# CVEs published 2017-10-18

54 CVEs were published on October 18, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-15600](https://cve.now/CVE-2017-15600.md): In GNU Libextractor 1.4, there is a NULL Pointer Dereference in the EXTRACTOR\_nsf\_extract\_method function of plugins/nsf\_extractor.c. (no CVSS)
- [CVE-2017-15601](https://cve.now/CVE-2017-15601.md): In GNU Libextractor 1.4, there is a heap-based buffer overflow in the EXTRACTOR\_png\_extract\_method function in plugins/png\_extractor.c… (no CVSS)
- [CVE-2017-15602](https://cve.now/CVE-2017-15602.md): In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR\_nsfe\_extract\_method function in… (no CVSS)
- [CVE-2015-5227](https://cve.now/CVE-2015-5227.md): The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter. (no CVSS)
- [CVE-2015-5376](https://cve.now/CVE-2015-5376.md): SQL injection vulnerability in the login form in GSI WiNPAT Portal 3.2.0.1001 through 3.6.1.0 allows remote attackers to execute arbitrary… (no CVSS)
- [CVE-2015-5739](https://cve.now/CVE-2015-5739.md): The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers… (no CVSS, stdlib)
- [CVE-2015-5740](https://cve.now/CVE-2015-5740.md): The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to… (no CVSS, stdlib)
- [CVE-2015-6961](https://cve.now/CVE-2015-6961.md): Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and… (no CVSS)
- [CVE-2015-7714](https://cve.now/CVE-2015-7714.md): Multiple SQL injection vulnerabilities in the Realtyna RPL (com\_rpl) component before 8.9.5 for Joomla! allow remote administrators to… (no CVSS)
- [CVE-2015-7715](https://cve.now/CVE-2015-7715.md): Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com\_rpl) component before 8.9.5 for Joomla! allows remote attackers… (no CVSS)
- [CVE-2015-7943](https://cve.now/CVE-2015-7943.md): Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal… (no CVSS)
- [CVE-2016-5714](https://cve.now/CVE-2016-5714.md): Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host… (no CVSS)
- [CVE-2017-14322](https://cve.now/CVE-2017-14322.md): The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows… (no CVSS)
- [CVE-2017-14956](https://cve.now/CVE-2017-14956.md): AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the… (no CVSS)
- [CVE-2017-15359](https://cve.now/CVE-2017-15359.md): In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack… (no CVSS)
- [CVE-2015-1239](https://cve.now/CVE-2015-1239.md): Double free vulnerability in the j2k\_read\_ppm\_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote… (no CVSS)
- [CVE-2015-5164](https://cve.now/CVE-2015-5164.md): The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with… (no CVSS)
- [CVE-2015-2156](https://cve.now/CVE-2015-2156.md): Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x… (no CVSS, io.netty:netty-parent · org.jboss.netty:netty +1)
- [CVE-2015-3400](https://cve.now/CVE-2015-3400.md): sharenfs 0.6.4, when built with commits bcdd594 and 7d08880 from the zfs repository, provides world readable access to the shared zfs file… (no CVSS)
- [CVE-2017-8022](https://cve.now/CVE-2017-8022.md): An issue was discovered in EMC NetWorker (prior to 8.2.4.9, all supported 9.0.x versions, prior to 9.1.1.3, prior to 9.2.0.4). (no CVSS, EMC NetWorker prior to 8.2.4.9, 9.0.x (all supported versio…)
- [CVE-2011-5320](https://cve.now/CVE-2011-5320.md): scanf and related functions in glibc before 2.15 allow local users to cause a denial of service (segmentation fault) via a large string of… (no CVSS)
- [CVE-2014-3164](https://cve.now/CVE-2014-3164.md): cmds/servicemanager/service\_manager.c in Android before commit 7d42a3c31ba78a418f9bdde0e0ab951469f321b5 allows attackers to cause a denial… (no CVSS)
- [CVE-2014-3531](https://cve.now/CVE-2014-3531.md): Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web… (no CVSS)
- [CVE-2014-3706](https://cve.now/CVE-2014-3706.md): ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes… (no CVSS)
- [CVE-2014-3709](https://cve.now/CVE-2014-3709.md): The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct… (no CVSS, org.keycloak:keycloak-services)
- [CVE-2014-7242](https://cve.now/CVE-2014-7242.md): The SumaHo application 3.0.0 and earlier for Android and the SumaHo "driving capability" diagnosis result transmission application 1.2.2… (no CVSS)
- [CVE-2014-7813](https://cve.now/CVE-2014-7813.md): Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via… (no CVSS)
- [CVE-2014-8491](https://cve.now/CVE-2014-8491.md): The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a request to (1)… (no CVSS)
- [CVE-2017-13083](https://cve.now/CVE-2017-13083.md): Akeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over HTTP, allowing an… (CVSS 5.3, Akeo Consulting Rufus)
- [CVE-2017-8024](https://cve.now/CVE-2017-8024.md): EMC Isilon OneFS (versions prior to 8.1.0.1, versions prior to 8.0.1.2, versions prior to 8.0.0.6, version 7.2.1.x) is impacted by a… (no CVSS, EMC Isilon OneFS EMC Isilon OneFS versions prior to 8.1.0.1…)
- [CVE-2017-15583](https://cve.now/CVE-2017-15583.md): The embedded web server on ABB Fox515T 1.0 devices is vulnerable to Local File Inclusion. (no CVSS)
- [CVE-2017-15587](https://cve.now/CVE-2017-15587.md): An integer overflow was discovered in pdf\_read\_new\_xref\_section in pdf/pdf-xref.c in Artifex MuPDF 1.11. (no CVSS)
- [CVE-2017-15588](https://cve.now/CVE-2017-15588.md): An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race… (no CVSS)
- [CVE-2017-15589](https://cve.now/CVE-2017-15589.md): An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the host OS (or an… (no CVSS)
- [CVE-2017-15590](https://cve.now/CVE-2017-15590.md): An issue was discovered in Xen through 4.9.x allowing x86 guest OS users to cause a denial of service (hypervisor crash) or possibly gain… (no CVSS)
- [CVE-2017-15591](https://cve.now/CVE-2017-15591.md): An issue was discovered in Xen 4.5.x through 4.9.x allowing attackers (who control a stub domain kernel or tool stack) to cause a denial… (no CVSS)
- [CVE-2017-15592](https://cve.now/CVE-2017-15592.md): An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service (hypervisor crash) or possibly… (no CVSS)
- [CVE-2017-15593](https://cve.now/CVE-2017-15593.md): An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (memory leak) because reference… (no CVSS)
- [CVE-2017-15594](https://cve.now/CVE-2017-15594.md): An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service (hypervisor crash) or gain… (no CVSS)
- [CVE-2017-15595](https://cve.now/CVE-2017-15595.md): An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recursion, stack… (no CVSS)
- [CVE-2017-15596](https://cve.now/CVE-2017-15596.md): An issue was discovered in Xen 4.4.x through 4.9.x allowing ARM guest OS users to cause a denial of service (prevent physical CPU usage)… (no CVSS)
- [CVE-2016-10515](https://cve.now/CVE-2016-10515.md): In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages. (no CVSS)
- [CVE-2017-15568](https://cve.now/CVE-2017-15568.md): In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application\_helper.rb via a multi-value… (no CVSS)
- [CVE-2017-15569](https://cve.now/CVE-2017-15569.md): In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries\_helper.rb via a multi-value field… (no CVSS)
- [CVE-2017-15570](https://cve.now/CVE-2017-15570.md): In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/\_list.html.erb via crafted column data. (no CVSS)
- [CVE-2017-15571](https://cve.now/CVE-2017-15571.md): In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/\_list.html.erb via crafted column data. (no CVSS)
- [CVE-2017-15572](https://cve.now/CVE-2017-15572.md): In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a… (no CVSS)
- [CVE-2017-15573](https://cve.now/CVE-2017-15573.md): In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content. (no CVSS)
- [CVE-2017-15574](https://cve.now/CVE-2017-15574.md): In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment. (no CVSS)
- [CVE-2017-15575](https://cve.now/CVE-2017-15575.md): In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's… (no CVSS)
- [CVE-2017-15576](https://cve.now/CVE-2017-15576.md): Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain… (no CVSS)
- [CVE-2017-15577](https://cve.now/CVE-2017-15577.md): Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive… (no CVSS)
- [CVE-2017-15578](https://cve.now/CVE-2017-15578.md): In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/edit\_category.php. (no CVSS)
- [CVE-2017-15579](https://cve.now/CVE-2017-15579.md): In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa\_pages\_per\_page cookie in a playlist action to watch.php. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-10-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.