# CVEs published 2017-10-17

41 CVEs were published on October 17, 2017: 0 critical, 1 high. Days are UTC.

- [CVE-2017-13999](https://cve.now/CVE-2017-13999.md): A Stack-based Buffer Overflow issue was discovered in WECON LEVI Studio HMI Editor v1.8.1 and prior. (no CVSS, WECON Technology Co., Ltd. LeviStudio HMI Editor)
- [CVE-2017-14005](https://cve.now/CVE-2017-14005.md): An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. (no CVSS, ProMinent MultiFLEX M10a Controller)
- [CVE-2017-14007](https://cve.now/CVE-2017-14007.md): An Insufficient Session Expiration issue was discovered in ProMinent MultiFLEX M10a Controller web interface. (no CVSS, ProMinent MultiFLEX M10a Controller)
- [CVE-2017-14009](https://cve.now/CVE-2017-14009.md): An Information Exposure issue was discovered in ProMinent MultiFLEX M10a Controller web interface. (no CVSS, ProMinent MultiFLEX M10a Controller)
- [CVE-2017-14011](https://cve.now/CVE-2017-14011.md): A Cross-Site Request Forgery issue was discovered in ProMinent MultiFLEX M10a Controller web interface. (no CVSS, ProMinent MultiFLEX M10a Controller)
- [CVE-2017-14013](https://cve.now/CVE-2017-14013.md): A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface. (no CVSS, ProMinent MultiFLEX M10a Controller)
- [CVE-2017-15565](https://cve.now/CVE-2017-15565.md): In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF… (no CVSS)
- [CVE-2017-9625](https://cve.now/CVE-2017-9625.md): An Improper Authentication issue was discovered in Envitech EnviDAS Ultimate Versions prior to v1.0.0.5. (no CVSS, Envitech Ltd. EnviDAS Ultimate)
- [CVE-2017-15539](https://cve.now/CVE-2017-15539.md): SQL Injection exists in zorovavi/blog through 2017-10-17 via the id parameter to recept.php. (no CVSS)
- [CVE-2017-15538](https://cve.now/CVE-2017-15538.md): Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to… (no CVSS)
- [CVE-2017-3758](https://cve.now/CVE-2017-3758.md): Improper access controls on several Android components in the Lenovo Service Framework application can be exploited to enable remote code… (no CVSS, Lenovo Group Service Framework application)
- [CVE-2017-3759](https://cve.now/CVE-2017-3759.md): The Lenovo Service Framework Android application accepts some responses from the server without proper validation. (no CVSS, Lenovo Group Service Framework application)
- [CVE-2017-3760](https://cve.now/CVE-2017-3760.md): The Lenovo Service Framework Android application uses a set of nonsecure credentials when performing integrity verification of downloaded… (no CVSS, Lenovo Group Service Framework application)
- [CVE-2017-3761](https://cve.now/CVE-2017-3761.md): The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. (no CVSS, Lenovo Group Service Framework application)
- [CVE-2017-5531](https://cve.now/CVE-2017-5531.md): Deployments of TIBCO Managed File Transfer Command Center versions 8.0.0 and 8.0.1 and TIBCO Managed File Transfer Internet Server… (CVSS 8.0, TIBCO Software TIBCO Managed File Transfer Command Center ·…)
- [CVE-2017-6273](https://cve.now/CVE-2017-6273.md): NVIDIA ADSP Firmware contains a vulnerability in the ADSP Loader component where there is the potential to write to a memory location that… (no CVSS, Nvidia Jetson)
- [CVE-2017-15537](https://cve.now/CVE-2017-15537.md): The x86/fpu (Floating Point Unit) subsystem in the Linux kernel before 4.13.5, when a processor supports the xsave feature but not the… (no CVSS)
- [CVE-2017-8805](https://cve.now/CVE-2017-8805.md): Debian ftpsync before 20171017 does not use the rsync --safe-links option, which allows remote attackers to conduct directory traversal… (no CVSS, Debian ftpsync before)
- [CVE-2014-8357](https://cve.now/CVE-2014-8357.md): backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows… (no CVSS)
- [CVE-2014-9118](https://cve.now/CVE-2014-9118.md): The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell… (no CVSS)
- [CVE-2015-7806](https://cve.now/CVE-2015-7806.md): Eval injection vulnerability in the fm\_saveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress… (no CVSS)
- [CVE-2014-2277](https://cve.now/CVE-2014-2277.md): The make\_temporary\_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to… (no CVSS)
- [CVE-2014-2664](https://cve.now/CVE-2014-2664.md): Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php… (no CVSS)
- [CVE-2014-8323](https://cve.now/CVE-2014-8323.md): buddy-ng.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with… (no CVSS)
- [CVE-2014-8324](https://cve.now/CVE-2014-8324.md): network.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a… (no CVSS)
- [CVE-2014-9487](https://cve.now/CVE-2014-9487.md): The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial… (no CVSS)
- [CVE-2014-9489](https://cve.now/CVE-2014-9489.md): The gollum-grit\_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the… (no CVSS, gollum · gollum-lib)
- [CVE-2014-9677](https://cve.now/CVE-2014-9677.md): Cross-site scripting (XSS) vulnerability in FlexPaperViewer.swf in Flexpaper before 2.3.1 allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2014-9678](https://cve.now/CVE-2014-9678.md): FlexPaperViewer.swf in Flexpaper before 2.3.1 allows remote attackers to conduct content-spoofing attacks via the Swfile parameter. (no CVSS)
- [CVE-2014-9697](https://cve.now/CVE-2014-9697.md): Huawei USG9560/9520/9580 before V300R001C01SPC300 allows remote attackers to cause a memory leak or denial of service (memory exhaustion… (no CVSS)
- [CVE-2014-9733](https://cve.now/CVE-2014-9733.md): nw.js before 0.11.5 can simulate user input events in a normal frame, which allows remote attackers to have unspecified impact via unknown… (no CVSS)
- [CVE-2017-13078](https://cve.now/CVE-2017-13078.md): Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an… (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13079](https://cve.now/CVE-2017-13079.md): Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during… (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13080](https://cve.now/CVE-2017-13080.md): Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an… (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13081](https://cve.now/CVE-2017-13081.md): Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during… (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13082](https://cve.now/CVE-2017-13082.md): Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key… (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13084](https://cve.now/CVE-2017-13084.md): Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey… (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13086](https://cve.now/CVE-2017-13086.md): Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS… (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13087](https://cve.now/CVE-2017-13087.md): Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a… (no CVSS)
- [CVE-2017-13088](https://cve.now/CVE-2017-13088.md): Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when… (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13077](https://cve.now/CVE-2017-13077.md): Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way… (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-10-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.