# CVEs published 2017-08-10

25 CVEs were published on August 10, 2017: 0 critical, 1 high. Days are UTC.

- [CVE-2016-6797](https://cve.now/CVE-2016-6797.md): The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2016-6817](https://cve.now/CVE-2016-6817.md): The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that wa (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2016-8745](https://cve.now/CVE-2016-8745.md): A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.R (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2017-3130](https://cve.now/CVE-2017-3130.md): An information disclosure vulnerability in Fortinet FortiOS 5.6.0, 5.4.4 and below versions allows attacker to get FortiOS version info by i (no CVSS, Fortinet FortiOS)
- [CVE-2017-7737](https://cve.now/CVE-2017-7737.md): An information disclosure vulnerability in Fortinet FortiWeb 5.8.2 and below versions allows logged-in admin user to view SNMPv3 user passwo (no CVSS, Fortinet FortiWeb)
- [CVE-2016-8739](https://cve.now/CVE-2016-8739.md): The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. (no CVSS, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2017-12798](https://cve.now/CVE-2017-12798.md): Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the q parameter to searchsuggest.php. (no CVSS)
- [CVE-2017-12799](https://cve.now/CVE-2017-12799.md): The elf\_read\_notesfunction in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and appli (no CVSS)
- [CVE-2017-3156](https://cve.now/CVE-2017-3156.md): The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signat (no CVSS, Apache Software Foundation Apache CXF · org.apache.cxf.kara…)
- [CVE-2017-8518](https://cve.now/CVE-2017-8518.md): Microsoft Edge allows a remote code execution vulnerability due to the way it accesses objects in memory, aka "Scripting Engine Memory Corru (no CVSS, Microsoft Edge)
- [CVE-2016-0762](https://cve.now/CVE-2016-0762.md): The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2016-5018](https://cve.now/CVE-2016-5018.md): In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2016-6794](https://cve.now/CVE-2016-6794.md): When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2016-6812](https://cve.now/CVE-2016-6812.md): The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page whi (no CVSS, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2014-0142](https://cve.now/CVE-2014-0142.md): QEMU, possibly before 2.0.0, allows local users to cause a denial of service (divide-by-zero error and crash) via a zero value in the (1) tr (no CVSS)
- [CVE-2014-0143](https://cve.now/CVE-2014-0143.md): Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service (crash) via a (no CVSS)
- [CVE-2014-0145](https://cve.now/CVE-2014-0145.md): Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly exec (no CVSS)
- [CVE-2014-0146](https://cve.now/CVE-2014-0146.md): The qcow2\_open function in the (block/qcow2.c) in QEMU before 1.7.2 and 2.x before 2.0.0 allows local users to cause a denial of service (NU (no CVSS)
- [CVE-2017-1168](https://cve.now/CVE-2017-1168.md): IBM Rational Engineering Lifecycle Manager 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Engineering Lifecycle Manager)
- [CVE-2017-1174](https://cve.now/CVE-2017-1174.md): IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to SQL injection. (no CVSS, IBM Sterling B2B Integrator)
- [CVE-2017-1192](https://cve.now/CVE-2017-1192.md): IBM Sterling B2B Integrator 5.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (no CVSS, IBM Sterling B2B Integrator)
- [CVE-2017-1377](https://cve.now/CVE-2017-1377.md): IBM Runbook Automation reveals sensitive information in error messages that could be used in further attacks against the system. (no CVSS, IBM Runbook Automation)
- [CVE-2017-1431](https://cve.now/CVE-2017-1431.md): IBM InfoSphere Streams 4.0, 4.1, and 4.2 is vulnerable to cross-site scripting. (no CVSS, IBM Streams)
- [CVE-2017-3751](https://cve.now/CVE-2017-3751.md): An unquoted service path vulnerability was identified in the driver for the ThinkPad Compact USB Keyboard with TrackPoint versions earlier t (no CVSS, Lenovo Group ThinkPad Compact USB Keyboard with TrackPoint…)
- [CVE-2017-3753](https://cve.now/CVE-2017-3753.md): A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (no CVSS, Lenovo Group Desktop and Notebook BIOS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-08-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.