)
- [CVE-2017-0745](https://cve.now/CVE-2017-0745.md): A remote code execution vulnerability in the Android media framework (avc decoder). (no CVSS, Google Android)
- [CVE-2017-0746](https://cve.now/CVE-2017-0746.md): A elevation of privilege vulnerability in the Qualcomm ipa driver. (no CVSS, Google Android)
- [CVE-2017-0747](https://cve.now/CVE-2017-0747.md): A elevation of privilege vulnerability in the Qualcomm proprietary component. (no CVSS, Google Android)
- [CVE-2017-0749](https://cve.now/CVE-2017-0749.md): A elevation of privilege vulnerability in the Upstream Linux linux kernel. (no CVSS, Google Android)
- [CVE-2017-0750](https://cve.now/CVE-2017-0750.md): A elevation of privilege vulnerability in the Upstream Linux file system. (no CVSS, Google Android)
- [CVE-2017-12756](https://cve.now/CVE-2017-12756.md): Command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the userfile\[0\] parameter. (no CVSS)
- [CVE-2017-12762](https://cve.now/CVE-2017-12762.md): In /drivers/isdn/i4l/isdn\_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check (no CVSS)
- [CVE-2017-12774](https://cve.now/CVE-2017-12774.md): finecms in 1.9.5\\controllers\\member\\ContentController.php allows remote attackers to operate website database (no CVSS)
- [CVE-2017-12777](https://cve.now/CVE-2017-12777.md): Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via some parameter to usersearch.php. (no CVSS)
- [CVE-2017-3752](https://cve.now/CVE-2017-3752.md): An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on som (no CVSS, Lenovo Group Lenovo and IBM Switch Products)
- [CVE-2017-9799](https://cve.now/CVE-2017-9799.md): It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically poss (no CVSS, Apache Software Foundation Apache Storm · org.apache.storm:…)
- [CVE-2012-2771](https://cve.now/CVE-2012-2771.md): Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2773, CVE-2 (no CVSS)
- [CVE-2012-2773](https://cve.now/CVE-2012-2773.md): Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2 (no CVSS)
- [CVE-2012-2778](https://cve.now/CVE-2012-2778.md): Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2 (no CVSS)
- [CVE-2012-2780](https://cve.now/CVE-2012-2780.md): Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2 (no CVSS)
- [CVE-2012-2781](https://cve.now/CVE-2012-2781.md): Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2 (no CVSS)
- [CVE-2014-5144](https://cve.now/CVE-2014-5144.md): Cross-site scripting (XSS) vulnerability in Telescope before 0.9.3 allows remote authenticated users to inject arbitrary web script or HTML (no CVSS)
- [CVE-2014-6393](https://cve.now/CVE-2014-6393.md): The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 le (no CVSS, express)
- [CVE-2014-9701](https://cve.now/CVE-2014-9701.md): Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2015-0780](https://cve.now/CVE-2015-0780.md): SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) al (no CVSS)
- [CVE-2015-0781](https://cve.now/CVE-2015-0781.md): Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management (ZCM) allows remote a (no CVSS)
- [CVE-2015-0782](https://cve.now/CVE-2015-0782.md): SQL injection vulnerability in the ScheduleQuery method of the schedule class in Novell ZENworks Configuration Management (ZCM) allows remot (no CVSS)
- [CVE-2015-0783](https://cve.now/CVE-2015-0783.md): The FileViewer class in Novell ZENworks Configuration Management (ZCM) allows remote authenticated users to read arbitrary files via the fil (no CVSS)
- [CVE-2015-0784](https://cve.now/CVE-2015-0784.md): Rtrlet.class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to obtain Session IDs of logged in users via a value (no CVSS)
- [CVE-2015-0785](https://cve.now/CVE-2015-0785.md): com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks Configuration Management (ZCM) allows remote attackers to read (no CVSS)
- [CVE-2015-0786](https://cve.now/CVE-2015-0786.md): Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management (ZCM) all (no CVSS)
- [CVE-2015-1820](https://cve.now/CVE-2015-1820.md): REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie i (no CVSS, rest-client)
- [CVE-2015-2291](https://cve.now/CVE-2015-2291.md): (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to c (CVSS 7.8, KEV)
- [CVE-2015-2310](https://cve.now/CVE-2015-2310.md): Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of ser (no CVSS)
- [CVE-2015-2311](https://cve.now/CVE-2015-2311.md): Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or (no CVSS)
- [CVE-2015-2312](https://cve.now/CVE-2015-2312.md): Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service (CPU and possibly general res (no CVSS)
- [CVE-2015-2313](https://cve.now/CVE-2015-2313.md): Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows (no CVSS)
- [CVE-2015-2674](https://cve.now/CVE-2015-2674.md): Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap\_socket function in Python with the default (no CVSS, restkit)
- [CVE-2015-2687](https://cve.now/CVE-2015-2687.md): OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normall (no CVSS, nova)
- [CVE-2015-3277](https://cve.now/CVE-2015-3277.md): The mod\_nss module before 1.0.11 in Fedora allows remote attackers to obtain cipher lists due to incorrect parsing of multi-keyword cipherst (no CVSS)
- [CVE-2015-6498](https://cve.now/CVE-2015-6498.md): Alcatel-Lucent Home Device Manager before 4.1.10, 4.2.x before 4.2.2 allows remote attackers to spoof and make calls as target devices. (no CVSS)
- [CVE-2015-6816](https://cve.now/CVE-2015-6816.md): ganglia-web before 3.7.1 allows remote attackers to bypass authentication. (no CVSS)
- [CVE-2015-7894](https://cve.now/CVE-2015-7894.md): The DCMProvider service in Samsung LibQjpeg on a Samsung SM-G925V device running build number LRX22G.G925VVRU1AOE2 allows remote attackers t (no CVSS)
- [CVE-2016-6121](https://cve.now/CVE-2016-6121.md): IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x is vulnerable to cross-site scripting. (no CVSS, IBM Emptoris Supplier Lifecycle Management)
- [CVE-2016-8949](https://cve.now/CVE-2016-8949.md): IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redire (no CVSS, IBM Emptoris Supplier Lifecycle Management)
- [CVE-2017-11368](https://cve.now/CVE-2017-11368.md): In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2P (no CVSS)
- [CVE-2017-1357](https://cve.now/CVE-2017-1357.md): IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to c (no CVSS, IBM Maximo Asset Management)
- [CVE-2017-1448](https://cve.now/CVE-2017-1448.md): IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redire (no CVSS, IBM Emptoris Supplier Lifecycle Management)
- [CVE-2017-9370](https://cve.now/CVE-2017-9370.md): An information disclosure / elevation of privilege vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker who (no CVSS, BlackBerry Workspaces Server; WatchDox by BlackBerry Server)
- [CVE-2015-3405](https://cve.now/CVE-2015-3405.md): ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machin (no CVSS)
- [CVE-2015-4165](https://cve.now/CVE-2015-4165.md): The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code fro (no CVSS, org.elasticsearch:elasticsearch)
- [CVE-2015-5619](https://cve.now/CVE-2015-5619.md): Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates f (no CVSS)
- [CVE-2015-6941](https://cve.now/CVE-2015-6941.md): win\_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in de (no CVSS, salt)
- [CVE-2015-7764](https://cve.now/CVE-2015-7764.md): Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode. (no CVSS, lemur)
- [CVE-2017-12754](https://cve.now/CVE-2017-12754.md): Stack buffer overflow in httpd in Asuswrt-Merlin firmware 380.67\_0RT-AC5300 and earlier for ASUS devices and ASUS firmware for ASUS RT-AC530 (no CVSS)
- [CVE-2016-5716](https://cve.now/CVE-2016-5716.md): The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code ex (no CVSS, Puppet Enterprise)
- [CVE-2017-5694](https://cve.now/CVE-2017-5694.md): Data corruption vulnerability in firmware in Intel Solid-State Drive Professional PSF104P, PSF109P allows local users to cause a denial of s (no CVSS, Intel Solid-State Drive Professional)
- [CVE-2017-5695](https://cve.now/CVE-2017-5695.md): Data corruption vulnerability in firmware in Intel Solid-State Drive Consumer, Professional, Embedded, Data Center affected firmware version (no CVSS, Intel Solid-State Drive Consumer, Professional, Embedded, D…)
- [CVE-2017-11506](https://cve.now/CVE-2017-11506.md): When linking a Nessus scanner or agent to Tenable.io or other manager, Nessus 6.x before 6.11 does not verify the manager's TLS certificate (no CVSS, Tenable Nessus)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-08-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.