# CVEs published 2017-08-24

36 CVEs were published on August 24, 2017: 0 critical, 2 high. Days are UTC.

- [CVE-2017-13686](https://cve.now/CVE-2017-13686.md): net/ipv4/route.c in the Linux kernel 4.13-rc1 through 4.13-rc6 is too late to check for a NULL fi field when RTM\_F\_FIB\_MATCH is set, which a (no CVSS)
- [CVE-2015-4699](https://cve.now/CVE-2015-4699.md): Cross-site scripting (XSS) vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2015-8352](https://cve.now/CVE-2015-8352.md): Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (no CVSS)
- [CVE-2015-8355](https://cve.now/CVE-2015-8355.md): Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remote authenticated users to execu (no CVSS)
- [CVE-2014-4616](https://cve.now/CVE-2014-4616.md): Array index error in the scanstring function in the \_json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-depend (no CVSS, simplejson)
- [CVE-2015-1800](https://cve.now/CVE-2015-1800.md): The samsung\_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potentially obtain sensitive (no CVSS)
- [CVE-2015-1801](https://cve.now/CVE-2015-1801.md): The samsung\_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to cause a denial of service (m (no CVSS)
- [CVE-2015-5146](https://cve.now/CVE-2015-5146.md): ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password (no CVSS)
- [CVE-2015-5293](https://cve.now/CVE-2015-5293.md): Red Hat Enterprise Virtualization Manager 3.6 and earlier gives valid SLAAC IPv6 addresses to interfaces when "boot protocol" is set to None (no CVSS)
- [CVE-2015-7257](https://cve.now/CVE-2015-7257.md): ZTE ADSL ZXV10 W300 modems W300V2.1.0f\_ER7\_PE\_O57 and W300V2.1.0h\_ER7\_PE\_O57 allow remote authenticated non-administrator users to change th (no CVSS)
- [CVE-2015-7258](https://cve.now/CVE-2015-7258.md): ZTE ADSL ZXV10 W300 modems W300V2.1.0f\_ER7\_PE\_O57 and W300V2.1.0h\_ER7\_PE\_O57 allow remote authenticated users to obtain user passwords by di (no CVSS)
- [CVE-2015-7259](https://cve.now/CVE-2015-7259.md): ZTE ADSL ZXV10 W300 modems W300V2.1.0f\_ER7\_PE\_O57 and W300V2.1.0h\_ER7\_PE\_O57 allow user accounts to have multiple valid username and passwor (no CVSS)
- [CVE-2015-7516](https://cve.now/CVE-2015-7516.md): ONOS before 1.5.0 when using the ifwd app allows remote attackers to cause a denial of service (NULL pointer dereference and switch disconne (no CVSS)
- [CVE-2015-7896](https://cve.now/CVE-2015-7896.md): LibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memory corruption and SIG (no CVSS)
- [CVE-2015-8308](https://cve.now/CVE-2015-8308.md): LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections. (no CVSS)
- [CVE-2017-12879](https://cve.now/CVE-2017-12879.md): Cross-site scripting (XSS-STORED) vulnerability in the DEVICES OR SENSORS functionality in Paessler PRTG Network Monitor before 17.3.33.2654 (no CVSS)
- [CVE-2017-13671](https://cve.now/CVE-2017-13671.md): app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. (no CVSS)
- [CVE-2017-9555](https://cve.now/CVE-2017-9555.md): Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to in (no CVSS, Synology Photo Station)
- [CVE-2017-12074](https://cve.now/CVE-2017-12074.md): Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authentic (no CVSS, Synology DNS Server)
- [CVE-2017-9511](https://cve.now/CVE-2017-9511.md): The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary file (CVSS 7.5, Atlassian Fisheye and Crucible)
- [CVE-2017-12679](https://cve.now/CVE-2017-12679.md): SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php. (no CVSS)
- [CVE-2017-13669](https://cve.now/CVE-2017-13669.md): SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php. (no CVSS)
- [CVE-2017-9507](https://cve.now/CVE-2017-9507.md): The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML (no CVSS, Atlassian Crucible)
- [CVE-2017-9508](https://cve.now/CVE-2017-9508.md): Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a (no CVSS, Atlassian Fisheye and Crucible)
- [CVE-2017-9509](https://cve.now/CVE-2017-9509.md): The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript vi (no CVSS, Atlassian Crucible)
- [CVE-2017-9510](https://cve.now/CVE-2017-9510.md): The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript v (no CVSS, Atlassian Fisheye)
- [CVE-2017-9512](https://cve.now/CVE-2017-9512.md): The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sen (CVSS 7.5, Atlassian Fisheye and Crucible)
- [CVE-2017-11424](https://cve.now/CVE-2017-11424.md): In PyJWT 1.5.0 and below the \`invalid\_strings\` check in \`HMACAlgorithm.prepare\_key\` does not account for all PEM encoded public keys. (no CVSS, pyjwt)
- [CVE-2017-12134](https://cve.now/CVE-2017-12134.md): The xen\_biovec\_phys\_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data stream (no CVSS)
- [CVE-2017-12135](https://cve.now/CVE-2017-12135.md): Xen allows local OS guest users to cause a denial of service (crash) or possibly obtain sensitive information or gain privileges via vectors (no CVSS)
- [CVE-2017-12136](https://cve.now/CVE-2017-12136.md): Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrators to cause a denial of service (free li (no CVSS)
- [CVE-2017-12137](https://cve.now/CVE-2017-12137.md): arch/x86/mm.c in Xen allows local PV guest OS users to gain host OS privileges via vectors related to map\_grant\_ref. (no CVSS)
- [CVE-2017-12836](https://cve.now/CVE-2017-12836.md): CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL (no CVSS)
- [CVE-2017-13658](https://cve.now/CVE-2017-13658.md): In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missing NULL check in the ReadMATImage function in coders/mat.c, leading to (no CVSS)
- [CVE-2017-13666](https://cve.now/CVE-2017-13666.md): An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.5, as (no CVSS)
- [CVE-2017-0805](https://cve.now/CVE-2017-0805.md): A elevation of privilege vulnerability in the Android media framework (libstagefright). (no CVSS, Google Android)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-08-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.