# CVEs published 2017-08-31

42 CVEs were published on August 31, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2014-8675](https://cve.now/CVE-2014-8675.md): Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers (no CVSS)
- [CVE-2014-8676](https://cve.now/CVE-2014-8676.md): Directory traversal vulnerability in the file\_get\_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the (no CVSS)
- [CVE-2014-8677](https://cve.now/CVE-2014-8677.md): The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existi (no CVSS)
- [CVE-2015-5695](https://cve.now/CVE-2015-5695.md): Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas (no CVSS, designate)
- [CVE-2015-5958](https://cve.now/CVE-2015-5958.md): phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL. (no CVSS)
- [CVE-2015-7700](https://cve.now/CVE-2015-7700.md): Double-free vulnerability in the sPLT chunk structure and png.c in pngcrush before 1.7.87 allows attackers to have unspecified impact via un (no CVSS)
- [CVE-2015-7711](https://cve.now/CVE-2015-7711.md): Cross-site scripting (XSS) vulnerability in popuphelp.php in ATutor 2.2 and earlier allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2016-5795](https://cve.now/CVE-2016-5795.md): An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and pri (no CVSS)
- [CVE-2017-7855](https://cve.now/CVE-2017-7855.md): In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" parameter. (no CVSS)
- [CVE-2016-10508](https://cve.now/CVE-2016-10508.md): Multiple cross-site scripting (XSS) vulnerabilities in phpThumb() before 1.7.14 allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2016-10509](https://cve.now/CVE-2016-10509.md): SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2. (no CVSS)
- [CVE-2016-10510](https://cve.now/CVE-2016-10510.md): Cross-site scripting (XSS) vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2017-0899](https://cve.now/CVE-2017-0899.md): RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. (no CVSS, HackerOne RubyGems · rubygems-update)
- [CVE-2017-0900](https://cve.now/CVE-2017-0900.md): RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against Ruby (no CVSS, rubygems-update)
- [CVE-2017-0901](https://cve.now/CVE-2017-0901.md): RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any f (no CVSS, HackerOne RubyGems · rubygems-update)
- [CVE-2017-0902](https://cve.now/CVE-2017-0902.md): RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client (no CVSS, HackerOne RubyGems · rubygems-update)
- [CVE-2017-14076](https://cve.now/CVE-2017-14076.md): SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action. (no CVSS)
- [CVE-2017-14069](https://cve.now/CVE-2017-14069.md): SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php. (no CVSS)
- [CVE-2017-14070](https://cve.now/CVE-2017-14070.md): Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH\_INFO to ipsearch.php, related to PHP\_SELF. (no CVSS)
- [CVE-2017-14064](https://cve.now/CVE-2017-14064.md): Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. (no CVSS)
- [CVE-2017-14061](https://cve.now/CVE-2017-14061.md): Integer overflow in the \_isBidi function in bidi.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly (no CVSS)
- [CVE-2017-14062](https://cve.now/CVE-2017-14062.md): Integer overflow in the decode\_digit function in puny\_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2017-14063](https://cve.now/CVE-2017-14063.md): Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.ne (no CVSS, org.asynchttpclient:async-http-client)
- [CVE-2017-14054](https://cve.now/CVE-2017-14054.md): In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr\_read\_header() due to lack of an EOF (End of File) check might cause huge CPU consumptio (no CVSS)
- [CVE-2017-14055](https://cve.now/CVE-2017-14055.md): In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv\_read\_header() due to lack of an EOF (End of File) check might cause huge CPU and memory (no CVSS)
- [CVE-2017-14056](https://cve.now/CVE-2017-14056.md): In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2\_read\_header() due to lack of an EOF (End of File) check might cause huge CPU and memory c (no CVSS)
- [CVE-2017-14057](https://cve.now/CVE-2017-14057.md): In FFmpeg 3.3.3, a DoS in asf\_read\_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. (no CVSS)
- [CVE-2017-14058](https://cve.now/CVE-2017-14058.md): In FFmpeg 2.4 and 3.3.3, the read\_data function in libavformat/hls.c does not restrict reload attempts for an insufficient list, which allow (no CVSS)
- [CVE-2017-14059](https://cve.now/CVE-2017-14059.md): In FFmpeg 3.3.3, a DoS in cine\_read\_header() due to lack of an EOF check might cause huge CPU and memory consumption. (no CVSS)
- [CVE-2017-14060](https://cve.now/CVE-2017-14060.md): In ImageMagick 7.0.6-10, a NULL Pointer Dereference issue is present in the ReadCUTImage function in coders/cut.c that could allow an attack (no CVSS)
- [CVE-2016-0713](https://cve.now/CVE-2016-0713.md): Gorouter in Cloud Foundry cf-release v141 through v228 allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks via (no CVSS)
- [CVE-2017-13708](https://cve.now/CVE-2017-13708.md): Buffer overflow in the web server service in VX Search Enterprise 10.0.14 allows remote attackers to execute arbitrary code via a crafted GE (no CVSS)
- [CVE-2017-1444](https://cve.now/CVE-2017-1444.md): IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting. (no CVSS, IBM Emptoris Sourcing)
- [CVE-2017-1447](https://cve.now/CVE-2017-1447.md): IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting. (no CVSS, IBM Emptoris Sourcing)
- [CVE-2017-1449](https://cve.now/CVE-2017-1449.md): IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (no CVSS, IBM Emptoris Sourcing)
- [CVE-2017-1450](https://cve.now/CVE-2017-1450.md): IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (no CVSS, IBM Emptoris Sourcing)
- [CVE-2017-11158](https://cve.now/CVE-2017-11158.md): Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Drive before 4.2.5-4396 on Windows allow local att (no CVSS, Synology Cloud Station Drive)
- [CVE-2017-13670](https://cve.now/CVE-2017-13670.md): In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajax\_upload.php, as demon (no CVSS)
- [CVE-2017-14048](https://cve.now/CVE-2017-14048.md): BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new\_modulename parameter to back (no CVSS)
- [CVE-2017-14049](https://cve.now/CVE-2017-14049.md): In BlackCat CMS 1.2, backend/settings/ajax\_save\_settings.php allows remote authenticated users to conduct XSS attacks via the Website header (no CVSS)
- [CVE-2017-14050](https://cve.now/CVE-2017-14050.md): In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that conta (no CVSS)
- [CVE-2017-14051](https://cve.now/CVE-2017-14051.md): An integer overflow in the qla2x00\_sysfs\_write\_optrom\_ctl function in drivers/scsi/qla2xxx/qla\_attr.c in the Linux kernel through 4.12.10 al (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-08-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.