CVEs published August 25, 2017
36 CVEs were published on August 25, 2017: 0 critical, 0 high.
- Published
- 36
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Automated Logic Corporation WebCTRL, i-VU, SiteScan
- 3
- Kaspersky Lab Kaspersky Internet Security for Android
- 2
- OSIsoft PI Server
- 2
- Westermo MRD-305-DIN, MRD-315, MRD-355, and MRD-455
- 2
- OSIsoft PI Web API
- 1
- pykerberos · kerberos
- 1
- salt
- 1
- SpiderControl SCADA MicroBrowser
- 1
- SpiderControl SCADA Web Server
- 1
- zendframework/zend-diactoros
- 1
Medium, low and unrated 36
- CVE-2017-12816In Kaspersky Internet Security for Android 11.12.4.1622, some of application exports activities have weak permissions, which might be used bKaspersky Lab Kaspersky Internet Security for Android
- CVE-2017-12817In Kaspersky Internet Security for Android 11.12.4.1622, some of the application trace files were not encrypted.Kaspersky Lab Kaspersky Internet Security for Android
- CVE-2017-12694A Directory Traversal issue was discovered in SpiderControl SCADA Web Server.SpiderControl SCADA Web Server
- CVE-2017-12707A Stack-based Buffer Overflow issue was discovered in SpiderControl SCADA MicroBrowser Versions 1.6.30.144 and prior.SpiderControl SCADA MicroBrowser
- CVE-2017-12857Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 ar
- CVE-2017-7926A Cross-Site Request Forgery issue was discovered in OSIsoft PI Web API versions prior to 2017 (1.9.0).OSIsoft PI Web API
- CVE-2017-7930An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017.OSIsoft PI Server
- CVE-2017-7934An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017.OSIsoft PI Server
- CVE-2017-9640A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteScAutomated Logic Corporation WebCTRL, i-VU, SiteScan
- CVE-2017-9644An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; Automated Logic Corporation WebCTRL, i-VU, SiteScan
- CVE-2017-9650An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan WebAutomated Logic Corporation WebCTRL, i-VU, SiteScan
- CVE-2014-7857D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05
- CVE-2014-7858The check_login function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the u
- CVE-2014-7859Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322L before 2.10 build 03, DNR-32
- CVE-2014-7860The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate request
- CVE-2014-9564CRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware before 3.4.1110 allows remot
- CVE-2014-9637GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fault) via a crafted d
- CVE-2015-1324Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11
- CVE-2015-1325Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2
- CVE-2015-1395Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to ar
- CVE-2015-3206The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers tpykerberos · kerberos
- CVE-2015-3211php-fpm allows local users to write to or create arbitrary files via a symlink attack.
- CVE-2015-3257Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perforzendframework/zend-diactoros
- CVE-2015-4017Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.salt
- CVE-2015-4180Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.4 allows remote attackers to read arbitrary files via a ..
- CVE-2015-4181Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a ..
- CVE-2015-5700mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.
- CVE-2015-5701mktexlsr revision 36855, and before revision 36626 as packaged in texlive allows local users to write to arbitrary files via a symlink attac
- CVE-2017-13697controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable.
- CVE-2016-5816A Use of Hard-Coded Cryptographic Key issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 version
- CVE-2017-12703A Cross-Site Request Forgery (CSRF) issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 Westermo MRD-305-DIN, MRD-315, MRD-355, and MRD-455
- CVE-2017-12709A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions oldeWestermo MRD-305-DIN, MRD-315, MRD-355, and MRD-455
- CVE-2017-13692In Tidy 5.5.31, the IsURLCodePoint function in attrs.c allows attackers to cause a denial of service (Segmentation Fault), as demonstrated b
- CVE-2017-13693The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flush the operand cache
- CVE-2017-13694The acpi_ps_complete_final_op() function in drivers/acpi/acpica/psobject.c in the Linux kernel through 4.12.9 does not flush the node and no
- CVE-2017-13695The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the operand cache and caus