# CVEs published 2017-09-05

26 CVEs were published on September 5, 2017: 0 critical, 7 high. Days are UTC.

- [CVE-2017-1097](https://cve.now/CVE-2017-1097.md): IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site request forgery which could allow an (no CVSS, IBM Emptoris Strategic Supply Management)
- [CVE-2017-1129](https://cve.now/CVE-2017-1129.md): IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. (no CVSS, IBM Lotus Expeditor · IBM Notes)
- [CVE-2017-1130](https://cve.now/CVE-2017-1130.md): IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. (no CVSS, IBM Notes)
- [CVE-2017-1457](https://cve.now/CVE-2017-1457.md): IBM QRadar Network Security 5.4 is vulnerable to cross-site scripting. (no CVSS, IBM QRadar Network Security)
- [CVE-2017-1458](https://cve.now/CVE-2017-1458.md): IBM QRadar Network Security 5.4 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. (no CVSS, IBM QRadar Network Security)
- [CVE-2017-1491](https://cve.now/CVE-2017-1491.md): IBM QRadar Network Security 5.4 supports interaction between multiple actors and allows those actors to negotiate which algorithm should be (no CVSS, IBM QRadar Network Security)
- [CVE-2017-5698](https://cve.now/CVE-2017-5698.md): Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology firmware versions 11.0.25.3001 and 11. (no CVSS, Intel Active Management Technology, Intel Standard Manageab…)
- [CVE-2017-14159](https://cve.now/CVE-2017-14159.md): slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to ki (no CVSS)
- [CVE-2017-2779](https://cve.now/CVE-2017-2779.md): An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015, (CVSS 7.5, National Instruments LabVIEW)
- [CVE-2017-2807](https://cve.now/CVE-2017-2807.md): An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. (CVSS 7.5, Ledger CLI)
- [CVE-2017-2808](https://cve.now/CVE-2017-2808.md): An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. (CVSS 7.5, Ledger CLI)
- [CVE-2017-2821](https://cve.now/CVE-2017-2821.md): An exploitable use-after-free exists in the PDF parsing functionality of Lexmark Perspective Document Filters 11.3.0.2400 and 11.4.0.2452. (CVSS 8.8, Lexmark Perceptive Document Filters)
- [CVE-2017-2822](https://cve.now/CVE-2017-2822.md): An exploitable code execution vulnerability exists in the image rendering functionality of Lexmark Perceptive Document Filters 11.3.0.2400. (CVSS 7.5, Lexmark Perceptive Document Filters)
- [CVE-2017-2862](https://cve.now/CVE-2017-2862.md): An exploitable heap overflow vulnerability exists in the gdk\_pixbuf\_\_jpeg\_image\_load\_increment functionality of Gdk-Pixbuf 2.36.6. (CVSS 8.8, GNOME Gdk-Pixbuf)
- [CVE-2017-2870](https://cve.now/CVE-2017-2870.md): An exploitable integer overflow vulnerability exists in the tiff\_image\_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. (CVSS 8.8, GNOME Gdk-Pixbuf)
- [CVE-2017-14156](https://cve.now/CVE-2017-14156.md): The atyfb\_ioctl function in drivers/video/fbdev/aty/atyfb\_base.c in the Linux kernel through 4.12.10 does not initialize a certain data stru (no CVSS)
- [CVE-2017-14158](https://cve.now/CVE-2017-14158.md): Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via large files because arbitrarily many files are read (no CVSS, scrapy)
- [CVE-2017-14151](https://cve.now/CVE-2017-14151.md): An off-by-one error was discovered in opj\_tcd\_code\_block\_enc\_allocate\_data in lib/openjp2/tcd.c in OpenJPEG 2.2.0. (no CVSS)
- [CVE-2017-14152](https://cve.now/CVE-2017-14152.md): A mishandled zero case was discovered in opj\_j2k\_set\_cinema\_parameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0. (no CVSS)
- [CVE-2016-3086](https://cve.now/CVE-2016-3086.md): The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by (no CVSS, Apache Software Foundation Apache Hadoop · org.apache.hadoo…)
- [CVE-2017-14145](https://cve.now/CVE-2017-14145.md): HelpDEZk 1.1.1 has SQL Injection in app\\modules\\admin\\controllers\\loginController.php via the admin/login/getWarningInfo/id/ PATH\_INFO, rela (no CVSS)
- [CVE-2017-14146](https://cve.now/CVE-2017-14146.md): HelpDEZk 1.1.1 allows remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it in the (no CVSS)
- [CVE-2017-14149](https://cve.now/CVE-2017-14149.md): GoAhead 3.4.0 through 3.6.5 has a NULL Pointer Dereference in the websDecodeUrl function in http.c, leading to a crash for a "POST / HTTP/1. (no CVSS)
- [CVE-2017-1000083](https://cve.now/CVE-2017-1000083.md): backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary com (no CVSS)
- [CVE-2017-14108](https://cve.now/CVE-2017-14108.md): libgedit.a in GNOME gedit through 3.22.1 allows remote attackers to cause a denial of service (CPU consumption) via a file that begins with (no CVSS)
- [CVE-2017-14140](https://cve.now/CVE-2017-14140.md): The move\_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective uid of the target process, enabling (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-09-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.