CVEs published September 7, 2017
77 CVEs were published on September 7, 2017: 0 critical, 1 high. 1 is now in CISA KEV.
- Published
- 77
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 76
- Now in CISA KEV
- 1
- Fix available
- 4
Most affected products
- Cisco Firepower Management Center
- 2
- Cisco IOS and Cisco IOS XE
- 2
- Cisco IOS XE
- 2
- Cisco Meeting Server
- 2
- Cisco Prime Collaboration Provisioning Tool
- 2
- centreon/centreon
- 1
- Cisco ASR 5500 System Architecture Evolution Gateway
- 1
- Cisco Catalyst 4000 Series Switches
- 1
- Cisco Email Security Appliance
- 1
- Cisco Emergency Responder
- 1
High 1
Medium, low and unrated 76
- CVE-2017-14219XSS (persistent) on the Intelbras Wireless N 150Mbps router with firmware WRN 240 allows attackers to steal wireless credentials without bei
- CVE-2017-12211A vulnerability in the IPv6 Simple Network Management Protocol (SNMP) code of Cisco IOS and Cisco IOS XE Software could allow an authenticatCisco IOS and Cisco IOS XE
- CVE-2017-12212A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-Cisco Unity Connection
- CVE-2017-12213A vulnerability in the dynamic access control list (ACL) feature of Cisco IOS XE Software running on Cisco Catalyst 4000 Series Switches couCisco Catalyst 4000 Series Switches
- CVE-2017-12216A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write Cisco SocialMiner
- CVE-2017-12217A vulnerability in the General Packet Radio Service (GPRS) Tunneling Protocol ingress packet handler of Cisco ASR 5500 System Architecture ECisco ASR 5500 System Architecture Evolution Gateway
- CVE-2017-12218A vulnerability in the malware detection functionality within Advanced Malware Protection (AMP) of Cisco AsyncOS Software for Cisco Email SeCisco Email Security Appliance
- CVE-2017-12220A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker tCisco Firepower Management Center
- CVE-2017-12221A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-sCisco Firepower Management Center
- CVE-2017-12223A vulnerability in the ROM Monitor (ROMMON) code of Cisco IR800 Integrated Services Router Software could allow an unauthenticated, local atCisco IR800 Integrated Services Router
- CVE-2017-12224A vulnerability in the ability for guest users to join meetings via a hyperlink with Cisco Meeting Server could allow an authenticated, remoCisco Meeting Server
- CVE-2017-12225A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack Cisco Prime LAN Management Solution
- CVE-2017-12227A vulnerability in the SQL database interface for Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a blindCisco Emergency Responder
- CVE-2017-6631A vulnerability in the HTTP remote procedure call (RPC) service of set-top box (STB) receivers manufactured by Cisco for Yes could allow an Cisco Yes Set-Top Box
- CVE-2017-6780A vulnerability in the TCP throttling process for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attackerCisco IoT Field Network Director
- CVE-2017-6789A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integriCisco Unified Intelligence Center
- CVE-2017-6791A vulnerability in the Trust Verification Service (TVS) of Cisco Unified Communications Manager could allow an unauthenticated, remote attacCisco Unified Communications Manager
- CVE-2017-6792A vulnerability in the batch provisioning feature in Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attackCisco Prime Collaboration Provisioning Tool
- CVE-2017-6793A vulnerability in the Inventory Management feature of Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attaCisco Prime Collaboration Provisioning Tool
- CVE-2017-6794A vulnerability in the CLI command-parsing code of Cisco Meeting Server could allow an authenticated, local attacker to perform command injeCisco Meeting Server
- CVE-2017-6795A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an aCisco IOS XE
- CVE-2017-6796A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an aCisco IOS XE
- CVE-2014-9565Cross-site request forgery (CSRF) vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware 3.4.0000
- CVE-2015-3169Cross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch.
- CVE-2015-3222syscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute arbitrary code as root.
- CVE-2015-3313SQL injection vulnerability in WordPress Community Events plugin before 1.4.
- CVE-2015-3314SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.
- CVE-2015-3991strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.
- CVE-2015-4085Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
- CVE-2015-4619Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.spina
- CVE-2015-4627SQL injection vulnerability in Pragyan CMS 3.0.
- CVE-2015-4629Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication,
- CVE-2015-4697Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563.
- CVE-2015-4721Multiple cross-site scripting (XSS) vulnerabilities in Concrete5 5.7.3.1.
- CVE-2015-4724SQL injection vulnerability in Concrete5 5.7.3.1.
- CVE-2015-5052SQL injection vulnerability in Sefrengo before 1.6.5 beta2.
- CVE-2015-5060Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev.
- CVE-2015-7672Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27).centreon/centreon
- CVE-2015-8079qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.
- CVE-2017-14192The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field.
- CVE-2017-14193The oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer.
- CVE-2017-14194The out function in controllers/member/Login.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer.
- CVE-2017-14195The call_msg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explo
- CVE-2013-7428The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service via the url parameter to plugin_googlemap2
- CVE-2017-1098IBM Emptoris Supplier Lifecycle Management 10.1.0.x is vulnerable to cross-site scripting.
- CVE-2017-1189IBM WebSphere Portal and Web Content Manager 6.1, 7.0, and 8.0 is vulnerable to cross-site scripting.
- CVE-2017-14181DeleteBitBuffer in libbitbuf/bitbuffer.c in mp4tools aacplusenc 0.17.5 allows remote attackers to cause a denial of service (invalid memory
- CVE-2017-1502IBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vulnerable to cross-site scripting.
- CVE-2015-1590The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl.
- CVE-2017-12911The "apetag.c" file in MP3Gain 1.5.2.r2 has a vulnerability which results in a stack memory corruption when opening a crafted MP3 file.
- CVE-2017-12912The "mpglibDBL/layer3.c" file in MP3Gain 1.5.2.r2 has a vulnerability which results in a read access violation when opening a crafted MP3 fi
- CVE-2017-14147An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a route
- CVE-2017-9779OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but with much less impact.
- CVE-2017-9834SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via
- CVE-2015-3250Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.org.apache.directory.api:api-ldap-model
- CVE-2015-3442Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call.
- CVE-2016-0732The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when config
- CVE-2016-10405Session fixation vulnerability in D-Link DIR-600L routers (rev.
- CVE-2017-11567Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of us
- CVE-2017-12133Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows
- CVE-2017-12416Cross-site scripting (XSS) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.
- CVE-2017-12794In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 ddjango
- CVE-2017-12838Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests t
- CVE-2017-12906Multiple cross-site scripting (XSS) vulnerabilities in NexusPHP allow remote attackers to inject arbitrary web script or HTML via the PATH_I
- CVE-2017-13713T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bi
- CVE-2017-13754Cross-site scripting (XSS) vulnerability in the "advanced settings - time server" module in Wibu-Systems CodeMeter before 6.50b allows remot
- CVE-2017-13771Lexmark Scan To Network (SNF) 3.2.9 and earlier stores network configuration credentials in plaintext and transmits them in requests, which
- CVE-2017-6362Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vect
- CVE-2017-9458XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1
- CVE-2017-14169In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, an integer signedness error might occur when a crafted
- CVE-2017-14170In libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause
- CVE-2017-14171In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge
- CVE-2017-14172In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause huge CPU consumption
- CVE-2017-14173In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuant
- CVE-2017-14174In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU
- CVE-2017-14175In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cause huge CPU consumpti