CVEs published August 14, 2017
20 CVEs were published on August 14, 2017: 0 critical, 0 high.
- Published
- 20
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- IBM Emptoris Strategic Supply Management
- 3
- Synology Download Station
- 2
- IBM InfoSphere Information Server
- 1
- org.apache.sling:org.apache.sling.servlets.post
- 1
Medium, low and unrated 20
- CVE-2016-6021IBM Emptoris Strategic Supply Management Platform 10.0 and 10.1 is vulnerable to cross-site scripting.IBM Emptoris Strategic Supply Management
- CVE-2016-6029IBM Emptoris Strategic Supply Management Platform 10.0 and 10.1 could allow a remote attacker to obtain sensitive information, caused by theIBM Emptoris Strategic Supply Management
- CVE-2017-1190IBM Emptoris Strategic Supply Management Platform 10.x and 10.1 could allow a local user with special access roles to execute arbitrary codeIBM Emptoris Strategic Supply Management
- CVE-2017-1469IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a local user to gain elevated privileges by placing arbitrary files in insIBM InfoSphere Information Server
- CVE-2017-12426GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.
- CVE-2017-12850An authenticated standard user could reset the password of other users (including the admin) by altering form data.
- CVE-2017-12851An authenticated standard user could reset the password of the admin by altering form data.
- CVE-2017-12853The RealTime RWR-3G-100 Router Firmware Version : Ver1.0.56 is affected by CSRF an attack that forces an end user to execute unwanted action
- CVE-2017-11149Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 Synology Download Station
- CVE-2017-11150Command injection vulnerability in Document.php in Synology Office 2.2.0-1502 and 2.2.1-1506 allows remote authenticated users to execute ar
- CVE-2017-11156Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which Synology Download Station
- CVE-2017-9646An Uncontrolled Search Path Element issue was discovered in Solar Controls Heating Control Downloader (HCDownloader) Version 1.0.1.15 and pr
- CVE-2017-9648An Uncontrolled Search Path Element issue was discovered in Solar Controls WATTConfig M Software Version 2.5.10.1 and prior.
- CVE-2017-9653An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft A
- CVE-2017-9655A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azur
- CVE-2017-9659A Stack-Based Buffer Overflow issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0.
- CVE-2017-9660A Heap-Based Buffer Overflow was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0.
- CVE-2017-9661An Uncontrolled Search Path Element issue was discovered in SIMPlight SCADA Software version 4.3.0.27 and prior.
- CVE-2017-9662An Improper Privilege Management issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0.
- CVE-2017-9802The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input striorg.apache.sling:org.apache.sling.servlets.post