# CVEs published 2017-09-11 82 CVEs were published on September 11, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-14312](https://cve.now/CVE-2017-14312.md): Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a no (no CVSS) - [CVE-2015-4687](https://cve.now/CVE-2015-4687.md): Cross-site scripting (XSS) vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 allows remote attackers to inject arbitrary w (no CVSS) - [CVE-2015-4688](https://cve.now/CVE-2015-4688.md): Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allow remote attackers to enumerate user accounts via a series of requests. (no CVSS) - [CVE-2015-4689](https://cve.now/CVE-2015-4689.md): Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, (no CVSS) - [CVE-2015-5054](https://cve.now/CVE-2015-5054.md): Open redirect vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to redirect users to a (no CVSS) - [CVE-2015-8349](https://cve.now/CVE-2015-8349.md): Cross-site scripting (XSS) vulnerability in SourceBans before 2.0 pre-alpha allows remote attackers to inject arbitrary web script or HTML v (no CVSS) - [CVE-2015-8350](https://cve.now/CVE-2015-8350.md): Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to injec (no CVSS) - [CVE-2015-8351](https://cve.now/CVE-2015-8351.md): PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow\_url\_include is enabled, allows (no CVSS) - [CVE-2015-8353](https://cve.now/CVE-2015-8353.md): Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary w (no CVSS) - [CVE-2015-8354](https://cve.now/CVE-2015-8354.md): Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inje (no CVSS) - [CVE-2015-9226](https://cve.now/CVE-2015-9226.md): Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute arbitrary SQL commands via the download pa (no CVSS) - [CVE-2015-9227](https://cve.now/CVE-2015-9227.md): PHP remote file inclusion vulnerability in the get\_file function in upload/admin2/controller/report\_logs.php in AlegroCart 1.2.8 allows remo (no CVSS) - [CVE-2017-1000249](https://cve.now/CVE-2017-1000249.md): An issue in file() was introduced in commit 9611f31313a93aa036389c5f3b15eea53510d4d1 (Oct 2016) lets an attacker overwrite a fixed 20 bytes (no CVSS) - [CVE-2017-14270](https://cve.now/CVE-2017-14270.md): XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, rel (no CVSS) - [CVE-2017-14271](https://cve.now/CVE-2017-14271.md): XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, rel (no CVSS) - [CVE-2017-14272](https://cve.now/CVE-2017-14272.md): XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, rel (no CVSS) - [CVE-2017-14273](https://cve.now/CVE-2017-14273.md): XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, rel (no CVSS) - [CVE-2017-14274](https://cve.now/CVE-2017-14274.md): XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, rel (no CVSS) - [CVE-2017-14275](https://cve.now/CVE-2017-14275.md): XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, rel (no CVSS) - [CVE-2017-14276](https://cve.now/CVE-2017-14276.md): XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafte (no CVSS) - [CVE-2017-14277](https://cve.now/CVE-2017-14277.md): XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafte (no CVSS) - [CVE-2017-14278](https://cve.now/CVE-2017-14278.md): XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafte (no CVSS) - [CVE-2017-14279](https://cve.now/CVE-2017-14279.md): XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafte (no CVSS) - [CVE-2017-14280](https://cve.now/CVE-2017-14280.md): XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafte (no CVSS) - [CVE-2017-14281](https://cve.now/CVE-2017-14281.md): XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafte (no CVSS) - [CVE-2017-14282](https://cve.now/CVE-2017-14282.md): XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafte (no CVSS) - [CVE-2017-14283](https://cve.now/CVE-2017-14283.md): XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafte (no CVSS) - [CVE-2017-14284](https://cve.now/CVE-2017-14284.md): XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafte (no CVSS) - [CVE-2017-14285](https://cve.now/CVE-2017-14285.md): XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafte (no CVSS) - [CVE-2017-14286](https://cve.now/CVE-2017-14286.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mode (no CVSS) - [CVE-2017-14287](https://cve.now/CVE-2017-14287.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "Read Acce (no CVSS) - [CVE-2017-14288](https://cve.now/CVE-2017-14288.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mode (no CVSS) - [CVE-2017-14289](https://cve.now/CVE-2017-14289.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mode (no CVSS) - [CVE-2017-14290](https://cve.now/CVE-2017-14290.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Heap Corrup (no CVSS) - [CVE-2017-14291](https://cve.now/CVE-2017-14291.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mode (no CVSS) - [CVE-2017-14292](https://cve.now/CVE-2017-14292.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mode (no CVSS) - [CVE-2017-14293](https://cve.now/CVE-2017-14293.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Heap Corrup (no CVSS) - [CVE-2017-14294](https://cve.now/CVE-2017-14294.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mode (no CVSS) - [CVE-2017-14295](https://cve.now/CVE-2017-14295.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from F (no CVSS) - [CVE-2017-14296](https://cve.now/CVE-2017-14296.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from F (no CVSS) - [CVE-2017-14297](https://cve.now/CVE-2017-14297.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from F (no CVSS) - [CVE-2017-14298](https://cve.now/CVE-2017-14298.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from F (no CVSS) - [CVE-2017-14299](https://cve.now/CVE-2017-14299.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from F (no CVSS) - [CVE-2017-14300](https://cve.now/CVE-2017-14300.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from F (no CVSS) - [CVE-2017-14301](https://cve.now/CVE-2017-14301.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from F (no CVSS) - [CVE-2017-14302](https://cve.now/CVE-2017-14302.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related (no CVSS) - [CVE-2017-14303](https://cve.now/CVE-2017-14303.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related (no CVSS) - [CVE-2017-14304](https://cve.now/CVE-2017-14304.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related (no CVSS) - [CVE-2017-14305](https://cve.now/CVE-2017-14305.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related (no CVSS) - [CVE-2017-14306](https://cve.now/CVE-2017-14306.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related (no CVSS) - [CVE-2017-14307](https://cve.now/CVE-2017-14307.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related (no CVSS) - [CVE-2017-14308](https://cve.now/CVE-2017-14308.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related (no CVSS) - [CVE-2017-14309](https://cve.now/CVE-2017-14309.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related (no CVSS) - [CVE-2017-14310](https://cve.now/CVE-2017-14310.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related (no CVSS) - [CVE-2015-4523](https://cve.now/CVE-2015-4523.md): Blue Coat Malware Analysis Appliance (MAA) before 4.2.5 and Malware Analyzer G2 allow remote attackers to bypass a virtual machine protectio (no CVSS) - [CVE-2015-7877](https://cve.now/CVE-2015-7877.md): Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrar (no CVSS) - [CVE-2015-7879](https://cve.now/CVE-2015-7879.md): Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permi (no CVSS) - [CVE-2017-14075](https://cve.now/CVE-2017-14075.md): This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. (no CVSS) - [CVE-2017-14153](https://cve.now/CVE-2017-14153.md): This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. (no CVSS) - [CVE-2017-7649](https://cve.now/CVE-2017-7649.md): The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules (no CVSS, Eclipse Foundation Eclipse Kura Installer) - [CVE-2017-7650](https://cve.now/CVE-2017-7650.md): In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. (no CVSS, Eclipse Foundation Mosquitto) - [CVE-2017-14238](https://cve.now/CVE-2017-14238.md): SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL comma (no CVSS, dolibarr/dolibarr) - [CVE-2017-14239](https://cve.now/CVE-2017-14239.md): Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web scrip (no CVSS, dolibarr/dolibarr) - [CVE-2017-14240](https://cve.now/CVE-2017-14240.md): There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter. (no CVSS, dolibarr/dolibarr) - [CVE-2017-14241](https://cve.now/CVE-2017-14241.md): Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML (no CVSS, dolibarr/dolibarr) - [CVE-2017-14242](https://cve.now/CVE-2017-14242.md): SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the stat (no CVSS, dolibarr/dolibarr) - [CVE-2017-14247](https://cve.now/CVE-2017-14247.md): SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the user\_id cookie to header.php, a related issue to CVE-2017 (no CVSS) - [CVE-2017-14248](https://cve.now/CVE-2017-14248.md): A heap-based buffer over-read in SampleImage() in MagickCore/resize.c in ImageMagick 7.0.6-8 Q16 allows remote attackers to cause a denial o (no CVSS) - [CVE-2017-14249](https://cve.now/CVE-2017-14249.md): ImageMagick 7.0.6-8 Q16 mishandles EOF checks in ReadMPCImage in coders/mpc.c, leading to division by zero in GetPixelCacheTileSize in Magic (no CVSS) - [CVE-2017-14251](https://cve.now/CVE-2017-14251.md): Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6 (no CVSS, typo3/cms) - [CVE-2017-14252](https://cve.now/CVE-2017-14252.md): SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the group\_id cookie to side.php. (no CVSS) - [CVE-2017-14257](https://cve.now/CVE-2017-14257.md): In the SDK in Bento4 1.5.0-616, AP4\_AtomSampleTable::GetSample in Core/Ap4AtomSampleTable.cpp contains a Read Memory Access Violation vulner (no CVSS) - [CVE-2017-14258](https://cve.now/CVE-2017-14258.md): In the SDK in Bento4 1.5.0-616, SetItemCount in Core/Ap4StscAtom.h file contains a Write Memory Access Violation vulnerability. (no CVSS) - [CVE-2017-14259](https://cve.now/CVE-2017-14259.md): In the SDK in Bento4 1.5.0-616, the AP4\_StscAtom class in Ap4StscAtom.cpp contains a Write Memory Access Violation vulnerability. (no CVSS) - [CVE-2017-14260](https://cve.now/CVE-2017-14260.md): In the SDK in Bento4 1.5.0-616, the AP4\_StssAtom class in Ap4StssAtom.cpp contains a Write Memory Access Violation vulnerability. (no CVSS) - [CVE-2017-14261](https://cve.now/CVE-2017-14261.md): In the SDK in Bento4 1.5.0-616, the AP4\_StszAtom class in Ap4StszAtom.cpp file contains a Read Memory Access Violation vulnerability. (no CVSS) - [CVE-2017-14262](https://cve.now/CVE-2017-14262.md): On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/m (no CVSS) - [CVE-2017-14263](https://cve.now/CVE-2017-14263.md): Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a (no CVSS) - [CVE-2017-14265](https://cve.now/CVE-2017-14265.md): A Stack-based Buffer Overflow was discovered in xtrans\_interpolate in internal/dcraw\_common.cpp in LibRaw before 0.18.3. (no CVSS) - [CVE-2017-14267](https://cve.now/CVE-2017-14267.md): EE 4GEE WiFi MBB (before EE60\_00\_05.00\_31) devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRed (no CVSS) - [CVE-2017-14268](https://cve.now/CVE-2017-14268.md): EE 4GEE WiFi MBB (before EE60\_00\_05.00\_31) devices have XSS in the sms\_content parameter in a getSMSlist request. (no CVSS) - [CVE-2017-14269](https://cve.now/CVE-2017-14269.md): EE 4GEE WiFi MBB (before EE60\_00\_05.00\_31) devices allow remote attackers to obtain sensitive information via a JSONP endpoint, as demonstra (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-09-11 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.