# CVEs published 2017-09-06 26 CVEs were published on September 6, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2014-6438](https://cve.now/CVE-2014-6438.md): The URI.decode\_www\_form\_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regula (no CVSS) - [CVE-2015-0853](https://cve.now/CVE-2015-0853.md): svn-workbench 1.6.2 and earlier on a system with xeyes installed allows local users to execute arbitrary commands by using the "Command Shel (no CVSS) - [CVE-2015-2210](https://cve.now/CVE-2015-2210.md): The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into th (no CVSS) - [CVE-2015-2943](https://cve.now/CVE-2015-2943.md): Honda Moto LINC 1.6.1 does not verify SSL certificates. (no CVSS) - [CVE-2015-3160](https://cve.now/CVE-2015-3160.md): XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive in (no CVSS) - [CVE-2015-3161](https://cve.now/CVE-2015-3161.md): The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape \ tags in string literals when producing JSON. (no CVSS) - [CVE-2015-3162](https://cve.now/CVE-2015-3162.md): Cross-site scripting (XSS) vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 allows remote authenticated user (no CVSS) - [CVE-2015-3163](https://cve.now/CVE-2015-3163.md): The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users (no CVSS) - [CVE-2015-3450](https://cve.now/CVE-2015-3450.md): Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory corruption) or execute arbitrary code via a (no CVSS) - [CVE-2015-3454](https://cve.now/CVE-2015-3454.md): TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashe (no CVSS) - [CVE-2015-5186](https://cve.now/CVE-2015-5186.md): Audit before 2.4.4 in Linux does not sanitize escape characters in filenames. (no CVSS) - [CVE-2015-5705](https://cve.now/CVE-2015-5705.md): Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and c (no CVSS) - [CVE-2015-5947](https://cve.now/CVE-2015-5947.md): SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. (no CVSS) - [CVE-2015-5948](https://cve.now/CVE-2015-5948.md): Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. (no CVSS) - [CVE-2015-5959](https://cve.now/CVE-2015-5959.md): Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/s (no CVSS) - [CVE-2015-6250](https://cve.now/CVE-2015-6250.md): simple-php-captcha before commit 9d65a945029c7be7bb6bc893759e74c5636be694 allows remote attackers to automatically generate the captcha resp (no CVSS) - [CVE-2015-7225](https://cve.now/CVE-2015-7225.md): Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-tim (no CVSS, devise-two-factor) - [CVE-2015-7241](https://cve.now/CVE-2015-7241.md): XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01. (no CVSS) - [CVE-2015-7294](https://cve.now/CVE-2015-7294.md): ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username. (no CVSS, ldapauth-fork ยท ldapauth) - [CVE-2015-8316](https://cve.now/CVE-2015-8316.md): Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled allows remote attacke (no CVSS) - [CVE-2017-14164](https://cve.now/CVE-2017-14164.md): A size-validation issue was discovered in opj\_j2k\_write\_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. (no CVSS) - [CVE-2017-14165](https://cve.now/CVE-2017-14165.md): The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has an issue where memory allocation is excessive because it depends only (no CVSS) - [CVE-2017-14166](https://cve.now/CVE-2017-14166.md): libarchive 3.3.2 allows remote attackers to cause a denial of service (xml\_data heap-based buffer over-read and application crash) via a cra (no CVSS) - [CVE-2017-12474](https://cve.now/CVE-2017-12474.md): The AP4\_AtomSampleTable::GetSample function in Core/Ap4AtomSampleTable.cpp in Bento4 mp42ts before 1.5.0-616 allows remote attackers to caus (no CVSS) - [CVE-2017-12475](https://cve.now/CVE-2017-12475.md): The AP4\_Processor::Process function in Core/Ap4Processor.cpp in Bento4 mp4encrypt before 1.5.0-616 allows remote attackers to cause a denial (no CVSS) - [CVE-2017-12476](https://cve.now/CVE-2017-12476.md): The AP4\_AvccAtom::InspectFields function in Core/Ap4AvccAtom.cpp in Bento4 mp4dump before 1.5.0-616 allows remote attackers to cause a denia (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-09-06 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.