# CVEs published 2017-09-28

40 CVEs were published on September 28, 2017: 1 critical, 5 high. 8 are now in CISA KEV. Days are UTC.

- [CVE-2017-7552](https://cve.now/CVE-2017-7552.md): A flaw was discovered in the file editor of millicore, affecting versions before 3.19.0 and 4.x before 4.5.0, which allows files to be… (no CVSS)
- [CVE-2017-7553](https://cve.now/CVE-2017-7553.md): The external\_request api call in App Studio (millicore) allows server side request forgery (SSRF). (no CVSS)
- [CVE-2017-7554](https://cve.now/CVE-2017-7554.md): It was found that the App Studio component of RHMAP 4.4 executes javascript provided by a user. (no CVSS)
- [CVE-2017-7687](https://cve.now/CVE-2017-7687.md): When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2… (no CVSS, Apache Software Foundation Apache Mesos · org.apache.mesos:…)
- [CVE-2017-9790](https://cve.now/CVE-2017-9790.md): When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before… (no CVSS, Apache Software Foundation Apache Mesos · org.apache.mesos:…)
- [CVE-2014-2029](https://cve.now/CVE-2014-2029.md): The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive… (no CVSS)
- [CVE-2015-1027](https://cve.now/CVE-2015-1027.md): The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade… (no CVSS)
- [CVE-2017-10701](https://cve.now/CVE-2017-10701.md): Cross site scripting (XSS) vulnerability in SAP Enterprise Portal 7.50 allows remote attackers to inject arbitrary web script or HTML, aka… (no CVSS)
- [CVE-2017-11479](https://cve.now/CVE-2017-11479.md): Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive… (no CVSS)
- [CVE-2017-14507](https://cve.now/CVE-2017-14507.md): Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL… (no CVSS)
- [CVE-2017-8444](https://cve.now/CVE-2017-8444.md): The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper. (no CVSS, Elastic Cloud Enterprise)
- [CVE-2017-8447](https://cve.now/CVE-2017-8447.md): An error was found in the X-Pack Security 5.3.0 to 5.5.2 privilege enforcement. (no CVSS, Elastic X-Pack Security)
- [CVE-2017-8448](https://cve.now/CVE-2017-8448.md): An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could… (no CVSS, Elastic X-Pack Alerting)
- [CVE-2017-14867](https://cve.now/CVE-2017-14867.md): Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to… (no CVSS)
- [CVE-2017-12222](https://cve.now/CVE-2017-12222.md): A vulnerability in the wireless controller manager of Cisco IOS XE could allow an unauthenticated, adjacent attacker to cause a restart of… (no CVSS, Cisco IOS XE)
- [CVE-2017-12226](https://cve.now/CVE-2017-12226.md): A vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software for Cisco 5760 Wireless LAN Controllers, Cisco Catalyst… (no CVSS, Cisco IOS XE)
- [CVE-2017-12228](https://cve.now/CVE-2017-12228.md): A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could… (no CVSS, Cisco IOS and IOS XE)
- [CVE-2017-12229](https://cve.now/CVE-2017-12229.md): A vulnerability in the REST API of the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 could allow an unauthenticated… (no CVSS, Cisco IOS XE)
- [CVE-2017-12230](https://cve.now/CVE-2017-12230.md): A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate… (no CVSS, Cisco IOS XE)
- [CVE-2017-12231](https://cve.now/CVE-2017-12231.md): A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS 12.4 through 15.6 could allow an unaut (CVSS 7.5, KEV, Cisco IOS)
- [CVE-2017-12232](https://cve.now/CVE-2017-12232.md): A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15. (CVSS 6.5, KEV, Cisco IOS)
- [CVE-2017-12233](https://cve.now/CVE-2017-12233.md): Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an (CVSS 7.5, KEV, Cisco IOS)
- [CVE-2017-12234](https://cve.now/CVE-2017-12234.md): Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an (CVSS 7.5, KEV, Cisco IOS)
- [CVE-2017-12235](https://cve.now/CVE-2017-12235.md): A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could al (CVSS 7.5, KEV, Cisco IOS)
- [CVE-2017-12236](https://cve.now/CVE-2017-12236.md): A vulnerability in the implementation of the Locator/ID Separation Protocol (LISP) in Cisco IOS XE 3.2 through 16.5 could allow an… (no CVSS, Cisco IOS XE)
- [CVE-2017-12237](https://cve.now/CVE-2017-12237.md): A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could (CVSS 7.5, KEV, Cisco IOS and IOS XE)
- [CVE-2017-12238](https://cve.now/CVE-2017-12238.md): A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could (CVSS 6.5, KEV, Cisco IOS)
- [CVE-2017-12239](https://cve.now/CVE-2017-12239.md): A vulnerability in motherboard console ports of line cards for Cisco ASR 1000 Series Aggregation Services Routers and Cisco cBR-8… (no CVSS, Cisco IOS XE)
- [CVE-2017-12240](https://cve.now/CVE-2017-12240.md): The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticat (CVSS 9.8, KEV, Cisco IOS and IOS XE)
- [CVE-2017-14857](https://cve.now/CVE-2017-14857.md): In Exiv2 0.26, there is an invalid free in the Image class in image.cpp that leads to a Segmentation fault. (no CVSS)
- [CVE-2017-14858](https://cve.now/CVE-2017-14858.md): There is a heap-based buffer overflow in the Exiv2::l2Data function of types.cpp in Exiv2 0.26. (no CVSS)
- [CVE-2017-14860](https://cve.now/CVE-2017-14860.md): There is a heap-based buffer over-read in the Exiv2::Jp2Image::readMetadata function of jp2image.cpp in Exiv2 0.26. (no CVSS)
- [CVE-2017-14861](https://cve.now/CVE-2017-14861.md): There is a stack consumption vulnerability in the Exiv2::Internal::stringFormat function of image.cpp in Exiv2 0.26. (no CVSS)
- [CVE-2017-14863](https://cve.now/CVE-2017-14863.md): A NULL pointer dereference was discovered in Exiv2::Image::printIFDStructure in image.cpp in Exiv2 0.26. (no CVSS)
- [CVE-2017-14865](https://cve.now/CVE-2017-14865.md): There is a heap-based buffer overflow in the Exiv2::us2Data function of types.cpp in Exiv2 0.26. (no CVSS)
- [CVE-2017-14866](https://cve.now/CVE-2017-14866.md): There is a heap-based buffer overflow in the Exiv2::s2Data function of types.cpp in Exiv2 0.26. (no CVSS)
- [CVE-2017-14849](https://cve.now/CVE-2017-14849.md): Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the… (no CVSS)
- [CVE-2017-14859](https://cve.now/CVE-2017-14859.md): An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. (no CVSS)
- [CVE-2017-14862](https://cve.now/CVE-2017-14862.md): An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26. (no CVSS)
- [CVE-2017-14864](https://cve.now/CVE-2017-14864.md): An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-09-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.