# CVEs published 2017-09-06 26 CVEs were published on September 6, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2014-6438](https://cve.now/CVE-2014-6438.md): The URI.decode\_www\_form\_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic… (no CVSS) - [CVE-2015-0853](https://cve.now/CVE-2015-0853.md): svn-workbench 1.6.2 and earlier on a system with xeyes installed allows local users to execute arbitrary commands by using the "Command… (no CVSS) - [CVE-2015-2210](https://cve.now/CVE-2015-2210.md): The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into… (no CVSS) - [CVE-2015-2943](https://cve.now/CVE-2015-2943.md): Honda Moto LINC 1.6.1 does not verify SSL certificates. (no CVSS) - [CVE-2015-3160](https://cve.now/CVE-2015-3160.md): XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive… (no CVSS) - [CVE-2015-3161](https://cve.now/CVE-2015-3161.md): The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape \ tags in string literals when producing JSON. (no CVSS) - [CVE-2015-3162](https://cve.now/CVE-2015-3162.md): Cross-site scripting (XSS) vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 allows remote authenticated… (no CVSS) - [CVE-2015-3163](https://cve.now/CVE-2015-3163.md): The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated… (no CVSS) - [CVE-2015-3450](https://cve.now/CVE-2015-3450.md): Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory corruption) or execute arbitrary code via… (no CVSS) - [CVE-2015-3454](https://cve.now/CVE-2015-3454.md): TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password… (no CVSS) - [CVE-2015-5186](https://cve.now/CVE-2015-5186.md): Audit before 2.4.4 in Linux does not sanitize escape characters in filenames. (no CVSS) - [CVE-2015-5705](https://cve.now/CVE-2015-5705.md): Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and… (no CVSS) - [CVE-2015-5947](https://cve.now/CVE-2015-5947.md): SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. (no CVSS) - [CVE-2015-5948](https://cve.now/CVE-2015-5948.md): Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. (no CVSS) - [CVE-2015-5959](https://cve.now/CVE-2015-5959.md): Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading… (no CVSS) - [CVE-2015-6250](https://cve.now/CVE-2015-6250.md): simple-php-captcha before commit 9d65a945029c7be7bb6bc893759e74c5636be694 allows remote attackers to automatically generate the captcha… (no CVSS) - [CVE-2015-7225](https://cve.now/CVE-2015-7225.md): Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated… (no CVSS, devise-two-factor) - [CVE-2015-7241](https://cve.now/CVE-2015-7241.md): XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01. (no CVSS) - [CVE-2015-7294](https://cve.now/CVE-2015-7294.md): ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username. (no CVSS, ldapauth-fork · ldapauth) - [CVE-2015-8316](https://cve.now/CVE-2015-8316.md): Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled allows remote… (no CVSS) - [CVE-2017-14164](https://cve.now/CVE-2017-14164.md): A size-validation issue was discovered in opj\_j2k\_write\_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. (no CVSS) - [CVE-2017-14165](https://cve.now/CVE-2017-14165.md): The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has an issue where memory allocation is excessive because it depends… (no CVSS) - [CVE-2017-14166](https://cve.now/CVE-2017-14166.md): libarchive 3.3.2 allows remote attackers to cause a denial of service (xml\_data heap-based buffer over-read and application crash) via a… (no CVSS) - [CVE-2017-12474](https://cve.now/CVE-2017-12474.md): The AP4\_AtomSampleTable::GetSample function in Core/Ap4AtomSampleTable.cpp in Bento4 mp42ts before 1.5.0-616 allows remote attackers to… (no CVSS) - [CVE-2017-12475](https://cve.now/CVE-2017-12475.md): The AP4\_Processor::Process function in Core/Ap4Processor.cpp in Bento4 mp4encrypt before 1.5.0-616 allows remote attackers to cause a… (no CVSS) - [CVE-2017-12476](https://cve.now/CVE-2017-12476.md): The AP4\_AvccAtom::InspectFields function in Core/Ap4AvccAtom.cpp in Bento4 mp4dump before 1.5.0-616 allows remote attackers to cause a… (no CVSS) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2017-09-06 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.