# CVEs published 2017-09-07

77 CVEs were published on September 7, 2017: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-14219](https://cve.now/CVE-2017-14219.md): XSS (persistent) on the Intelbras Wireless N 150Mbps router with firmware WRN 240 allows attackers to steal wireless credentials without bei (no CVSS)
- [CVE-2017-12211](https://cve.now/CVE-2017-12211.md): A vulnerability in the IPv6 Simple Network Management Protocol (SNMP) code of Cisco IOS and Cisco IOS XE Software could allow an authenticat (no CVSS, Cisco IOS and Cisco IOS XE)
- [CVE-2017-12212](https://cve.now/CVE-2017-12212.md): A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross- (no CVSS, Cisco Unity Connection)
- [CVE-2017-12213](https://cve.now/CVE-2017-12213.md): A vulnerability in the dynamic access control list (ACL) feature of Cisco IOS XE Software running on Cisco Catalyst 4000 Series Switches cou (no CVSS, Cisco Catalyst 4000 Series Switches)
- [CVE-2017-12216](https://cve.now/CVE-2017-12216.md): A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write (no CVSS, Cisco SocialMiner)
- [CVE-2017-12217](https://cve.now/CVE-2017-12217.md): A vulnerability in the General Packet Radio Service (GPRS) Tunneling Protocol ingress packet handler of Cisco ASR 5500 System Architecture E (no CVSS, Cisco ASR 5500 System Architecture Evolution Gateway)
- [CVE-2017-12218](https://cve.now/CVE-2017-12218.md): A vulnerability in the malware detection functionality within Advanced Malware Protection (AMP) of Cisco AsyncOS Software for Cisco Email Se (no CVSS, Cisco Email Security Appliance)
- [CVE-2017-12220](https://cve.now/CVE-2017-12220.md): A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker t (no CVSS, Cisco Firepower Management Center)
- [CVE-2017-12221](https://cve.now/CVE-2017-12221.md): A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-s (no CVSS, Cisco Firepower Management Center)
- [CVE-2017-12223](https://cve.now/CVE-2017-12223.md): A vulnerability in the ROM Monitor (ROMMON) code of Cisco IR800 Integrated Services Router Software could allow an unauthenticated, local at (no CVSS, Cisco IR800 Integrated Services Router)
- [CVE-2017-12224](https://cve.now/CVE-2017-12224.md): A vulnerability in the ability for guest users to join meetings via a hyperlink with Cisco Meeting Server could allow an authenticated, remo (no CVSS, Cisco Meeting Server)
- [CVE-2017-12225](https://cve.now/CVE-2017-12225.md): A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack (no CVSS, Cisco Prime LAN Management Solution)
- [CVE-2017-12227](https://cve.now/CVE-2017-12227.md): A vulnerability in the SQL database interface for Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a blind (no CVSS, Cisco Emergency Responder)
- [CVE-2017-6627](https://cve.now/CVE-2017-6627.md): A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, re (CVSS 7.5, KEV, Cisco IOS and Cisco IOS XE)
- [CVE-2017-6631](https://cve.now/CVE-2017-6631.md): A vulnerability in the HTTP remote procedure call (RPC) service of set-top box (STB) receivers manufactured by Cisco for Yes could allow an (no CVSS, Cisco Yes Set-Top Box)
- [CVE-2017-6780](https://cve.now/CVE-2017-6780.md): A vulnerability in the TCP throttling process for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker (no CVSS, Cisco IoT Field Network Director)
- [CVE-2017-6789](https://cve.now/CVE-2017-6789.md): A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integri (no CVSS, Cisco Unified Intelligence Center)
- [CVE-2017-6791](https://cve.now/CVE-2017-6791.md): A vulnerability in the Trust Verification Service (TVS) of Cisco Unified Communications Manager could allow an unauthenticated, remote attac (no CVSS, Cisco Unified Communications Manager)
- [CVE-2017-6792](https://cve.now/CVE-2017-6792.md): A vulnerability in the batch provisioning feature in Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attack (no CVSS, Cisco Prime Collaboration Provisioning Tool)
- [CVE-2017-6793](https://cve.now/CVE-2017-6793.md): A vulnerability in the Inventory Management feature of Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote atta (no CVSS, Cisco Prime Collaboration Provisioning Tool)
- [CVE-2017-6794](https://cve.now/CVE-2017-6794.md): A vulnerability in the CLI command-parsing code of Cisco Meeting Server could allow an authenticated, local attacker to perform command inje (no CVSS, Cisco Meeting Server)
- [CVE-2017-6795](https://cve.now/CVE-2017-6795.md): A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an a (no CVSS, Cisco IOS XE)
- [CVE-2017-6796](https://cve.now/CVE-2017-6796.md): A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an a (no CVSS, Cisco IOS XE)
- [CVE-2014-9565](https://cve.now/CVE-2014-9565.md): Cross-site request forgery (CSRF) vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware 3.4.0000 (no CVSS)
- [CVE-2015-3169](https://cve.now/CVE-2015-3169.md): Cross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch. (no CVSS)
- [CVE-2015-3222](https://cve.now/CVE-2015-3222.md): syscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute arbitrary code as root. (no CVSS)
- [CVE-2015-3313](https://cve.now/CVE-2015-3313.md): SQL injection vulnerability in WordPress Community Events plugin before 1.4. (no CVSS)
- [CVE-2015-3314](https://cve.now/CVE-2015-3314.md): SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5. (no CVSS)
- [CVE-2015-3991](https://cve.now/CVE-2015-3991.md): strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code. (no CVSS)
- [CVE-2015-4085](https://cve.now/CVE-2015-4085.md): Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1. (no CVSS)
- [CVE-2015-4619](https://cve.now/CVE-2015-4619.md): Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75. (no CVSS, spina)
- [CVE-2015-4627](https://cve.now/CVE-2015-4627.md): SQL injection vulnerability in Pragyan CMS 3.0. (no CVSS)
- [CVE-2015-4629](https://cve.now/CVE-2015-4629.md): Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication, (no CVSS)
- [CVE-2015-4697](https://cve.now/CVE-2015-4697.md): Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563. (no CVSS)
- [CVE-2015-4721](https://cve.now/CVE-2015-4721.md): Multiple cross-site scripting (XSS) vulnerabilities in Concrete5 5.7.3.1. (no CVSS)
- [CVE-2015-4724](https://cve.now/CVE-2015-4724.md): SQL injection vulnerability in Concrete5 5.7.3.1. (no CVSS)
- [CVE-2015-5052](https://cve.now/CVE-2015-5052.md): SQL injection vulnerability in Sefrengo before 1.6.5 beta2. (no CVSS)
- [CVE-2015-5060](https://cve.now/CVE-2015-5060.md): Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev. (no CVSS)
- [CVE-2015-7672](https://cve.now/CVE-2015-7672.md): Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27). (no CVSS, centreon/centreon)
- [CVE-2015-8079](https://cve.now/CVE-2015-8079.md): qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db. (no CVSS)
- [CVE-2017-14192](https://cve.now/CVE-2017-14192.md): The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field. (no CVSS)
- [CVE-2017-14193](https://cve.now/CVE-2017-14193.md): The oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer. (no CVSS)
- [CVE-2017-14194](https://cve.now/CVE-2017-14194.md): The out function in controllers/member/Login.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer. (no CVSS)
- [CVE-2017-14195](https://cve.now/CVE-2017-14195.md): The call\_msg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explo (no CVSS)
- [CVE-2013-7428](https://cve.now/CVE-2013-7428.md): The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service via the url parameter to plugin\_googlemap2 (no CVSS)
- [CVE-2017-1098](https://cve.now/CVE-2017-1098.md): IBM Emptoris Supplier Lifecycle Management 10.1.0.x is vulnerable to cross-site scripting. (no CVSS)
- [CVE-2017-1189](https://cve.now/CVE-2017-1189.md): IBM WebSphere Portal and Web Content Manager 6.1, 7.0, and 8.0 is vulnerable to cross-site scripting. (no CVSS)
- [CVE-2017-14181](https://cve.now/CVE-2017-14181.md): DeleteBitBuffer in libbitbuf/bitbuffer.c in mp4tools aacplusenc 0.17.5 allows remote attackers to cause a denial of service (invalid memory (no CVSS)
- [CVE-2017-1502](https://cve.now/CVE-2017-1502.md): IBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vulnerable to cross-site scripting. (no CVSS)
- [CVE-2015-1590](https://cve.now/CVE-2015-1590.md): The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio\_ctl. (no CVSS)
- [CVE-2017-12911](https://cve.now/CVE-2017-12911.md): The "apetag.c" file in MP3Gain 1.5.2.r2 has a vulnerability which results in a stack memory corruption when opening a crafted MP3 file. (no CVSS)
- [CVE-2017-12912](https://cve.now/CVE-2017-12912.md): The "mpglibDBL/layer3.c" file in MP3Gain 1.5.2.r2 has a vulnerability which results in a read access violation when opening a crafted MP3 fi (no CVSS)
- [CVE-2017-14147](https://cve.now/CVE-2017-14147.md): An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a route (no CVSS)
- [CVE-2017-9779](https://cve.now/CVE-2017-9779.md): OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but with much less impact. (no CVSS)
- [CVE-2017-9834](https://cve.now/CVE-2017-9834.md): SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2015-3250](https://cve.now/CVE-2015-3250.md): Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors. (no CVSS, org.apache.directory.api:api-ldap-model)
- [CVE-2015-3442](https://cve.now/CVE-2015-3442.md): Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call. (no CVSS)
- [CVE-2016-0732](https://cve.now/CVE-2016-0732.md): The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when config (no CVSS)
- [CVE-2016-10405](https://cve.now/CVE-2016-10405.md): Session fixation vulnerability in D-Link DIR-600L routers (rev. (no CVSS)
- [CVE-2017-11567](https://cve.now/CVE-2017-11567.md): Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of us (no CVSS)
- [CVE-2017-12133](https://cve.now/CVE-2017-12133.md): Use-after-free vulnerability in the clntudp\_call function in sunrpc/clnt\_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows (no CVSS)
- [CVE-2017-12416](https://cve.now/CVE-2017-12416.md): Cross-site scripting (XSS) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6. (no CVSS)
- [CVE-2017-12794](https://cve.now/CVE-2017-12794.md): In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 d (no CVSS, django)
- [CVE-2017-12838](https://cve.now/CVE-2017-12838.md): Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests t (no CVSS)
- [CVE-2017-12906](https://cve.now/CVE-2017-12906.md): Multiple cross-site scripting (XSS) vulnerabilities in NexusPHP allow remote attackers to inject arbitrary web script or HTML via the PATH\_I (no CVSS)
- [CVE-2017-13713](https://cve.now/CVE-2017-13713.md): T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bi (no CVSS)
- [CVE-2017-13754](https://cve.now/CVE-2017-13754.md): Cross-site scripting (XSS) vulnerability in the "advanced settings - time server" module in Wibu-Systems CodeMeter before 6.50b allows remot (no CVSS)
- [CVE-2017-13771](https://cve.now/CVE-2017-13771.md): Lexmark Scan To Network (SNF) 3.2.9 and earlier stores network configuration credentials in plaintext and transmits them in requests, which (no CVSS)
- [CVE-2017-6362](https://cve.now/CVE-2017-6362.md): Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vect (no CVSS)
- [CVE-2017-9458](https://cve.now/CVE-2017-9458.md): XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1 (no CVSS)
- [CVE-2017-14169](https://cve.now/CVE-2017-14169.md): In the mxf\_read\_primer\_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3 -\> 2.4, an integer signedness error might occur when a crafted (no CVSS)
- [CVE-2017-14170](https://cve.now/CVE-2017-14170.md): In libavformat/mxfdec.c in FFmpeg 3.3.3 -\> 2.4, a DoS in mxf\_read\_index\_entry\_array() due to lack of an EOF (End of File) check might cause (no CVSS)
- [CVE-2017-14171](https://cve.now/CVE-2017-14171.md): In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv\_parse\_NSVf\_header() due to lack of an EOF (End of File) check might cause huge (no CVSS)
- [CVE-2017-14172](https://cve.now/CVE-2017-14172.md): In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause huge CPU consumption (no CVSS)
- [CVE-2017-14173](https://cve.now/CVE-2017-14173.md): In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuant (no CVSS)
- [CVE-2017-14174](https://cve.now/CVE-2017-14174.md): In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU (no CVSS)
- [CVE-2017-14175](https://cve.now/CVE-2017-14175.md): In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cause huge CPU consumpti (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-09-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.