# CVEs published 2017-08-28

104 CVEs were published on August 28, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2015-8300](https://cve.now/CVE-2015-8300.md): Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\\polycom\\polycom btoe connector\\p (no CVSS)
- [CVE-2015-8332](https://cve.now/CVE-2015-8332.md): Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which (no CVSS)
- [CVE-2017-13716](https://cve.now/CVE-2017-13716.md): The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial (no CVSS)
- [CVE-2014-8393](https://cve.now/CVE-2014-8393.md): DLL Hijacking vulnerability in CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015, and Corel PDF Fusion. (no CVSS)
- [CVE-2014-8872](https://cve.now/CVE-2014-8872.md): Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and (no CVSS)
- [CVE-2015-0234](https://cve.now/CVE-2015-0234.md): Multiple temporary file creation vulnerabilities in pki-core 10.2.0. (no CVSS)
- [CVE-2016-2970](https://cve.now/CVE-2016-2970.md): IBM Sametime 8.5 and 9.0 meetings server may provide detailed information in an error message that may provide details about the application (no CVSS, IBM Sametime)
- [CVE-2016-9732](https://cve.now/CVE-2016-9732.md): IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting. (no CVSS, IBM Cram Social Program Management)
- [CVE-2017-10812](https://cve.now/CVE-2017-10812.md): Untrusted search path vulnerability in Photo Collection PC Software Ver.4.0.2 and earlier allows an attacker to gain privileges via a Trojan (no CVSS, NTT DOCOMO Photo Collection PC Software)
- [CVE-2017-10826](https://cve.now/CVE-2017-10826.md): Untrusted search path vulnerability in Security Kinou Mihariban v1.0.21 and earlier allows an attacker to gain privileges via a Trojan horse (no CVSS, NIPPON TELEGRAPH AND TELEPHONE WEST Security Kinou Mihariban)
- [CVE-2017-10827](https://cve.now/CVE-2017-10827.md): Untrusted search path vulnerability in Flets Azukeru for Windows Auto Backup Tool v1.0.3.0 and earlier allows an attacker to gain privileges (no CVSS, NIPPON TELEGRAPH AND TELEPHONE WEST Flets Azukeru for Windo…)
- [CVE-2017-10828](https://cve.now/CVE-2017-10828.md): Untrusted search path vulnerability in Flets Install Tool all versions distributed through the website till 2017 August 8 allows an attacker (no CVSS, NIPPON TELEGRAPH AND TELEPHONE WEST Flets Install Tool)
- [CVE-2017-10830](https://cve.now/CVE-2017-10830.md): Untrusted search path vulnerability in Security Setup Tool all versions allows an attacker to gain privileges via a Trojan horse DLL in an u (no CVSS, NIPPON TELEGRAPH AND TELEPHONE WEST Security Setup Tool)
- [CVE-2017-10831](https://cve.now/CVE-2017-10831.md): Untrusted search path vulnerability in The electronic authentication system based on the commercial registration system "The CRCA user's Sof (no CVSS)
- [CVE-2017-10832](https://cve.now/CVE-2017-10832.md): "Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vec (no CVSS, NIPPON ANTENNA Co. "Dokodemo eye Smart HD" SCR02HD)
- [CVE-2017-10833](https://cve.now/CVE-2017-10833.md): "Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to bypass access restriction to view information or (no CVSS, NIPPON ANTENNA Co. "Dokodemo eye Smart HD" SCR02HD)
- [CVE-2017-10834](https://cve.now/CVE-2017-10834.md): Directory traversal vulnerability in "Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows authenticated attackers to read (no CVSS, NIPPON ANTENNA Co. "Dokodemo eye Smart HD" SCR02HD)
- [CVE-2017-10835](https://cve.now/CVE-2017-10835.md): "Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows authenticated attackers to conduct code injection attacks via unspeci (no CVSS)
- [CVE-2017-10836](https://cve.now/CVE-2017-10836.md): Untrusted search path vulnerability in Optimal Guard 1.1.21 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an u (no CVSS, Optimal Guard)
- [CVE-2017-10837](https://cve.now/CVE-2017-10837.md): Cross-site scripting vulnerability in BackupGuard prior to version 1.1.47 allows an attacker to inject arbitrary web script or HTML via unsp (no CVSS, BackupGuard)
- [CVE-2017-10838](https://cve.now/CVE-2017-10838.md): Cross-site scripting vulnerability in SEO Panel prior to version 3.11.0 allows an attacker to inject arbitrary web script or HTML via unspec (no CVSS, SEO Panel)
- [CVE-2017-10839](https://cve.now/CVE-2017-10839.md): SQL injection vulnerability in the SEO Panel prior to version 3.11.0 allows authenticated attackers to execute arbitrary SQL commands via un (no CVSS, SEO Panel)
- [CVE-2017-10840](https://cve.now/CVE-2017-10840.md): Cross-site scripting vulnerability in WebCalendar 1.2.7 and earlier allows an attacker to inject arbitrary web script or HTML via unspecifie (no CVSS, k5n.us WebCalendar)
- [CVE-2017-10841](https://cve.now/CVE-2017-10841.md): Directory traversal vulnerability in WebCalendar 1.2.7 and earlier allows authenticated attackers to read arbitrary files via unspecified ve (no CVSS, k5n.us WebCalendar)
- [CVE-2017-10842](https://cve.now/CVE-2017-10842.md): SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands (no CVSS, baserCMS Users Community baserCMS · baserproject/basercms)
- [CVE-2017-10843](https://cve.now/CVE-2017-10843.md): baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified vectors when the "F (no CVSS, baserCMS Users Community baserCMS · baserproject/basercms)
- [CVE-2017-10844](https://cve.now/CVE-2017-10844.md): baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors. (no CVSS, baserproject/basercms)
- [CVE-2017-1110](https://cve.now/CVE-2017-1110.md): IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 contains an unspecified vulnerability that could allow an authenticated user to v (no CVSS, IBM Cram Social Program Management)
- [CVE-2017-13715](https://cve.now/CVE-2017-13715.md): The \_\_skb\_flow\_dissect function in net/core/flow\_dissector.c in the Linux kernel before 4.3 does not ensure that n\_proto, ip\_proto, and thof (no CVSS)
- [CVE-2017-1376](https://cve.now/CVE-2017-1376.md): A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. (no CVSS, IBM Operations Analytics Predictive Insights)
- [CVE-2017-1489](https://cve.now/CVE-2017-1489.md): IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability. (no CVSS, IBM Security Access Manager for Web)
- [CVE-2017-2242](https://cve.now/CVE-2017-2242.md): Untrusted search path vulnerability in Flets Setsuzoku Tool for Windows all versions allows an attacker to gain privileges via a Trojan hors (no CVSS, NIPPON TELEGRAPH AND TELEPHONE WEST Flets Setsuzoku Tool fo…)
- [CVE-2017-2254](https://cve.now/CVE-2017-2254.md): Cybozu Garoon 3.5.0 to 4.2.5 allows an attacker to cause a denial of service in the application menu's edit function via specially crafted i (no CVSS, Cybozu Garoon)
- [CVE-2017-2255](https://cve.now/CVE-2017-2255.md): Cross-site scripting vulnerability in Cybozu Garoon 3.7.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" (no CVSS, Cybozu Garoon)
- [CVE-2017-2256](https://cve.now/CVE-2017-2256.md): Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" (no CVSS, Cybozu Garoon)
- [CVE-2017-2257](https://cve.now/CVE-2017-2257.md): Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via mail functi (no CVSS, Cybozu Garoon)
- [CVE-2017-2258](https://cve.now/CVE-2017-2258.md): Directory traversal vulnerability in Cybozu Garoon 4.2.4 to 4.2.5 allows an attacker to read arbitrary files via Garoon SOAP API "WorkflowHa (no CVSS, Cybozu Garoon)
- [CVE-2017-3746](https://cve.now/CVE-2017-3746.md): ThinkPad USB 3.0 Ethernet Adapter (part number 4X90E51405) driver, various versions, was found to contain a privilege escalation vulnerabili (no CVSS, Lenovo Group ThinkPad USB 3.0 Ethernet Adapter Driver)
- [CVE-2017-3757](https://cve.now/CVE-2017-3757.md): An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand n (no CVSS, Lenovo Group Lenovo ElanTech Touchpad driver)
- [CVE-2013-7430](https://cve.now/CVE-2013-7430.md): Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla! allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2014-8163](https://cve.now/CVE-2014-8163.md): Directory traversal vulnerability in the XMLRPC interface in Red Hat Satellite 5. (no CVSS)
- [CVE-2015-0233](https://cve.now/CVE-2015-0233.md): Multiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38. (no CVSS)
- [CVE-2015-1554](https://cve.now/CVE-2015-1554.md): kgb-bot 1.33-2 allows remote attackers to cause a denial of service (crash). (no CVSS)
- [CVE-2015-1600](https://cve.now/CVE-2015-1600.md): Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier. (no CVSS)
- [CVE-2017-12076](https://cve.now/CVE-2017-12076.md): Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM) before 6.1.1-15088 allows re (no CVSS)
- [CVE-2017-12077](https://cve.now/CVE-2017-12077.md): Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology Router Manager (SRM) before 1.1.4-6509 allows (no CVSS)
- [CVE-2017-12840](https://cve.now/CVE-2017-12840.md): A kernel driver, namely DLMFENC.sys, bundled with the DESLock+ client application 4.8.16 and earlier contains a locally exploitable heap bas (no CVSS)
- [CVE-2017-12876](https://cve.now/CVE-2017-12876.md): Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted fil (no CVSS)
- [CVE-2017-12877](https://cve.now/CVE-2017-12877.md): Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial (no CVSS)
- [CVE-2017-12919](https://cve.now/CVE-2017-12919.md): Heap-based buffer overflow in OLEStream::WriteVT\_LPSTR in olestrm.cpp in libfpx 1.3.1\_p6 allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2017-12920](https://cve.now/CVE-2017-12920.md): CDirectory::GetDirEntry in dir.cxx in libfpx 1.3.1\_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a (no CVSS)
- [CVE-2017-12921](https://cve.now/CVE-2017-12921.md): PFileFlashPixView::GetGlobalInfoProperty in f\_fpxvw.cpp in libfpx 1.3.1\_p6 allows remote attackers to cause a denial of service (NULL pointe (no CVSS)
- [CVE-2017-12922](https://cve.now/CVE-2017-12922.md): wchar.c in libfpx 1.3.1\_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image. (no CVSS)
- [CVE-2017-12923](https://cve.now/CVE-2017-12923.md): OLEStream::WriteVT\_LPSTR in olestrm.cpp in libfpx 1.3.1\_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) v (no CVSS)
- [CVE-2017-12924](https://cve.now/CVE-2017-12924.md): CDirVector::GetTable in dirfunc.hxx in libfpx 1.3.1\_p6 allows remote attackers to cause a denial of service (divide-by-zero error) via a cra (no CVSS)
- [CVE-2017-12925](https://cve.now/CVE-2017-12925.md): Double free vulnerability in DfFromLB in docfile.cxx in libfpx 1.3.1\_p6 allows remote attackers to cause a denial of service via a crafted f (no CVSS)
- [CVE-2017-12950](https://cve.now/CVE-2017-12950.md): The gig::Region::Region function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference a (no CVSS)
- [CVE-2017-12951](https://cve.now/CVE-2017-12951.md): The gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (stac (no CVSS)
- [CVE-2017-12952](https://cve.now/CVE-2017-12952.md): The LoadString function in helper.h in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and appli (no CVSS)
- [CVE-2017-12953](https://cve.now/CVE-2017-12953.md): The gig::Instrument::UpdateRegionKeyTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid (no CVSS)
- [CVE-2017-12954](https://cve.now/CVE-2017-12954.md): The gig::Region::GetSampleFromWavePool function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid mem (no CVSS)
- [CVE-2017-13712](https://cve.now/CVE-2017-13712.md): NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of S (no CVSS)
- [CVE-2017-3735](https://cve.now/CVE-2017-3735.md): While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. (no CVSS, OpenSSL Software Foundation OpenSSL)
- [CVE-2017-6594](https://cve.now/CVE-2017-6594.md): The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging (no CVSS)
- [CVE-2017-9978](https://cve.now/CVE-2017-9978.md): On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, a flaw was found with the error message sent as a response for users that don't (no CVSS)
- [CVE-2017-9979](https://cve.now/CVE-2017-9979.md): On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing (no CVSS)
- [CVE-2012-2805](https://cve.now/CVE-2012-2805.md): Unspecified vulnerability in FFMPEG 0.10 allows remote attackers to cause a denial of service. (no CVSS)
- [CVE-2013-0870](https://cve.now/CVE-2013-0870.md): The 'vp3\_decode\_frame' function in FFmpeg 1.1.4 moves threads check out of header packet type check. (no CVSS)
- [CVE-2014-0141](https://cve.now/CVE-2014-0141.md): Cross-site scripting (XSS) vulnerability in Red Hat Satellite 6.0.3. (no CVSS)
- [CVE-2014-4925](https://cve.now/CVE-2014-4925.md): Cross-site scripting (XSS) vulnerability in Good for Enterprise for Android 2.8.0.398 and 1.9.0.40. (no CVSS)
- [CVE-2014-5301](https://cve.now/CVE-2014-5301.md): Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to (no CVSS)
- [CVE-2014-5302](https://cve.now/CVE-2014-5302.md): Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9 (no CVSS)
- [CVE-2014-8168](https://cve.now/CVE-2014-8168.md): Red Hat Satellite 6 allows local users to access mongod and delete pulp\_database. (no CVSS)
- [CVE-2014-8426](https://cve.now/CVE-2014-8426.md): Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015. (no CVSS)
- [CVE-2014-8428](https://cve.now/CVE-2014-8428.md): Privilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 via the use of an improperly protected SSH key. (no CVSS)
- [CVE-2014-8753](https://cve.now/CVE-2014-8753.md): Multiple cross-site scripting (XSS) vulnerabilities in Cit-e-Net Cit-e-Access 6. (no CVSS)
- [CVE-2014-8871](https://cve.now/CVE-2014-8871.md): Directory traversal vulnerability in hybris Commerce software suite 5.0.3.3 and earlier, 5.0.0.3 and earlier, 5.0.4.4 and earlier, 5.1.0.1 a (no CVSS)
- [CVE-2014-8900](https://cve.now/CVE-2014-8900.md): Cross-site request forgery (CSRF) vulnerability in IBM UrbanCode Release 6.0.1.6 and earlier, 6.1.0.7 and earlier, and 6.1.1.1 and earlier. (no CVSS)
- [CVE-2014-9312](https://cve.now/CVE-2014-9312.md): Unrestricted File Upload vulnerability in Photo Gallery 1.2.5. (no CVSS)
- [CVE-2014-9469](https://cve.now/CVE-2014-9469.md): Cross-site scripting (XSS) vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3. (no CVSS)
- [CVE-2014-9483](https://cve.now/CVE-2014-9483.md): Emacs 24.4 allows remote attackers to bypass security restrictions. (no CVSS)
- [CVE-2014-9513](https://cve.now/CVE-2014-9513.md): Insecure use of temporary files in xbindkeys-config 0.1.3-2 allows remote attackers to execute arbitrary code. (no CVSS)
- [CVE-2014-9514](https://cve.now/CVE-2014-9514.md): Cross-site scripting (XSS) vulnerability in BMC Footprints Service Core 11.5. (no CVSS)
- [CVE-2014-9557](https://cve.now/CVE-2014-9557.md): Multiple cross-site scripting (XSS) vulnerabilities in SmartCMS v.2. (no CVSS)
- [CVE-2014-9558](https://cve.now/CVE-2014-9558.md): Multiple SQL injection vulnerabilities in SmartCMS v.2. (no CVSS)
- [CVE-2015-0101](https://cve.now/CVE-2015-0101.md): Cross-site scripting (XSS) vulnerability in IBM Business Process Manager Standard 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; (no CVSS)
- [CVE-2015-0114](https://cve.now/CVE-2015-0114.md): Stack-based buffer overflow in IBM V5R4, and IBM i Access for Windows 6.1 and 7.1. (no CVSS)
- [CVE-2015-0210](https://cve.now/CVE-2015-0210.md): wpa\_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack. (no CVSS)
- [CVE-2015-0928](https://cve.now/CVE-2015-0928.md): libhtp 0.5.15 allows remote attackers to cause a denial of service (NULL pointer dereference). (no CVSS)
- [CVE-2015-0974](https://cve.now/CVE-2015-0974.md): Untrusted search path vulnerability in ZTE Datacard MF19 0V1.0.0B04 allows local users to gain privilege by modifying the 'Ucell Internet' d (no CVSS)
- [CVE-2015-1177](https://cve.now/CVE-2015-1177.md): Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2. (no CVSS)
- [CVE-2015-1198](https://cve.now/CVE-2015-1198.md): Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5. (no CVSS)
- [CVE-2015-1199](https://cve.now/CVE-2015-1199.md): Directory traversal vulnerability in ppmd 10.1-5. (no CVSS)
- [CVE-2015-1386](https://cve.now/CVE-2015-1386.md): Directory traversal vulnerability in unshield 1.0-1. (no CVSS)
- [CVE-2015-1401](https://cve.now/CVE-2015-1401.md): Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig\_ldap\_sso\_auth) extension 2.0.0 for TYPO3. (no CVSS)
- [CVE-2015-1430](https://cve.now/CVE-2015-1430.md): Buffer overflow in xymon 4.3.17-1. (no CVSS)
- [CVE-2015-1443](https://cve.now/CVE-2015-1443.md): The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code. (no CVSS)
- [CVE-2015-1445](https://cve.now/CVE-2015-1445.md): HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30. (no CVSS)
- [CVE-2015-1876](https://cve.now/CVE-2015-1876.md): Directory traversal vulnerability in ES File Explorer 3.2.4.1. (no CVSS)
- [CVE-2015-2046](https://cve.now/CVE-2015-2046.md): Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20. (no CVSS)
- [CVE-2015-3976](https://cve.now/CVE-2015-3976.md): GE Multilink Cross-site Scripting (no CVSS, GE Multilink ML800/1200/1600/2400 · GE ML810/3000/3100 seri…)
- [CVE-2016-0634](https://cve.now/CVE-2016-0634.md): The expansion of '\\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters (no CVSS)
- [CVE-2016-7030](https://cve.now/CVE-2016-7030.md): FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to (no CVSS)
- [CVE-2017-8380](https://cve.now/CVE-2017-8380.md): Buffer overflow in the "megasas\_mmio\_write" function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-08-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.