# CVEs published 2017-10-02

64 CVEs were published on October 2, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-11496](https://cve.now/CVE-2017-11496.md): Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50… (no CVSS)
- [CVE-2017-11497](https://cve.now/CVE-2017-11497.md): Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50… (no CVSS)
- [CVE-2017-11498](https://cve.now/CVE-2017-11498.md): Buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows… (no CVSS)
- [CVE-2017-12638](https://cve.now/CVE-2017-12638.md): Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via… (no CVSS)
- [CVE-2017-12639](https://cve.now/CVE-2017-12639.md): Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via… (no CVSS)
- [CVE-2017-13704](https://cve.now/CVE-2017-13704.md): In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. (no CVSS)
- [CVE-2017-14491](https://cve.now/CVE-2017-14491.md): Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code… (no CVSS)
- [CVE-2017-14492](https://cve.now/CVE-2017-14492.md): Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code… (no CVSS)
- [CVE-2017-14493](https://cve.now/CVE-2017-14493.md): Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code… (no CVSS)
- [CVE-2017-14494](https://cve.now/CVE-2017-14494.md): dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving… (no CVSS)
- [CVE-2017-14495](https://cve.now/CVE-2017-14495.md): Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause… (no CVSS)
- [CVE-2017-14496](https://cve.now/CVE-2017-14496.md): Integer underflow in the add\_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is… (no CVSS)
- [CVE-2017-14770](https://cve.now/CVE-2017-14770.md): Skybox Manager Client Application prior to 8.5.501 is prone to an information disclosure vulnerability of user password hashes. (no CVSS)
- [CVE-2017-14771](https://cve.now/CVE-2017-14771.md): Skybox Manager Client Application prior to 8.5.501 is prone to an arbitrary file upload vulnerability due to insufficient input validation… (no CVSS)
- [CVE-2017-14772](https://cve.now/CVE-2017-14772.md): Skybox Manager Client Application is prone to information disclosure via a username enumeration attack. (no CVSS)
- [CVE-2017-14773](https://cve.now/CVE-2017-14773.md): Skybox Manager Client Application prior to 8.5.501 is prone to an elevation of privileges vulnerability during authentication of a valid… (no CVSS)
- [CVE-2017-14848](https://cve.now/CVE-2017-14848.md): WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee\_id parameter. (no CVSS)
- [CVE-2017-1311](https://cve.now/CVE-2017-1311.md): IBM Insights Foundation for Energy 2.0 is vulnerable to SQL injection. (no CVSS, IBM Insights Foundation for Energy)
- [CVE-2017-1324](https://cve.now/CVE-2017-1324.md): IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Engineering Lifecycle Manager)
- [CVE-2017-1334](https://cve.now/CVE-2017-1334.md): IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Engineering Lifecycle Manager)
- [CVE-2017-1335](https://cve.now/CVE-2017-1335.md): IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Engineering Lifecycle Manager)
- [CVE-2017-1345](https://cve.now/CVE-2017-1345.md): IBM Insights Foundation for Energy 2.0 is vulnerable to cross-site scripting. (no CVSS, IBM Insights Foundation for Energy)
- [CVE-2017-1359](https://cve.now/CVE-2017-1359.md): IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Engineering Lifecycle Manager)
- [CVE-2017-1364](https://cve.now/CVE-2017-1364.md): IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Engineering Lifecycle Manager)
- [CVE-2017-1369](https://cve.now/CVE-2017-1369.md): IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Engineering Lifecycle Manager)
- [CVE-2017-1429](https://cve.now/CVE-2017-1429.md): IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Engineering Lifecycle Manager)
- [CVE-2017-1569](https://cve.now/CVE-2017-1569.md): IBM WebSphere Commerce 7.0 and 8.0 contains an unspecified vulnerability in Marketing ESpot's that could cause a denial of service. (no CVSS, IBM WebSphere Commerce Enterprise)
- [CVE-2015-7357](https://cve.now/CVE-2015-7357.md): Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to… (no CVSS)
- [CVE-2015-7358](https://cve.now/CVE-2015-7358.md): The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows… (no CVSS)
- [CVE-2015-7359](https://cve.now/CVE-2015-7359.md): The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed… (no CVSS)
- [CVE-2015-3321](https://cve.now/CVE-2015-3321.md): Services and files in Lenovo Fingerprint Manager before 8.01.42 have incorrect ACLs, which allows local users to invalidate local checks… (no CVSS)
- [CVE-2015-6576](https://cve.now/CVE-2015-6576.md): Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java… (no CVSS)
- [CVE-2015-6971](https://cve.now/CVE-2015-6971.md): Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update… (no CVSS)
- [CVE-2015-7841](https://cve.now/CVE-2015-7841.md): The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with… (no CVSS)
- [CVE-2015-7843](https://cve.now/CVE-2015-7843.md): The management interface on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software… (no CVSS)
- [CVE-2015-7980](https://cve.now/CVE-2015-7980.md): Cross-site scripting (XSS) vulnerability in the Compass Rose module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to inject… (no CVSS)
- [CVE-2017-11321](https://cve.now/CVE-2017-11321.md): The restricted shell interface in UCOPIA Wireless Appliance before 5.1.8 allows remote authenticated users to gain 'admin' privileges via… (no CVSS)
- [CVE-2017-11322](https://cve.now/CVE-2017-11322.md): The chroothole\_client executable in UCOPIA Wireless Appliance before 5.1.8 allows remote attackers to gain root privileges via a dollar… (no CVSS)
- [CVE-2017-14754](https://cve.now/CVE-2017-14754.md): OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as… (no CVSS)
- [CVE-2017-14755](https://cve.now/CVE-2017-14755.md): OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as… (no CVSS)
- [CVE-2017-14756](https://cve.now/CVE-2017-14756.md): OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as… (no CVSS)
- [CVE-2017-14757](https://cve.now/CVE-2017-14757.md): OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as… (no CVSS)
- [CVE-2017-14758](https://cve.now/CVE-2017-14758.md): OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as… (no CVSS)
- [CVE-2017-14759](https://cve.now/CVE-2017-14759.md): OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as… (no CVSS)
- [CVE-2017-14979](https://cve.now/CVE-2017-14979.md): Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary… (no CVSS)
- [CVE-2017-14990](https://cve.now/CVE-2017-14990.md): WordPress 4.8.2 stores cleartext wp\_signups.activation\_key values (but stores the analogous wp\_users.user\_activation\_key values as… (no CVSS)
- [CVE-2017-6089](https://cve.now/CVE-2017-6089.md): SQL injection vulnerability in PhpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) project… (no CVSS)
- [CVE-2017-6090](https://cve.now/CVE-2017-6090.md): Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to… (no CVSS)
- [CVE-2017-12620](https://cve.now/CVE-2017-12620.md): When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only… (no CVSS, Apache Software Foundation Apache OpenNLP · org.apache.open…)
- [CVE-2017-12792](https://cve.now/CVE-2017-12792.md): Multiple cross-site request forgery (CSRF) vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack the authentication of… (no CVSS)
- [CVE-2017-9537](https://cve.now/CVE-2017-9537.md): Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows… (no CVSS)
- [CVE-2017-9538](https://cve.now/CVE-2017-9538.md): The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to… (no CVSS)
- [CVE-2014-0043](https://cve.now/CVE-2014-0043.md): In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of… (no CVSS, Apache Software Foundation Apache Wicket · org.apache.wicke…)
- [CVE-2016-6806](https://cve.now/CVE-2016-6806.md): Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin… (no CVSS, Apache Software Foundation Apache Wicket · org.apache.wicke…)
- [CVE-2017-9797](https://cve.now/CVE-2017-9797.md): When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode… (no CVSS, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2017-13997](https://cve.now/CVE-2017-13997.md): A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and… (no CVSS, Schneider Electric InduSoft Web Studio, InTouch Machine Edi…)
- [CVE-2017-14983](https://cve.now/CVE-2017-14983.md): Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators… (no CVSS)
- [CVE-2017-14984](https://cve.now/CVE-2017-14984.md): Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject… (no CVSS)
- [CVE-2017-14985](https://cve.now/CVE-2017-14985.md): Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject… (no CVSS)
- [CVE-2017-14988](https://cve.now/CVE-2017-14988.md): Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessive memory… (no CVSS)
- [CVE-2017-14989](https://cve.now/CVE-2017-14989.md): A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a… (no CVSS)
- [CVE-2017-8018](https://cve.now/CVE-2017-8018.md): EMC AppSync host plug-in versions 3.5 and below (Windows platform only) includes a denial of service (DoS) vulnerability that could… (no CVSS, EMC AppSync host plug-in versions 3.5 and below)
- [CVE-2017-8021](https://cve.now/CVE-2017-8021.md): EMC Elastic Cloud Storage (ECS) before 3.1 is affected by an undocumented account vulnerability that could potentially be leveraged by… (no CVSS, EMC Elastic Cloud Storage all versions prior to)
- [CVE-2017-14981](https://cve.now/CVE-2017-14981.md): Cross-Site Scripting (XSS) was discovered in ATutor before 2.2.3. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-10-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.