CVEs published August 31, 2017
42 CVEs were published on August 31, 2017: 0 critical, 0 high.
- Published
- 42
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 42
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- IBM Emptoris Sourcing
- 4
- HackerOne RubyGems · rubygems-update
- 3
- designate
- 1
- org.asynchttpclient:async-http-client
- 1
- rubygems-update
- 1
- Synology Cloud Station Drive
- 1
Medium, low and unrated 42
- CVE-2014-8675Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers
- CVE-2014-8676Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the
- CVE-2014-8677The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existi
- CVE-2015-5695Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas designate
- CVE-2015-5958phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL.
- CVE-2015-7700Double-free vulnerability in the sPLT chunk structure and png.c in pngcrush before 1.7.87 allows attackers to have unspecified impact via un
- CVE-2015-7711Cross-site scripting (XSS) vulnerability in popuphelp.php in ATutor 2.2 and earlier allows remote attackers to inject arbitrary web script o
- CVE-2016-5795An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and pri
- CVE-2017-7855In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" parameter.
- CVE-2016-10508Multiple cross-site scripting (XSS) vulnerabilities in phpThumb() before 1.7.14 allow remote attackers to inject arbitrary web script or HTM
- CVE-2016-10509SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2.
- CVE-2016-10510Cross-site scripting (XSS) vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web sc
- CVE-2017-0899RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters.HackerOne RubyGems · rubygems-update
- CVE-2017-0900RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against Rubyrubygems-update
- CVE-2017-0901RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any fHackerOne RubyGems · rubygems-update
- CVE-2017-0902RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client HackerOne RubyGems · rubygems-update
- CVE-2017-14076SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.
- CVE-2017-14069SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.
- CVE-2017-14070Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to ipsearch.php, related to PHP_SELF.
- CVE-2017-14064Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call.
- CVE-2017-14061Integer overflow in the _isBidi function in bidi.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly
- CVE-2017-14062Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service
- CVE-2017-14063Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.neorg.asynchttpclient:async-http-client
- CVE-2017-14054In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumptio
- CVE-2017-14055In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory
- CVE-2017-14056In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory c
- CVE-2017-14057In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption.
- CVE-2017-14058In FFmpeg 2.4 and 3.3.3, the read_data function in libavformat/hls.c does not restrict reload attempts for an insufficient list, which allow
- CVE-2017-14059In FFmpeg 3.3.3, a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption.
- CVE-2017-14060In ImageMagick 7.0.6-10, a NULL Pointer Dereference issue is present in the ReadCUTImage function in coders/cut.c that could allow an attack
- CVE-2016-0713Gorouter in Cloud Foundry cf-release v141 through v228 allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks via
- CVE-2017-13708Buffer overflow in the web server service in VX Search Enterprise 10.0.14 allows remote attackers to execute arbitrary code via a crafted GE
- CVE-2017-1444IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting.IBM Emptoris Sourcing
- CVE-2017-1447IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting.IBM Emptoris Sourcing
- CVE-2017-1449IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM Emptoris Sourcing
- CVE-2017-1450IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM Emptoris Sourcing
- CVE-2017-11158Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Drive before 4.2.5-4396 on Windows allow local attSynology Cloud Station Drive
- CVE-2017-13670In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajax_upload.php, as demon
- CVE-2017-14048BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to back
- CVE-2017-14049In BlackCat CMS 1.2, backend/settings/ajax_save_settings.php allows remote authenticated users to conduct XSS attacks via the Website header
- CVE-2017-14050In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that conta
- CVE-2017-14051An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel through 4.12.10 al