CVEs published August 29, 2017
98 CVEs were published on August 29, 2017: 0 critical, 0 high.
- Published
- 98
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 98
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- IBM Sametime
- 21
- Apache Software Foundation Apache Atlas · apache-atlas +1
- 7
- IBM Cognos Analytics
- 4
- Zero Day Initiative Foxit Reader
- 2
- IBM Cram Social Program Management
- 1
- libgcrypt
- 1
- org.apache.struts:struts2-core
- 1
- simplesamlphp/simplesamlphp
- 1
- Zero Day Initiative Bitdefender Total Security
- 1
Medium, low and unrated 98
- CVE-2017-13757The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the PLT section size, which al
- CVE-2017-13758In ImageMagick 7.0.6-10, there is a heap-based buffer overflow in the TracePoint() function in MagickCore/draw.c.
- CVE-2017-13760In The Sleuth Kit (TSK) 4.4.2, fls hangs on a corrupt exfat image in tsk_img_read() in tsk/img/img_io.c in libtskimg.a.
- CVE-2017-0379Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret libgcrypt
- CVE-2017-13755In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660_proc_dir() in tsk/fs/iso9660_dent.
- CVE-2017-13756In The Sleuth Kit (TSK) 4.4.2, opening a crafted disk image triggers infinite recursion in dos_load_ext_table() in tsk/vs/dos.c in libtskvs.
- CVE-2016-0358IBM Sametime 8.5.2 and 9.0 could allow an unauthorized authenticated user to enumerate group chat ID numbers and join meetings that he was nIBM Sametime
- CVE-2016-2964IBM Sametime 8.5.2 and 9.0 under certain conditions provides an error message to a user that is too detailed and may reveal details about thIBM Sametime
- CVE-2016-2966IBM Sametime 8.5.1 and 9.0 could allow an authenticated user to enumerate meeting rooms by guessing the meeting room id.IBM Sametime
- CVE-2016-2967IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting.IBM Sametime
- CVE-2016-2974IBM Sametime Connect 8.5.2 and 9.0, after uninstalling the Sametime Rich Client, could disclose potentially sensitive information related toIBM Sametime
- CVE-2016-2975IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting.IBM Sametime
- CVE-2016-2976IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting invitee to obtain previously cleared sensitive information by viewing the meIBM Sametime
- CVE-2016-2978IBM Sametime 8.5.2 and 9.0 could store potentially sensitive information from the browser cache locally that could be available to a local uIBM Sametime
- CVE-2016-2980The Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a IBM Sametime
- CVE-2017-1195IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 could allow a remote attacker to conduct phishing attacks, using an open redirectIBM Cram Social Program Management
- CVE-2017-1427IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting.IBM Cognos Analytics
- CVE-2017-1428IBM Cognos Analytics 11.0 could allow a remote attacker to hijack the clicking action of the victim.IBM Cognos Analytics
- CVE-2017-1485IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting.IBM Cognos Analytics
- CVE-2017-1535IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting.IBM Cognos Analytics
- CVE-2013-7426Insecure Temporary file vulnerability in /tmp/kamailio_fifo in kamailio 4.0.1.
- CVE-2013-7431Full path disclosure in the Googlemaps plugin before 3.1 for Joomla!.
- CVE-2013-7432The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to bypass an intended protection mechanism.
- CVE-2013-7433Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla!.
- CVE-2014-9497Buffer overflow in mpg123 before 1.18.0.
- CVE-2016-8752Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointiApache Software Foundation Apache Atlas · apache-atlas +1
- CVE-2017-3150Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script.Apache Software Foundation Apache Atlas · apache-atlas +1
- CVE-2017-3151Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionaliApache Software Foundation Apache Atlas · apache-atlas +1
- CVE-2017-3152Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality.Apache Software Foundation Apache Atlas · apache-atlas +1
- CVE-2017-3153Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality.Apache Software Foundation Apache Atlas · apache-atlas +1
- CVE-2017-3154Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.Apache Software Foundation Apache Atlas · apache-atlas +1
- CVE-2017-3155Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting.Apache Software Foundation Apache Atlas · apache-atlas +1
- CVE-2016-0354IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user to upload a malicious file to a Sametime meeting roomIBM Sametime
- CVE-2016-0355IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to IBM Sametime
- CVE-2016-0356IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to IBM Sametime
- CVE-2016-10503IBM Sametime Meeting Server 8.5.2 and 9.0 could allow an authenticated and invited user of Sametime meeting to lower any or all hands in an IBM Sametime
- CVE-2016-2959IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting room manager to remove the primary managers privileges.IBM Sametime
- CVE-2016-2965IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input.IBM Sametime
- CVE-2016-2969IBM Sametime Meeting Server 8.5.2 and 9.0 may send replies that contain emails of people that should not be in these messages.IBM Sametime
- CVE-2016-2971IBM Sametime Media Services 8.5.2 and 9.0 can disclose sensitive information in stack trace error logs that could aid an attacker in future IBM Sametime
- CVE-2016-2972IBM Sametime Meeting Server 8.5.2 and 9.0 could store credentials of the Sametime Meetings user in the local cache of their browser which coIBM Sametime
- CVE-2016-2973IBM Sametime Media Services 8.5.2 and 9.0 is vulnerable to cross-site scripting.IBM Sametime
- CVE-2016-2977IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a malicious user to lower other users hands in the meeting.IBM Sametime
- CVE-2016-2979IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site scripting.IBM Sametime
- CVE-2017-12865Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or exec
- CVE-2017-13673The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of serv
- CVE-2015-3653Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to write to arbitrary
- CVE-2015-3654Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileg
- CVE-2015-3655Cross-site request forgery (CSRF) vulnerability in Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote
- CVE-2015-3656Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain p
- CVE-2015-3657Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain "
- CVE-2015-4649Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileg
- CVE-2015-5209Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings org.apache.struts:struts2-core
- CVE-2015-6588Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web s
- CVE-2015-6942Cross-site scripting (XSS) vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in
- CVE-2015-7255ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host key
- CVE-2015-7517Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute
- CVE-2015-8299Buffer overflow in the Group messages monitor (Falcon) in KNX ETS 4.1.5 (Build 3246) allows remote attackers to execute arbitrary code via a
- CVE-2015-8334SQL injection vulnerability in the Operation and Maintenance Unit (OMU) in Huawei VCN500 before V100R002C00SPC201 allows remote authenticate
- CVE-2017-11455diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8,
- CVE-2017-12422NetApp StorageGRID Webscale 10.2.x before 10.2.2.3, 10.3.x before 10.3.0.4, and 10.4.x before 10.4.0.2 allow remote authenticated users to d
- CVE-2017-12763An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining acce
- CVE-2017-12775qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts.
- CVE-2017-12797Integer overflow in the INT123_parse_new_id3 function in the ID3 parser in mpg123 before 1.25.5 on 32-bit platforms allows remote attackers
- CVE-2017-12856Cross-site scripting (XSS) vulnerability in C.P.Sub 5.2 allows remote attackers to inject arbitrary web script or HTML via the keyword param
- CVE-2017-12867The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend itssimplesamlphp/simplesamlphp
- CVE-2017-12875The WritePixelCachePixels function in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (CPU consumption) via a craft
- CVE-2017-10950This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Bitdefender Total Security 21.0.24.62.Zero Day Initiative Bitdefender Total Security
- CVE-2017-10951This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878.Zero Day Initiative Foxit Reader
- CVE-2017-10952This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.0.2051.Zero Day Initiative Foxit Reader
- CVE-2017-13685The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via
- CVE-2017-13726There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag.
- CVE-2017-13727There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD
- CVE-2017-13728There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic.
- CVE-2017-13729There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0.
- CVE-2017-13730There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial
- CVE-2017-13731There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial o
- CVE-2017-13732There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of se
- CVE-2017-13733There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of serv
- CVE-2017-13734There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service
- CVE-2017-13735There is a floating point exception in the kodak_radc_load_raw function in dcraw_common.cpp in LibRaw 0.18.2.
- CVE-2017-13736There are lots of memory leaks in the GMCommand function in magick/command.c in GraphicsMagick 1.3.26 that will lead to a remote denial of s
- CVE-2017-13737There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service
- CVE-2017-13738There is an illegal address access in the _lou_getALine function in compileTranslationTable.c:346 in Liblouis 3.2.0.
- CVE-2017-13739There is a heap-based buffer overflow that causes a more than two thousand bytes out-of-bounds write in Liblouis 3.2.0, triggered in the fun
- CVE-2017-13740There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function parseChars() in compileTranslationTable.c, that will lea
- CVE-2017-13741There is a use-after-free in the function compileBrailleIndicator() in compileTranslationTable.c in Liblouis 3.2.0 that will lead to a remot
- CVE-2017-13742There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function includeFile() in compileTranslationTable.c, that will le
- CVE-2017-13743There is a buffer overflow in Liblouis 3.2.0, triggered in the function _lou_showString() in utils.c, that will lead to a remote denial of s
- CVE-2017-13744There is an illegal address access in the function _lou_getALine() in compileTranslationTable.c:343 in Liblouis 3.2.0.
- CVE-2017-13745There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote deni
- CVE-2017-13746There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1297 in JasPer 2.0.12 that will lead to a remote
- CVE-2017-13747There is a reachable assertion abort in the function jpc_floorlog2() in jpc/jpc_math.c in JasPer 2.0.12 that will lead to a remote denial of
- CVE-2017-13748There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in base/jas_string.c, that will lead to a remote den
- CVE-2017-13749There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12 that will lead to a remote denial
- CVE-2017-13750There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1296 in JasPer 2.0.12 that will lead to a remote
- CVE-2017-13751There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of
- CVE-2017-13752There is a reachable assertion abort in the function jpc_dequantize() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of