# CVEs published 2017-09-29

48 CVEs were published on September 29, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2015-9233](https://cve.now/CVE-2015-9233.md): The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related… (no CVSS)
- [CVE-2015-9234](https://cve.now/CVE-2015-9234.md): The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the… (no CVSS)
- [CVE-2017-9794](https://cve.now/CVE-2017-9794.md): When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to… (no CVSS, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2016-4434](https://cve.now/CVE-2016-4434.md): Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML… (no CVSS, org.apache.tika:tika-core)
- [CVE-2017-13684](https://cve.now/CVE-2017-13684.md): Unisys Libra 64xx and 84xx and FS601 class systems with MCP-FIRMWARE before 43.211 allow remote authenticated users to cause a denial of… (no CVSS)
- [CVE-2017-14582](https://cve.now/CVE-2017-14582.md): The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which… (no CVSS)
- [CVE-2017-14945](https://cve.now/CVE-2017-14945.md): Artifex GSView 6.0 Beta on Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted… (no CVSS)
- [CVE-2017-14946](https://cve.now/CVE-2017-14946.md): Artifex GSView 6.0 Beta on Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted… (no CVSS)
- [CVE-2017-14947](https://cve.now/CVE-2017-14947.md): Artifex GSView 6.0 Beta on Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file… (no CVSS)
- [CVE-2017-14351](https://cve.now/CVE-2017-14351.md): A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.23. (no CVSS)
- [CVE-2017-14352](https://cve.now/CVE-2017-14352.md): A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.23. (no CVSS)
- [CVE-2017-14942](https://cve.now/CVE-2017-14942.md): Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct… (no CVSS)
- [CVE-2017-14944](https://cve.now/CVE-2017-14944.md): Inedo ProGet before 4.7.14 does not properly address dangerous package IDs during package addition, aka PG-1060. (no CVSS)
- [CVE-2016-10512](https://cve.now/CVE-2016-10512.md): MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. (no CVSS)
- [CVE-2017-14938](https://cve.now/CVE-2017-14938.md): \_bfd\_elf\_slurp\_version\_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29… (no CVSS)
- [CVE-2017-14939](https://cve.now/CVE-2017-14939.md): decode\_line\_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a… (no CVSS)
- [CVE-2017-14940](https://cve.now/CVE-2017-14940.md): scan\_unit\_for\_symbols in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows… (no CVSS)
- [CVE-2017-14350](https://cve.now/CVE-2017-14350.md): A potential security vulnerability has been identified in HPE Application Performance Management (BSM) Platform versions 9.26, 9.30, 9.40. (no CVSS, Micro Focus HPE Application Performance Management)
- [CVE-2017-14620](https://cve.now/CVE-2017-14620.md): SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQueries resulting in… (no CVSS)
- [CVE-2017-13982](https://cve.now/CVE-2017-13982.md): A directory traversal vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and… (no CVSS)
- [CVE-2017-13983](https://cve.now/CVE-2017-13983.md): An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40… (no CVSS)
- [CVE-2017-13984](https://cve.now/CVE-2017-13984.md): An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40… (no CVSS)
- [CVE-2017-13985](https://cve.now/CVE-2017-13985.md): An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40… (no CVSS)
- [CVE-2017-13986](https://cve.now/CVE-2017-13986.md): A reflected Cross-Site Scripting(XSS) vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or… (no CVSS)
- [CVE-2017-13987](https://cve.now/CVE-2017-13987.md): An insufficient access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0… (no CVSS)
- [CVE-2017-13988](https://cve.now/CVE-2017-13988.md): An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch… (no CVSS)
- [CVE-2017-13989](https://cve.now/CVE-2017-13989.md): An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch… (no CVSS)
- [CVE-2017-13990](https://cve.now/CVE-2017-13990.md): An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1… (no CVSS)
- [CVE-2017-13991](https://cve.now/CVE-2017-13991.md): An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1… (no CVSS)
- [CVE-2017-14349](https://cve.now/CVE-2017-14349.md): An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope… (no CVSS)
- [CVE-2017-14702](https://cve.now/CVE-2017-14702.md): ERS Data System 1.8.1.0 allows remote attackers to execute arbitrary code, related to "com.branaghgroup.ecers.update.UpdateRequest" object… (no CVSS)
- [CVE-2017-14738](https://cve.now/CVE-2017-14738.md): FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the… (no CVSS)
- [CVE-2017-14930](https://cve.now/CVE-2017-14930.md): Memory leak in decode\_line\_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29… (no CVSS)
- [CVE-2017-14931](https://cve.now/CVE-2017-14931.md): ExifImageFile::readDQT in ExifImageFileRead.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service (stack-based buffer… (no CVSS)
- [CVE-2017-14932](https://cve.now/CVE-2017-14932.md): decode\_line\_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote… (no CVSS)
- [CVE-2017-14933](https://cve.now/CVE-2017-14933.md): read\_formatted\_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows… (no CVSS)
- [CVE-2017-14934](https://cve.now/CVE-2017-14934.md): process\_debug\_info in dwarf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote… (no CVSS)
- [CVE-2017-14935](https://cve.now/CVE-2017-14935.md): Pulse Secure Pulse One On-Premise 2.0.1649 and below does not properly validate requests, which allows remote users to query and obtain… (no CVSS)
- [CVE-2017-14920](https://cve.now/CVE-2017-14920.md): Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an unauthenticated remote attacker to inject… (no CVSS, egroupware/egroupware)
- [CVE-2017-14921](https://cve.now/CVE-2017-14921.md): Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an… (no CVSS)
- [CVE-2017-14922](https://cve.now/CVE-2017-14922.md): Stored XSS vulnerability via IMG element at "History" of Profile, Calendar, Tasks, and CRM in Tine 2.0 Community Edition before 2017.08.4… (no CVSS)
- [CVE-2017-14923](https://cve.now/CVE-2017-14923.md): Stored XSS vulnerability via IMG element at "Leadname" of CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user… (no CVSS)
- [CVE-2017-14924](https://cve.now/CVE-2017-14924.md): Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS… (no CVSS)
- [CVE-2017-14925](https://cve.now/CVE-2017-14925.md): Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS… (no CVSS)
- [CVE-2017-14926](https://cve.now/CVE-2017-14926.md): In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF document. (no CVSS)
- [CVE-2017-14927](https://cve.now/CVE-2017-14927.md): In Poppler 0.59.0, a NULL Pointer Dereference exists in the SplashOutputDev::type3D0() function in SplashOutputDev.cc via a crafted PDF… (no CVSS)
- [CVE-2017-14928](https://cve.now/CVE-2017-14928.md): In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Configuration::Configuration in Annot.cc via a crafted PDF document. (no CVSS)
- [CVE-2017-14929](https://cve.now/CVE-2017-14929.md): In Poppler 0.59.0, memory corruption occurs in a call to Object::dictLookup() in Object.h after a repeating series of Gfx::display… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-09-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.