CVEs published September 12, 2017
50 CVEs were published on September 12, 2017: 0 critical, 0 high.
- Published
- 50
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 50
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- IBM DB2 for Linux, UNIX and Windows
- 7
- Fortinet FortiOS
- 5
- org.jenkins-ci.main:jenkins-core
- 2
- EMC AppSync all versions prior to
- 1
- IBM Maximo Asset Management
- 1
- IBM Security QRadar SIEM
- 1
Medium, low and unrated 50
- CVE-2015-9229In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated
- CVE-2015-9230In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible f
- CVE-2017-1162IBM QRadar 7.2 and 7.3 discloses sensitive information to unauthorized users.IBM Security QRadar SIEM
- CVE-2017-1352IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could be executed by anotIBM Maximo Asset Management
- CVE-2017-1434IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) under unusual circumstances, could expose highly sensitive informatioIBM DB2 for Linux, UNIX and Windows
- CVE-2017-1438IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user with DB2 instance ownerIBM DB2 for Linux, UNIX and Windows
- CVE-2017-1439IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user with DB2 instance ownerIBM DB2 for Linux, UNIX and Windows
- CVE-2017-14396In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as
- CVE-2017-14397AnyDesk before 3.6.1 on Windows has a DLL injection vulnerability.
- CVE-2017-14399In BlackCat CMS 1.2.2, unrestricted file upload is possible in backend\media\ajax_rename.php via the extension parameter, as demonstrated by
- CVE-2017-14400In ImageMagick 7.0.7-1 Q16, the PersistPixelCache function in magick/cache.c mishandles the pixel cache nexus, which allows remote attackers
- CVE-2017-1451IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user with DB2 instance ownerIBM DB2 for Linux, UNIX and Windows
- CVE-2017-1452IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user to obtain elevated privIBM DB2 for Linux, UNIX and Windows
- CVE-2017-1519IBM DB2 10.5 and 11.1 contains a denial of service vulnerability.IBM DB2 for Linux, UNIX and Windows
- CVE-2017-1520IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorized command that allows the database to be activated when authentication typeIBM DB2 for Linux, UNIX and Windows
- CVE-2017-8015EMC AppSync (all versions prior to 3.5) contains a SQL injection vulnerability that could potentially be exploited by malicious users to comEMC AppSync all versions prior to
- CVE-2017-14347NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action.
- CVE-2017-14348LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted file.
- CVE-2017-14344This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier.
- CVE-2017-14345SQL Injection exists in tianchoy/blog through 2017-09-12 via the id parameter to view.php.
- CVE-2017-14346upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg,
- CVE-2017-8918XXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows attackers to remotely view local files via
- CVE-2017-1000250All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attac
- CVE-2017-1000251The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vuln
- CVE-2017-14341ImageMagick 7.0.6-6 has a large loop vulnerability in ReadWPGImage in coders/wpg.c, causing CPU exhaustion via a crafted wpg image file.
- CVE-2017-14342ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c via a crafted wpg image file.
- CVE-2017-14343ImageMagick 7.0.6-6 has a memory leak vulnerability in ReadXCFImage in coders/xcf.c via a crafted xcf image file.
- CVE-2017-14337When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user manageme
- CVE-2017-14315In Apple iOS 7 through 9, due to a BlueBorne flaw in the implementation of LEAP (Low Energy Audio Protocol), a large audio command can be se
- CVE-2017-14316A parameter verification issue was discovered in Xen through 4.9.x.
- CVE-2017-14317A domain cleanup issue was discovered in the C xenstore daemon (aka cxenstored) in Xen through 4.9.x.
- CVE-2017-14318An issue was discovered in Xen 4.5.x through 4.9.x.
- CVE-2017-14319A grant unmapping issue was discovered in Xen through 4.9.x.
- CVE-2014-9624CAPTCHA bypass vulnerability in MantisBT before 1.2.19.
- CVE-2014-9634Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote atorg.jenkins-ci.main:jenkins-core
- CVE-2014-9635Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makorg.jenkins-ci.main:jenkins-core
- CVE-2015-9228In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter,
- CVE-2017-14266tcprewrite in Tcpreplay 3.4.4 has a Heap-Based Buffer Overflow vulnerability triggered by a crafted PCAP file, a related issue to CVE-2016-6
- CVE-2017-14324In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to ca
- CVE-2017-14325In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function PersistPixelCache in magick/cache.c, which allows attacker
- CVE-2017-14326In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to ca
- CVE-2017-14333The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and
- CVE-2017-14335On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Securi
- CVE-2017-3131A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized codFortinet FortiOS
- CVE-2017-3132A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commandFortinet FortiOS
- CVE-2017-3133A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commandFortinet FortiOS
- CVE-2017-7734A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commaFortinet FortiOS
- CVE-2017-7735A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.2.0 through 5.2.11 and 5.4.0 through 5.4.4 allows attackers to execute uFortinet FortiOS
- CVE-2017-14313The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due
- CVE-2017-14314Off-by-one error in the DrawImage function in magick/render.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service