CVEs published September 6, 2017
26 CVEs were published on September 6, 2017: 0 critical, 0 high.
- Published
- 26
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 26
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- devise-two-factor
- 1
- ldapauth-fork · ldapauth
- 1
Medium, low and unrated 26
- CVE-2014-6438The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regula
- CVE-2015-0853svn-workbench 1.6.2 and earlier on a system with xeyes installed allows local users to execute arbitrary commands by using the "Command Shel
- CVE-2015-2210The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into th
- CVE-2015-2943Honda Moto LINC 1.6.1 does not verify SSL certificates.
- CVE-2015-3160XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive in
- CVE-2015-3161The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape </script> tags in string literals when producing JSON.
- CVE-2015-3162Cross-site scripting (XSS) vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 allows remote authenticated user
- CVE-2015-3163The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users
- CVE-2015-3450Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory corruption) or execute arbitrary code via a
- CVE-2015-3454TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashe
- CVE-2015-5186Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
- CVE-2015-5705Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and c
- CVE-2015-5947SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.
- CVE-2015-5948Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.
- CVE-2015-5959Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/s
- CVE-2015-6250simple-php-captcha before commit 9d65a945029c7be7bb6bc893759e74c5636be694 allows remote attackers to automatically generate the captcha resp
- CVE-2015-7225Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-timdevise-two-factor
- CVE-2015-7241XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.
- CVE-2015-7294ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.ldapauth-fork · ldapauth
- CVE-2015-8316Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled allows remote attacke
- CVE-2017-14164A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0.
- CVE-2017-14165The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has an issue where memory allocation is excessive because it depends only
- CVE-2017-14166libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a cra
- CVE-2017-12474The AP4_AtomSampleTable::GetSample function in Core/Ap4AtomSampleTable.cpp in Bento4 mp42ts before 1.5.0-616 allows remote attackers to caus
- CVE-2017-12475The AP4_Processor::Process function in Core/Ap4Processor.cpp in Bento4 mp4encrypt before 1.5.0-616 allows remote attackers to cause a denial
- CVE-2017-12476The AP4_AvccAtom::InspectFields function in Core/Ap4AvccAtom.cpp in Bento4 mp4dump before 1.5.0-616 allows remote attackers to cause a denia