CVEs published August 28, 2017
104 CVEs were published on August 28, 2017: 0 critical, 0 high.
- Published
- 104
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 104
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Cybozu Garoon
- 5
- NIPPON ANTENNA Co. "Dokodemo eye Smart HD" SCR02HD
- 3
- baserCMS Users Community baserCMS · baserproject/basercms
- 2
- IBM Cram Social Program Management
- 2
- k5n.us WebCalendar
- 2
- SEO Panel
- 2
- BackupGuard
- 1
- baserproject/basercms
- 1
- GE Multilink ML800/1200/1600/2400 · GE ML810/3000/3100 seri…
- 1
- IBM Operations Analytics Predictive Insights
- 1
Medium, low and unrated 104
- CVE-2015-8300Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\polycom\polycom btoe connector\p
- CVE-2015-8332Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which
- CVE-2017-13716The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial
- CVE-2014-8393DLL Hijacking vulnerability in CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015, and Corel PDF Fusion.
- CVE-2014-8872Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and
- CVE-2015-0234Multiple temporary file creation vulnerabilities in pki-core 10.2.0.
- CVE-2016-2970IBM Sametime 8.5 and 9.0 meetings server may provide detailed information in an error message that may provide details about the applicationIBM Sametime
- CVE-2016-9732IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting.IBM Cram Social Program Management
- CVE-2017-10812Untrusted search path vulnerability in Photo Collection PC Software Ver.4.0.2 and earlier allows an attacker to gain privileges via a TrojanNTT DOCOMO Photo Collection PC Software
- CVE-2017-10826Untrusted search path vulnerability in Security Kinou Mihariban v1.0.21 and earlier allows an attacker to gain privileges via a Trojan horseNIPPON TELEGRAPH AND TELEPHONE WEST Security Kinou Mihariban
- CVE-2017-10827Untrusted search path vulnerability in Flets Azukeru for Windows Auto Backup Tool v1.0.3.0 and earlier allows an attacker to gain privilegesNIPPON TELEGRAPH AND TELEPHONE WEST Flets Azukeru for Windo…
- CVE-2017-10828Untrusted search path vulnerability in Flets Install Tool all versions distributed through the website till 2017 August 8 allows an attackerNIPPON TELEGRAPH AND TELEPHONE WEST Flets Install Tool
- CVE-2017-10830Untrusted search path vulnerability in Security Setup Tool all versions allows an attacker to gain privileges via a Trojan horse DLL in an uNIPPON TELEGRAPH AND TELEPHONE WEST Security Setup Tool
- CVE-2017-10831Untrusted search path vulnerability in The electronic authentication system based on the commercial registration system "The CRCA user's Sof
- CVE-2017-10832"Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vecNIPPON ANTENNA Co. "Dokodemo eye Smart HD" SCR02HD
- CVE-2017-10833"Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to bypass access restriction to view information or NIPPON ANTENNA Co. "Dokodemo eye Smart HD" SCR02HD
- CVE-2017-10834Directory traversal vulnerability in "Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows authenticated attackers to read NIPPON ANTENNA Co. "Dokodemo eye Smart HD" SCR02HD
- CVE-2017-10835"Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows authenticated attackers to conduct code injection attacks via unspeci
- CVE-2017-10836Untrusted search path vulnerability in Optimal Guard 1.1.21 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an uOptimal Guard
- CVE-2017-10837Cross-site scripting vulnerability in BackupGuard prior to version 1.1.47 allows an attacker to inject arbitrary web script or HTML via unspBackupGuard
- CVE-2017-10838Cross-site scripting vulnerability in SEO Panel prior to version 3.11.0 allows an attacker to inject arbitrary web script or HTML via unspecSEO Panel
- CVE-2017-10839SQL injection vulnerability in the SEO Panel prior to version 3.11.0 allows authenticated attackers to execute arbitrary SQL commands via unSEO Panel
- CVE-2017-10840Cross-site scripting vulnerability in WebCalendar 1.2.7 and earlier allows an attacker to inject arbitrary web script or HTML via unspecifiek5n.us WebCalendar
- CVE-2017-10841Directory traversal vulnerability in WebCalendar 1.2.7 and earlier allows authenticated attackers to read arbitrary files via unspecified vek5n.us WebCalendar
- CVE-2017-10842SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands baserCMS Users Community baserCMS · baserproject/basercms
- CVE-2017-10843baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified vectors when the "FbaserCMS Users Community baserCMS · baserproject/basercms
- CVE-2017-10844baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors.baserproject/basercms
- CVE-2017-1110IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 contains an unspecified vulnerability that could allow an authenticated user to vIBM Cram Social Program Management
- CVE-2017-13715The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto, ip_proto, and thof
- CVE-2017-1376A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges.IBM Operations Analytics Predictive Insights
- CVE-2017-1489IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability.IBM Security Access Manager for Web
- CVE-2017-2242Untrusted search path vulnerability in Flets Setsuzoku Tool for Windows all versions allows an attacker to gain privileges via a Trojan horsNIPPON TELEGRAPH AND TELEPHONE WEST Flets Setsuzoku Tool fo…
- CVE-2017-2254Cybozu Garoon 3.5.0 to 4.2.5 allows an attacker to cause a denial of service in the application menu's edit function via specially crafted iCybozu Garoon
- CVE-2017-2255Cross-site scripting vulnerability in Cybozu Garoon 3.7.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text"Cybozu Garoon
- CVE-2017-2256Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text"Cybozu Garoon
- CVE-2017-2257Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via mail functiCybozu Garoon
- CVE-2017-2258Directory traversal vulnerability in Cybozu Garoon 4.2.4 to 4.2.5 allows an attacker to read arbitrary files via Garoon SOAP API "WorkflowHaCybozu Garoon
- CVE-2017-3746ThinkPad USB 3.0 Ethernet Adapter (part number 4X90E51405) driver, various versions, was found to contain a privilege escalation vulnerabiliLenovo Group ThinkPad USB 3.0 Ethernet Adapter Driver
- CVE-2017-3757An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand nLenovo Group Lenovo ElanTech Touchpad driver
- CVE-2013-7430Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla! allows remote attackers to inject arbitrary web scr
- CVE-2014-8163Directory traversal vulnerability in the XMLRPC interface in Red Hat Satellite 5.
- CVE-2015-0233Multiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38.
- CVE-2015-1554kgb-bot 1.33-2 allows remote attackers to cause a denial of service (crash).
- CVE-2015-1600Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier.
- CVE-2017-12076Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM) before 6.1.1-15088 allows re
- CVE-2017-12077Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology Router Manager (SRM) before 1.1.4-6509 allows
- CVE-2017-12840A kernel driver, namely DLMFENC.sys, bundled with the DESLock+ client application 4.8.16 and earlier contains a locally exploitable heap bas
- CVE-2017-12876Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted fil
- CVE-2017-12877Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial
- CVE-2017-12919Heap-based buffer overflow in OLEStream::WriteVT_LPSTR in olestrm.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of servic
- CVE-2017-12920CDirectory::GetDirEntry in dir.cxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a
- CVE-2017-12921PFileFlashPixView::GetGlobalInfoProperty in f_fpxvw.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointe
- CVE-2017-12922wchar.c in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image.
- CVE-2017-12923OLEStream::WriteVT_LPSTR in olestrm.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) v
- CVE-2017-12924CDirVector::GetTable in dirfunc.hxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (divide-by-zero error) via a cra
- CVE-2017-12925Double free vulnerability in DfFromLB in docfile.cxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service via a crafted f
- CVE-2017-12950The gig::Region::Region function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference a
- CVE-2017-12951The gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (stac
- CVE-2017-12952The LoadString function in helper.h in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and appli
- CVE-2017-12953The gig::Instrument::UpdateRegionKeyTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid
- CVE-2017-12954The gig::Region::GetSampleFromWavePool function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid mem
- CVE-2017-13712NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of S
- CVE-2017-3735While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread.OpenSSL Software Foundation OpenSSL
- CVE-2017-6594The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging
- CVE-2017-9978On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, a flaw was found with the error message sent as a response for users that don't
- CVE-2017-9979On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing
- CVE-2012-2805Unspecified vulnerability in FFMPEG 0.10 allows remote attackers to cause a denial of service.
- CVE-2013-0870The 'vp3_decode_frame' function in FFmpeg 1.1.4 moves threads check out of header packet type check.
- CVE-2014-0141Cross-site scripting (XSS) vulnerability in Red Hat Satellite 6.0.3.
- CVE-2014-4925Cross-site scripting (XSS) vulnerability in Good for Enterprise for Android 2.8.0.398 and 1.9.0.40.
- CVE-2014-5301Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to
- CVE-2014-5302Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9
- CVE-2014-8168Red Hat Satellite 6 allows local users to access mongod and delete pulp_database.
- CVE-2014-8426Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015.
- CVE-2014-8428Privilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 via the use of an improperly protected SSH key.
- CVE-2014-8753Multiple cross-site scripting (XSS) vulnerabilities in Cit-e-Net Cit-e-Access 6.
- CVE-2014-8871Directory traversal vulnerability in hybris Commerce software suite 5.0.3.3 and earlier, 5.0.0.3 and earlier, 5.0.4.4 and earlier, 5.1.0.1 a
- CVE-2014-8900Cross-site request forgery (CSRF) vulnerability in IBM UrbanCode Release 6.0.1.6 and earlier, 6.1.0.7 and earlier, and 6.1.1.1 and earlier.
- CVE-2014-9312Unrestricted File Upload vulnerability in Photo Gallery 1.2.5.
- CVE-2014-9469Cross-site scripting (XSS) vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3.
- CVE-2014-9483Emacs 24.4 allows remote attackers to bypass security restrictions.
- CVE-2014-9513Insecure use of temporary files in xbindkeys-config 0.1.3-2 allows remote attackers to execute arbitrary code.
- CVE-2014-9514Cross-site scripting (XSS) vulnerability in BMC Footprints Service Core 11.5.
- CVE-2014-9557Multiple cross-site scripting (XSS) vulnerabilities in SmartCMS v.2.
- CVE-2014-9558Multiple SQL injection vulnerabilities in SmartCMS v.2.
- CVE-2015-0101Cross-site scripting (XSS) vulnerability in IBM Business Process Manager Standard 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5;
- CVE-2015-0114Stack-based buffer overflow in IBM V5R4, and IBM i Access for Windows 6.1 and 7.1.
- CVE-2015-0210wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack.
- CVE-2015-0928libhtp 0.5.15 allows remote attackers to cause a denial of service (NULL pointer dereference).
- CVE-2015-0974Untrusted search path vulnerability in ZTE Datacard MF19 0V1.0.0B04 allows local users to gain privilege by modifying the 'Ucell Internet' d
- CVE-2015-1177Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2.
- CVE-2015-1198Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5.
- CVE-2015-1199Directory traversal vulnerability in ppmd 10.1-5.
- CVE-2015-1386Directory traversal vulnerability in unshield 1.0-1.
- CVE-2015-1401Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3.
- CVE-2015-1430Buffer overflow in xymon 4.3.17-1.
- CVE-2015-1443The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code.
- CVE-2015-1445HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30.
- CVE-2015-1876Directory traversal vulnerability in ES File Explorer 3.2.4.1.
- CVE-2015-2046Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20.
- CVE-2015-3976GE Multilink Cross-site ScriptingGE Multilink ML800/1200/1600/2400 · GE ML810/3000/3100 seri…
- CVE-2016-0634The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters
- CVE-2016-7030FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to
- CVE-2017-8380Buffer overflow in the "megasas_mmio_write" function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors.