# CVEs published 2017-09-12

50 CVEs were published on September 12, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2015-9229](https://cve.now/CVE-2015-9229.md): In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated (no CVSS)
- [CVE-2015-9230](https://cve.now/CVE-2015-9230.md): In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible f (no CVSS)
- [CVE-2017-1162](https://cve.now/CVE-2017-1162.md): IBM QRadar 7.2 and 7.3 discloses sensitive information to unauthorized users. (no CVSS, IBM Security QRadar SIEM)
- [CVE-2017-1352](https://cve.now/CVE-2017-1352.md): IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could be executed by anot (no CVSS, IBM Maximo Asset Management)
- [CVE-2017-1434](https://cve.now/CVE-2017-1434.md): IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) under unusual circumstances, could expose highly sensitive informatio (no CVSS, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2017-1438](https://cve.now/CVE-2017-1438.md): IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user with DB2 instance owner (no CVSS, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2017-1439](https://cve.now/CVE-2017-1439.md): IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user with DB2 instance owner (no CVSS, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2017-14396](https://cve.now/CVE-2017-14396.md): In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as (no CVSS)
- [CVE-2017-14397](https://cve.now/CVE-2017-14397.md): AnyDesk before 3.6.1 on Windows has a DLL injection vulnerability. (no CVSS)
- [CVE-2017-14399](https://cve.now/CVE-2017-14399.md): In BlackCat CMS 1.2.2, unrestricted file upload is possible in backend\\media\\ajax\_rename.php via the extension parameter, as demonstrated by (no CVSS)
- [CVE-2017-14400](https://cve.now/CVE-2017-14400.md): In ImageMagick 7.0.7-1 Q16, the PersistPixelCache function in magick/cache.c mishandles the pixel cache nexus, which allows remote attackers (no CVSS)
- [CVE-2017-1451](https://cve.now/CVE-2017-1451.md): IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user with DB2 instance owner (no CVSS, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2017-1452](https://cve.now/CVE-2017-1452.md): IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user to obtain elevated priv (no CVSS, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2017-1519](https://cve.now/CVE-2017-1519.md): IBM DB2 10.5 and 11.1 contains a denial of service vulnerability. (no CVSS, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2017-1520](https://cve.now/CVE-2017-1520.md): IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorized command that allows the database to be activated when authentication type (no CVSS, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2017-8015](https://cve.now/CVE-2017-8015.md): EMC AppSync (all versions prior to 3.5) contains a SQL injection vulnerability that could potentially be exploited by malicious users to com (no CVSS, EMC AppSync all versions prior to)
- [CVE-2017-14347](https://cve.now/CVE-2017-14347.md): NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action. (no CVSS)
- [CVE-2017-14348](https://cve.now/CVE-2017-14348.md): LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted file. (no CVSS)
- [CVE-2017-14344](https://cve.now/CVE-2017-14344.md): This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. (no CVSS)
- [CVE-2017-14345](https://cve.now/CVE-2017-14345.md): SQL Injection exists in tianchoy/blog through 2017-09-12 via the id parameter to view.php. (no CVSS)
- [CVE-2017-14346](https://cve.now/CVE-2017-14346.md): upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, (no CVSS)
- [CVE-2017-8918](https://cve.now/CVE-2017-8918.md): XXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows attackers to remotely view local files via (no CVSS)
- [CVE-2017-1000250](https://cve.now/CVE-2017-1000250.md): All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attac (no CVSS)
- [CVE-2017-1000251](https://cve.now/CVE-2017-1000251.md): The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vuln (no CVSS)
- [CVE-2017-14341](https://cve.now/CVE-2017-14341.md): ImageMagick 7.0.6-6 has a large loop vulnerability in ReadWPGImage in coders/wpg.c, causing CPU exhaustion via a crafted wpg image file. (no CVSS)
- [CVE-2017-14342](https://cve.now/CVE-2017-14342.md): ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c via a crafted wpg image file. (no CVSS)
- [CVE-2017-14343](https://cve.now/CVE-2017-14343.md): ImageMagick 7.0.6-6 has a memory leak vulnerability in ReadXCFImage in coders/xcf.c via a crafted xcf image file. (no CVSS)
- [CVE-2017-14337](https://cve.now/CVE-2017-14337.md): When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user manageme (no CVSS)
- [CVE-2017-14315](https://cve.now/CVE-2017-14315.md): In Apple iOS 7 through 9, due to a BlueBorne flaw in the implementation of LEAP (Low Energy Audio Protocol), a large audio command can be se (no CVSS)
- [CVE-2017-14316](https://cve.now/CVE-2017-14316.md): A parameter verification issue was discovered in Xen through 4.9.x. (no CVSS)
- [CVE-2017-14317](https://cve.now/CVE-2017-14317.md): A domain cleanup issue was discovered in the C xenstore daemon (aka cxenstored) in Xen through 4.9.x. (no CVSS)
- [CVE-2017-14318](https://cve.now/CVE-2017-14318.md): An issue was discovered in Xen 4.5.x through 4.9.x. (no CVSS)
- [CVE-2017-14319](https://cve.now/CVE-2017-14319.md): A grant unmapping issue was discovered in Xen through 4.9.x. (no CVSS)
- [CVE-2014-9624](https://cve.now/CVE-2014-9624.md): CAPTCHA bypass vulnerability in MantisBT before 1.2.19. (no CVSS)
- [CVE-2014-9634](https://cve.now/CVE-2014-9634.md): Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote at (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2014-9635](https://cve.now/CVE-2014-9635.md): Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which mak (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2015-9228](https://cve.now/CVE-2015-9228.md): In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, (no CVSS)
- [CVE-2017-14266](https://cve.now/CVE-2017-14266.md): tcprewrite in Tcpreplay 3.4.4 has a Heap-Based Buffer Overflow vulnerability triggered by a crafted PCAP file, a related issue to CVE-2016-6 (no CVSS)
- [CVE-2017-14324](https://cve.now/CVE-2017-14324.md): In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to ca (no CVSS)
- [CVE-2017-14325](https://cve.now/CVE-2017-14325.md): In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function PersistPixelCache in magick/cache.c, which allows attacker (no CVSS)
- [CVE-2017-14326](https://cve.now/CVE-2017-14326.md): In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to ca (no CVSS)
- [CVE-2017-14333](https://cve.now/CVE-2017-14333.md): The process\_version\_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and (no CVSS)
- [CVE-2017-14335](https://cve.now/CVE-2017-14335.md): On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Securi (no CVSS)
- [CVE-2017-3131](https://cve.now/CVE-2017-3131.md): A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized cod (no CVSS, Fortinet FortiOS)
- [CVE-2017-3132](https://cve.now/CVE-2017-3132.md): A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or command (no CVSS, Fortinet FortiOS)
- [CVE-2017-3133](https://cve.now/CVE-2017-3133.md): A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or command (no CVSS, Fortinet FortiOS)
- [CVE-2017-7734](https://cve.now/CVE-2017-7734.md): A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or comma (no CVSS, Fortinet FortiOS)
- [CVE-2017-7735](https://cve.now/CVE-2017-7735.md): A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.2.0 through 5.2.11 and 5.4.0 through 5.4.4 allows attackers to execute u (no CVSS, Fortinet FortiOS)
- [CVE-2017-14313](https://cve.now/CVE-2017-14313.md): The shibboleth\_login\_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due (no CVSS)
- [CVE-2017-14314](https://cve.now/CVE-2017-14314.md): Off-by-one error in the DrawImage function in magick/render.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-09-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.