CVEs published August 24, 2017
36 CVEs were published on August 24, 2017: 0 critical, 2 high.
- Published
- 36
- Critical
- 0
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 34
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Atlassian Fisheye and Crucible
- 3
- Atlassian Crucible
- 2
- Atlassian Fisheye
- 1
- Google Android
- 1
- pyjwt
- 1
- simplejson
- 1
- Synology DNS Server
- 1
- Synology Photo Station
- 1
High 2
- CVE-2017-9511The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary fileAtlassian Fisheye and Crucible
- CVE-2017-9512The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access senAtlassian Fisheye and Crucible
Medium, low and unrated 34
- CVE-2017-13686net/ipv4/route.c in the Linux kernel 4.13-rc1 through 4.13-rc6 is too late to check for a NULL fi field when RTM_F_FIB_MATCH is set, which a
- CVE-2015-4699Cross-site scripting (XSS) vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web scrip
- CVE-2015-8352Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a ..
- CVE-2015-8355Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remote authenticated users to execu
- CVE-2014-4616Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependsimplejson
- CVE-2015-1800The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potentially obtain sensitive
- CVE-2015-1801The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to cause a denial of service (m
- CVE-2015-5146ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password
- CVE-2015-5293Red Hat Enterprise Virtualization Manager 3.6 and earlier gives valid SLAAC IPv6 addresses to interfaces when "boot protocol" is set to None
- CVE-2015-7257ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change th
- CVE-2015-7258ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain user passwords by di
- CVE-2015-7259ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid username and passwor
- CVE-2015-7516ONOS before 1.5.0 when using the ifwd app allows remote attackers to cause a denial of service (NULL pointer dereference and switch disconne
- CVE-2015-7896LibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memory corruption and SIG
- CVE-2015-8308LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections.
- CVE-2017-12879Cross-site scripting (XSS-STORED) vulnerability in the DEVICES OR SENSORS functionality in Paessler PRTG Network Monitor before 17.3.33.2654
- CVE-2017-13671app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments.
- CVE-2017-9555Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inSynology Photo Station
- CVE-2017-12074Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authenticSynology DNS Server
- CVE-2017-12679SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
- CVE-2017-13669SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
- CVE-2017-9507The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTMLAtlassian Crucible
- CVE-2017-9508Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via aAtlassian Fisheye and Crucible
- CVE-2017-9509The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript viAtlassian Crucible
- CVE-2017-9510The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript vAtlassian Fisheye
- CVE-2017-11424In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys.pyjwt
- CVE-2017-12134The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data stream
- CVE-2017-12135Xen allows local OS guest users to cause a denial of service (crash) or possibly obtain sensitive information or gain privileges via vectors
- CVE-2017-12136Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrators to cause a denial of service (free li
- CVE-2017-12137arch/x86/mm.c in Xen allows local PV guest OS users to gain host OS privileges via vectors related to map_grant_ref.
- CVE-2017-12836CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL
- CVE-2017-13658In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missing NULL check in the ReadMATImage function in coders/mat.c, leading to
- CVE-2017-13666An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.5, as
- CVE-2017-0805A elevation of privilege vulnerability in the Android media framework (libstagefright).Google Android