CVEs published August 30, 2017
51 CVEs were published on August 30, 2017: 0 critical, 0 high.
- Published
- 51
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 51
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Advantech WebAccess
- 9
- IBM Emptoris Services Procurement
- 4
- Apache Software Foundation Apache OFBiz
- 2
- IBM Emptoris Spend Analysis
- 2
- Siemens LOGO! 8 BM
- 2
- Apache Software Foundation Apache Hadoop · org.apache.hadoo…
- 1
- Apache Software Foundation Apache Solr · org.apache.solr:so…
- 1
- org.onosproject:onos-base
- 1
- Siemens 7KM PAC Switched Ethernet PROFINET expansion module…
- 1
Medium, low and unrated 51
- CVE-2017-14039A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in lib/openjp2/t2.c in OpenJPEG 2.2.0.
- CVE-2017-14040An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function.
- CVE-2017-14041A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0.
- CVE-2017-14042A memory allocation failure was discovered in the ReadPNMImage function in coders/pnm.c in GraphicsMagick 1.3.26.
- CVE-2017-14035CrushFTP 8.x before 8.2.0 has a serialization vulnerability.
- CVE-2017-14036CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS.
- CVE-2017-14037CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability.
- CVE-2017-14038CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability.
- CVE-2017-1440IBM Emptoris Services Procurement 10.0.0.5 could allow a remote attacker to include arbitrary files.IBM Emptoris Services Procurement
- CVE-2017-1441IBM Emptoris Services Procurement 10.0.0.5 could allow a local user to view sensitive information stored locally due to improper access contIBM Emptoris Services Procurement
- CVE-2017-1442IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious anIBM Emptoris Services Procurement
- CVE-2017-1443IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site scripting.IBM Emptoris Services Procurement
- CVE-2017-1445IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting.IBM Emptoris Spend Analysis
- CVE-2017-1446IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting.IBM Emptoris Spend Analysis
- CVE-2017-11157Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Backup before 4.2.5-4396 on Windows allow local at
- CVE-2017-14032ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentica
- CVE-2016-5001This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HApache Software Foundation Apache Hadoop · org.apache.hadoo…
- CVE-2017-12069An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.0
- CVE-2017-12734A vulnerability has been identified in LOGO! 8 BM (incl.Siemens LOGO! 8 BM
- CVE-2017-12735A vulnerability has been identified in LOGO! 8 BM (incl.Siemens LOGO! 8 BM
- CVE-2017-9945In the Siemens 7KM PAC Switched Ethernet PROFINET expansion module (All versions < V2.1.3), a Denial-of-Service condition could be induced bSiemens 7KM PAC Switched Ethernet PROFINET expansion module…
- CVE-2017-12698An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2_20170817.Advantech WebAccess
- CVE-2017-12702An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_20170817.Advantech WebAccess
- CVE-2017-12704A heap-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817.Advantech WebAccess
- CVE-2017-12706A stack-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817.Advantech WebAccess
- CVE-2017-12708An Improper Restriction Of Operations Within The Bounds Of A Memory Buffer issue was discovered in Advantech WebAccess versions prior to V8.Advantech WebAccess
- CVE-2017-12710A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817.Advantech WebAccess
- CVE-2017-12711An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.2_20170817.Advantech WebAccess
- CVE-2017-12713An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817.Advantech WebAccess
- CVE-2017-12717An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2_20170817.Advantech WebAccess
- CVE-2016-4462By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template EnginApache Software Foundation Apache OFBiz
- CVE-2016-6800The default configuration of the Apache OFBiz framework offers a blog functionality.Apache Software Foundation Apache OFBiz
- CVE-2017-13780The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows directory traversal attacks for reading arbitrary files via the module/admin_conf/
- CVE-2017-3163When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts aApache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2016-10504Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause
- CVE-2016-10505NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb fun
- CVE-2016-10506Division-by-zero vulnerabilities in the functions opj_pi_next_cprl, opj_pi_next_pcrl, and opj_pi_next_rpcl in pi.c in OpenJPEG before 2.2.0
- CVE-2016-10507Integer overflow vulnerability in the bmp24toimage function in convertbmp.c in OpenJPEG before 2.2.0 allows remote attackers to cause a deni
- CVE-2017-13764In Wireshark 2.4.0, the Modbus dissector could crash with a NULL pointer dereference.
- CVE-2017-13765In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the IrCOMM dissector has a buffer over-read and application crash.
- CVE-2017-13766In Wireshark 2.4.0 and 2.2.0 to 2.2.8, the Profinet I/O dissector could crash with an out-of-bounds write.
- CVE-2017-13767In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSDP dissector could go into an infinite loop.
- CVE-2017-13768Null Pointer Dereference in the IdentifyImage function in MagickCore/identify.c in ImageMagick through 7.0.6-10 allows an attacker to perfor
- CVE-2017-13769The WriteTHUMBNAILImage function in coders/thumbnail.c in ImageMagick through 7.0.6-10 allows an attacker to cause a denial of service (buff
- CVE-2017-13774Hikvision iVMS-4200 devices before v2.6.2.7 allow local users to generate password-recovery codes via unspecified vectors.
- CVE-2017-13775GraphicsMagick 1.3.26 has a denial of service issue in ReadJNXImage() in coders/jnx.c whereby large amounts of CPU and memory resources may
- CVE-2017-13776GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version!=10 case that results
- CVE-2017-13777GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version==10 case that results
- CVE-2017-13778Fiyo CMS 2.0.7 has XSS in dapur\apps\app_config\sys_config.php via the site_name parameter.
- CVE-2017-13762ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS.
- CVE-2017-13763ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated.org.onosproject:onos-base