# CVEs published 2017-08-14 20 CVEs were published on August 14, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2016-6021](https://cve.now/CVE-2016-6021.md): IBM Emptoris Strategic Supply Management Platform 10.0 and 10.1 is vulnerable to cross-site scripting. (no CVSS, IBM Emptoris Strategic Supply Management) - [CVE-2016-6029](https://cve.now/CVE-2016-6029.md): IBM Emptoris Strategic Supply Management Platform 10.0 and 10.1 could allow a remote attacker to obtain sensitive information, caused by the (no CVSS, IBM Emptoris Strategic Supply Management) - [CVE-2017-1190](https://cve.now/CVE-2017-1190.md): IBM Emptoris Strategic Supply Management Platform 10.x and 10.1 could allow a local user with special access roles to execute arbitrary code (no CVSS, IBM Emptoris Strategic Supply Management) - [CVE-2017-1469](https://cve.now/CVE-2017-1469.md): IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a local user to gain elevated privileges by placing arbitrary files in ins (no CVSS, IBM InfoSphere Information Server) - [CVE-2017-12426](https://cve.now/CVE-2017-12426.md): GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3. (no CVSS) - [CVE-2017-12850](https://cve.now/CVE-2017-12850.md): An authenticated standard user could reset the password of other users (including the admin) by altering form data. (no CVSS) - [CVE-2017-12851](https://cve.now/CVE-2017-12851.md): An authenticated standard user could reset the password of the admin by altering form data. (no CVSS) - [CVE-2017-12853](https://cve.now/CVE-2017-12853.md): The RealTime RWR-3G-100 Router Firmware Version : Ver1.0.56 is affected by CSRF an attack that forces an end user to execute unwanted action (no CVSS) - [CVE-2017-11149](https://cve.now/CVE-2017-11149.md): Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 (no CVSS, Synology Download Station) - [CVE-2017-11150](https://cve.now/CVE-2017-11150.md): Command injection vulnerability in Document.php in Synology Office 2.2.0-1502 and 2.2.1-1506 allows remote authenticated users to execute ar (no CVSS) - [CVE-2017-11156](https://cve.now/CVE-2017-11156.md): Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which (no CVSS, Synology Download Station) - [CVE-2017-9646](https://cve.now/CVE-2017-9646.md): An Uncontrolled Search Path Element issue was discovered in Solar Controls Heating Control Downloader (HCDownloader) Version 1.0.1.15 and pr (no CVSS) - [CVE-2017-9648](https://cve.now/CVE-2017-9648.md): An Uncontrolled Search Path Element issue was discovered in Solar Controls WATTConfig M Software Version 2.5.10.1 and prior. (no CVSS) - [CVE-2017-9653](https://cve.now/CVE-2017-9653.md): An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft A (no CVSS) - [CVE-2017-9655](https://cve.now/CVE-2017-9655.md): A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azur (no CVSS) - [CVE-2017-9659](https://cve.now/CVE-2017-9659.md): A Stack-Based Buffer Overflow issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. (no CVSS) - [CVE-2017-9660](https://cve.now/CVE-2017-9660.md): A Heap-Based Buffer Overflow was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. (no CVSS) - [CVE-2017-9661](https://cve.now/CVE-2017-9661.md): An Uncontrolled Search Path Element issue was discovered in SIMPlight SCADA Software version 4.3.0.27 and prior. (no CVSS) - [CVE-2017-9662](https://cve.now/CVE-2017-9662.md): An Improper Privilege Management issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. (no CVSS) - [CVE-2017-9802](https://cve.now/CVE-2017-9802.md): The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input stri (no CVSS, org.apache.sling:org.apache.sling.servlets.post) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-08-14 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.