# CVEs published 2017-08-30

51 CVEs were published on August 30, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-14039](https://cve.now/CVE-2017-14039.md): A heap-based buffer overflow was discovered in the opj\_t2\_encode\_packet function in lib/openjp2/t2.c in OpenJPEG 2.2.0. (no CVSS)
- [CVE-2017-14040](https://cve.now/CVE-2017-14040.md): An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. (no CVSS)
- [CVE-2017-14041](https://cve.now/CVE-2017-14041.md): A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. (no CVSS)
- [CVE-2017-14042](https://cve.now/CVE-2017-14042.md): A memory allocation failure was discovered in the ReadPNMImage function in coders/pnm.c in GraphicsMagick 1.3.26. (no CVSS)
- [CVE-2017-14035](https://cve.now/CVE-2017-14035.md): CrushFTP 8.x before 8.2.0 has a serialization vulnerability. (no CVSS)
- [CVE-2017-14036](https://cve.now/CVE-2017-14036.md): CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS. (no CVSS)
- [CVE-2017-14037](https://cve.now/CVE-2017-14037.md): CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability. (no CVSS)
- [CVE-2017-14038](https://cve.now/CVE-2017-14038.md): CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability. (no CVSS)
- [CVE-2017-1440](https://cve.now/CVE-2017-1440.md): IBM Emptoris Services Procurement 10.0.0.5 could allow a remote attacker to include arbitrary files. (no CVSS, IBM Emptoris Services Procurement)
- [CVE-2017-1441](https://cve.now/CVE-2017-1441.md): IBM Emptoris Services Procurement 10.0.0.5 could allow a local user to view sensitive information stored locally due to improper access cont (no CVSS, IBM Emptoris Services Procurement)
- [CVE-2017-1442](https://cve.now/CVE-2017-1442.md): IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious an (no CVSS, IBM Emptoris Services Procurement)
- [CVE-2017-1443](https://cve.now/CVE-2017-1443.md): IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site scripting. (no CVSS, IBM Emptoris Services Procurement)
- [CVE-2017-1445](https://cve.now/CVE-2017-1445.md): IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. (no CVSS, IBM Emptoris Spend Analysis)
- [CVE-2017-1446](https://cve.now/CVE-2017-1446.md): IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. (no CVSS, IBM Emptoris Spend Analysis)
- [CVE-2017-11157](https://cve.now/CVE-2017-11157.md): Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Backup before 4.2.5-4396 on Windows allow local at (no CVSS)
- [CVE-2017-14032](https://cve.now/CVE-2017-14032.md): ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentica (no CVSS)
- [CVE-2016-5001](https://cve.now/CVE-2016-5001.md): This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of H (no CVSS, Apache Software Foundation Apache Hadoop · org.apache.hadoo…)
- [CVE-2017-12069](https://cve.now/CVE-2017-12069.md): An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.0 (no CVSS)
- [CVE-2017-12734](https://cve.now/CVE-2017-12734.md): A vulnerability has been identified in LOGO! 8 BM (incl. (no CVSS, Siemens LOGO! 8 BM)
- [CVE-2017-12735](https://cve.now/CVE-2017-12735.md): A vulnerability has been identified in LOGO! 8 BM (incl. (no CVSS, Siemens LOGO! 8 BM)
- [CVE-2017-9945](https://cve.now/CVE-2017-9945.md): In the Siemens 7KM PAC Switched Ethernet PROFINET expansion module (All versions \< V2.1.3), a Denial-of-Service condition could be induced b (no CVSS, Siemens 7KM PAC Switched Ethernet PROFINET expansion module…)
- [CVE-2017-12698](https://cve.now/CVE-2017-12698.md): An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2\_20170817. (no CVSS, Advantech WebAccess)
- [CVE-2017-12702](https://cve.now/CVE-2017-12702.md): An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2\_20170817. (no CVSS, Advantech WebAccess)
- [CVE-2017-12704](https://cve.now/CVE-2017-12704.md): A heap-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2\_20170817. (no CVSS, Advantech WebAccess)
- [CVE-2017-12706](https://cve.now/CVE-2017-12706.md): A stack-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2\_20170817. (no CVSS, Advantech WebAccess)
- [CVE-2017-12708](https://cve.now/CVE-2017-12708.md): An Improper Restriction Of Operations Within The Bounds Of A Memory Buffer issue was discovered in Advantech WebAccess versions prior to V8. (no CVSS, Advantech WebAccess)
- [CVE-2017-12710](https://cve.now/CVE-2017-12710.md): A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2\_20170817. (no CVSS, Advantech WebAccess)
- [CVE-2017-12711](https://cve.now/CVE-2017-12711.md): An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.2\_20170817. (no CVSS, Advantech WebAccess)
- [CVE-2017-12713](https://cve.now/CVE-2017-12713.md): An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2\_20170817. (no CVSS, Advantech WebAccess)
- [CVE-2017-12717](https://cve.now/CVE-2017-12717.md): An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2\_20170817. (no CVSS, Advantech WebAccess)
- [CVE-2016-4462](https://cve.now/CVE-2016-4462.md): By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engin (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2016-6800](https://cve.now/CVE-2016-6800.md): The default configuration of the Apache OFBiz framework offers a blog functionality. (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2017-13780](https://cve.now/CVE-2017-13780.md): The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows directory traversal attacks for reading arbitrary files via the module/admin\_conf/ (no CVSS)
- [CVE-2017-3163](https://cve.now/CVE-2017-3163.md): When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a (no CVSS, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2016-10504](https://cve.now/CVE-2016-10504.md): Heap-based buffer overflow vulnerability in the opj\_mqc\_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause (no CVSS)
- [CVE-2016-10505](https://cve.now/CVE-2016-10505.md): NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444\_to\_rgb function in color.c, color\_esycc\_to\_rgb fun (no CVSS)
- [CVE-2016-10506](https://cve.now/CVE-2016-10506.md): Division-by-zero vulnerabilities in the functions opj\_pi\_next\_cprl, opj\_pi\_next\_pcrl, and opj\_pi\_next\_rpcl in pi.c in OpenJPEG before 2.2.0 (no CVSS)
- [CVE-2016-10507](https://cve.now/CVE-2016-10507.md): Integer overflow vulnerability in the bmp24toimage function in convertbmp.c in OpenJPEG before 2.2.0 allows remote attackers to cause a deni (no CVSS)
- [CVE-2017-13764](https://cve.now/CVE-2017-13764.md): In Wireshark 2.4.0, the Modbus dissector could crash with a NULL pointer dereference. (no CVSS)
- [CVE-2017-13765](https://cve.now/CVE-2017-13765.md): In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the IrCOMM dissector has a buffer over-read and application crash. (no CVSS)
- [CVE-2017-13766](https://cve.now/CVE-2017-13766.md): In Wireshark 2.4.0 and 2.2.0 to 2.2.8, the Profinet I/O dissector could crash with an out-of-bounds write. (no CVSS)
- [CVE-2017-13767](https://cve.now/CVE-2017-13767.md): In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSDP dissector could go into an infinite loop. (no CVSS)
- [CVE-2017-13768](https://cve.now/CVE-2017-13768.md): Null Pointer Dereference in the IdentifyImage function in MagickCore/identify.c in ImageMagick through 7.0.6-10 allows an attacker to perfor (no CVSS)
- [CVE-2017-13769](https://cve.now/CVE-2017-13769.md): The WriteTHUMBNAILImage function in coders/thumbnail.c in ImageMagick through 7.0.6-10 allows an attacker to cause a denial of service (buff (no CVSS)
- [CVE-2017-13774](https://cve.now/CVE-2017-13774.md): Hikvision iVMS-4200 devices before v2.6.2.7 allow local users to generate password-recovery codes via unspecified vectors. (no CVSS)
- [CVE-2017-13775](https://cve.now/CVE-2017-13775.md): GraphicsMagick 1.3.26 has a denial of service issue in ReadJNXImage() in coders/jnx.c whereby large amounts of CPU and memory resources may (no CVSS)
- [CVE-2017-13776](https://cve.now/CVE-2017-13776.md): GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version!=10 case that results (no CVSS)
- [CVE-2017-13777](https://cve.now/CVE-2017-13777.md): GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version==10 case that results (no CVSS)
- [CVE-2017-13778](https://cve.now/CVE-2017-13778.md): Fiyo CMS 2.0.7 has XSS in dapur\\apps\\app\_config\\sys\_config.php via the site\_name parameter. (no CVSS)
- [CVE-2017-13762](https://cve.now/CVE-2017-13762.md): ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS. (no CVSS)
- [CVE-2017-13763](https://cve.now/CVE-2017-13763.md): ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. (no CVSS, org.onosproject:onos-base)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-08-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.