CVEs published September 13, 2017
136 CVEs were published on September 13, 2017: 1 critical, 2 high. 1 is now in CISA KEV.
- Published
- 136
- Critical
- 1
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 133
- Now in CISA KEV
- 1
- Fix available
- 5
Most affected products
- Microsoft Edge
- 22
- Microsoft Office
- 9
- Microsoft Windows kernel
- 8
- Microsoft Windows Hyper-V
- 7
- Internet Explorer, Microsoft Edge
- 4
- Microsoft Internet Explorer
- 3
- Microsoft Windows GDI+
- 3
- Apache Software Foundation Apache Brooklyn · org.apache.bro…
- 2
- Microsoft Exchange Server
- 2
- Microsoft Windows graphics
- 2
Critical 1
High 2
Medium, low and unrated 133
- CVE-2017-12249A vulnerability in the Traversal Using Relay NAT (TURN) server included with Cisco Meeting Server (CMS) could allow an authenticated, remoteCisco Meeting Server
- CVE-2017-14431Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by conti
- CVE-2017-1508IBM Informix Dynamic Server 12.1 could allow a local user logged in with database administrator user to gain root privileges.IBM Informix Servers
- CVE-2017-1556IBM API Connect 5.0.7.0 through 5.0.7.2 is vulnerable to a regular expression attack that could allow an authenticated attacker to use a regIBM API Connect
- CVE-2017-14413D-Link DIR-850L REV.
- CVE-2017-14414D-Link DIR-850L REV.
- CVE-2017-14415D-Link DIR-850L REV.
- CVE-2017-14416D-Link DIR-850L REV.
- CVE-2017-14417register_send.php on D-Link DIR-850L REV.
- CVE-2017-14418The D-Link NPAPI extension, as used in conjunction with D-Link DIR-850L REV.
- CVE-2017-14419The D-Link NPAPI extension, as used on D-Link DIR-850L REV.
- CVE-2017-14420The D-Link NPAPI extension, as used on D-Link DIR-850L REV.
- CVE-2017-14421D-Link DIR-850L REV.
- CVE-2017-14422D-Link DIR-850L REV.
- CVE-2017-14423htdocs/parentalcontrols/bind.php on D-Link DIR-850L REV.
- CVE-2017-14424D-Link DIR-850L REV.
- CVE-2017-14425D-Link DIR-850L REV.
- CVE-2017-14426D-Link DIR-850L REV.
- CVE-2017-14427D-Link DIR-850L REV.
- CVE-2017-14428D-Link DIR-850L REV.
- CVE-2017-14430D-Link DIR-850L REV.
- CVE-2017-7560It was found that rhnsd PID files are created as world-writable that allows local attackers to fill the disks or to kill selected processes.Red Hat rhnsd
- CVE-2017-7561Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS comRed Hat resteasy · org.jboss.resteasy:resteasy-jaxrs
- CVE-2015-2749Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites a
- CVE-2015-2750Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect u
- CVE-2015-5168Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and attack vecto
- CVE-2015-5206Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attac
- CVE-2015-7880The Entity Registration module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to obtain sensitive event registration information
- CVE-2016-8737In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web sitApache Software Foundation Apache Brooklyn · org.apache.… +1
- CVE-2016-8744Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs.Apache Software Foundation Apache Brooklyn · org.apache.bro…
- CVE-2017-11462Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion
- CVE-2017-12612In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket.org.apache.spark:spark-core_2.11 · org.apache.spark:spar… +1
- CVE-2017-14124In eLux RP 5.x before 5.5.1000 LTSR and 5.6.x before 5.6.2 CR when classic desktop mode is used, it is possible to start applications other
- CVE-2017-3165In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to ruApache Software Foundation Apache Brooklyn · org.apache.bro…
- CVE-2017-6330Symantec Encryption Desktop before SED 10.4.1MP2 can allow remote attackers to cause a denial of service (resource consumption) via crafted Symantec Encryption Desktop
- CVE-2017-11350Cross-Site Request Forgery (CSRF) exists in cgi-bin/ConfigSet on Axesstel MU553S MU55XS-V1.14 devices.
- CVE-2017-11351Axesstel MU553S MU55XS-V1.14 devices have a default password of admin for the admin account.
- CVE-2017-13724On the Axesstel MU553S MU55XS-V1.14, there is a Stored Cross Site Scripting vulnerability in the APN parameter under the "Basic Settings" pa
- CVE-2017-14398rzpnk.sys in Razer Synapse 2.20.15.1104 allows local users to read and write to arbitrary memory locations, and consequently gain privileges
- CVE-2017-6007A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert
- CVE-2017-6008A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert
- CVE-2017-7441In Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean), a crafted IOCTL with code
- CVE-2017-14401The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in
- CVE-2017-14402The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in
- CVE-2017-14403The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the term parameter to module/admin_group/search.php.
- CVE-2017-14404The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows local file inclusion via the tool_list parameter (aka the url_tool variable) to mo
- CVE-2017-14405The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote command execution via shell metacharacters in a hosts_cacti array parameter
- CVE-2017-14406A NULL pointer dereference was discovered in sync_buffer in interface.c in mpglibDBL, as used in MP3Gain version 1.5.2.
- CVE-2017-14407A stack-based buffer over-read was discovered in filterYule in gain_analysis.c in MP3Gain version 1.5.2.
- CVE-2017-14408A stack-based buffer over-read was discovered in dct36 in layer3.c in mpglibDBL, as used in MP3Gain version 1.5.2.
- CVE-2017-14409A buffer overflow was discovered in III_dequantize_sample in layer3.c in mpglibDBL, as used in MP3Gain version 1.5.2.
- CVE-2017-14410A buffer over-read was discovered in III_i_stereo in layer3.c in mpglibDBL, as used in MP3Gain version 1.5.2.
- CVE-2017-14411A stack-based buffer overflow was discovered in copy_mp in interface.c in mpglibDBL, as used in MP3Gain version 1.5.2.
- CVE-2017-14412An invalid memory write was discovered in copy_mp in interface.c in mpglibDBL, as used in MP3Gain version 1.5.2.
- CVE-2017-0161The Windows NetBT Session Services component on Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold aMicrosoft Windows NetBT Session Services
- CVE-2017-11761Microsoft Exchange Server 2013 and Microsoft Exchange Server 2016 allow an input sanitization issue with Microsoft Exchange that could potenMicrosoft Exchange Server
- CVE-2017-11764Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of thMicrosoft Edge
- CVE-2017-11766Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the cMicrosoft Edge
- CVE-2017-8567A remote code execution vulnerability exists in Microsoft Excel for Mac 2011 when it fails to properly handle objects in memory, aka "MicrosMicrosoft Office
- CVE-2017-8597Microsoft Edge in Microsoft Windows 10 Version 1703 allows an attacker to obtain information to further compromise the user's system, due toMicrosoft Edge
- CVE-2017-8628Microsoft Bluetooth Driver in Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703 allows Microsoft Bluetooth Driver
- CVE-2017-8629Microsoft SharePoint Server 2013 Service Pack 1 allows an elevation of privilege vulnerability when it fails to properly sanitize a speciallMicrosoft SharePoint Server
- CVE-2017-8630Microsoft Office 2016 allows a remote code execution vulnerability when it fails to properly handle objects in memory, aka "Microsoft OfficeMicrosoft Office
- CVE-2017-8631A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, MiMicrosoft Office
- CVE-2017-8632A remote code execution vulnerability exists in Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 20Microsoft Office
- CVE-2017-8643Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to leave a malicious website open Microsoft Edge
- CVE-2017-8648Microsoft Edge in Microsoft Windows Version 1703 allows an attacker to obtain information to further compromise the user's system, due to thMicrosoft Edge
- CVE-2017-8649Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of thMicrosoft Edge
- CVE-2017-8660Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the contextMicrosoft Edge
- CVE-2017-8675The Windows Kernel-Mode Drivers component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 GMicrosoft Windows Kernel-Mode Drivers
- CVE-2017-8676The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012Microsoft Windows Graphics Device Interface
- CVE-2017-8677The Windows GDI+ component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, WinMicrosoft Windows GDI+ component
- CVE-2017-8678The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, WMicrosoft Windows kernel
- CVE-2017-8679The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, WMicrosoft Windows kernel
- CVE-2017-8680The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, aMicrosoft Windows kernel
- CVE-2017-8681The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, WMicrosoft Windows kernel
- CVE-2017-8682Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.Microsoft Windows graphics
- CVE-2017-8683Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.Microsoft Windows graphics
- CVE-2017-8684Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.Microsoft Windows GDI+
- CVE-2017-8685Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows information disclosure by the way it discloses kernelMicrosoft Windows GDI+
- CVE-2017-8686The Windows Server DHCP service in Windows Server 2012 Gold and R2, and Windows Server 2016 allows an attacker to either run arbitrary code
- CVE-2017-8687The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, WMicrosoft Windows kernel
- CVE-2017-8688Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, WMicrosoft Windows GDI+
- CVE-2017-8692The Windows Uniscribe component on Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Microsoft Windows Uniscribe
- CVE-2017-8695Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8Microsoft Windows Uniscribe
- CVE-2017-8696Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for
- CVE-2017-8699Windows Shell in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, WindowMicrosoft Windows Shell
- CVE-2017-8702Windows Error Reporting (WER) in Microsoft Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows an attacker to gain greater accesMicrosoft Windows Error Reporting
- CVE-2017-8704The Windows Hyper-V component on Microsoft Windows 10 1607 and Windows Server 2016 allows a denial of service vulnerability when it fails toMicrosoft Windows Hyper-V
- CVE-2017-8706The Windows Hyper-V component on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vMicrosoft Windows Hyper-V
- CVE-2017-8707The Windows Hyper-V component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 GoldMicrosoft Windows Hyper-V
- CVE-2017-8708The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, WMicrosoft Windows kernel
- CVE-2017-8709The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, WMicrosoft Windows kernel
- CVE-2017-8710The Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1 allows an attacker to read arbitMicrosoft Common Console Document
- CVE-2017-8711The Windows Hyper-V component on Microsoft Windows 10 1607 and Windows Server 2016 allows an information disclosure vulnerability when it faMicrosoft Windows Hyper-V
- CVE-2017-8712The Windows Hyper-V component on Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability wheMicrosoft Windows Hyper-V
- CVE-2017-8713The Windows Hyper-V component on Microsoft Windows Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold, 1511, 1607, and 1703, and Microsoft Windows Hyper-V
- CVE-2017-8714The Windows Hyper-V component on Microsoft Windows 8.1, Windows Server 2012 Gold and R2,, Windows 10 1607, and Windows Server 2016 allows a Microsoft Windows Hyper-V
- CVE-2017-8716Windows Control Flow Guard in Microsoft Windows 10 Version 1703 allows an attacker to run a specially crafted application to bypass Control Microsoft Windows Control Flow Guard
- CVE-2017-8719The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, WMicrosoft Windows kernel
- CVE-2017-8720The Microsoft Windows graphics component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 GoMicrosoft Windows graphics component
- CVE-2017-8723Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to trick a user into loading a pagMicrosoft Edge
- CVE-2017-8724Microsoft Edge in Microsoft Windows 10 Version 1703 allows an attacker to trick a user by redirecting the user to a specially crafted websitMicrosoft Edge
- CVE-2017-8725A remote code execution vulnerability exists in Microsoft Publisher 2007 Service Pack 3 and Microsoft Publisher 2010 Service Pack 2 when theMicrosoft Office
- CVE-2017-8728Microsoft Windows PDF Library in Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, anMicrosoft Windows PDF Library
- CVE-2017-8729Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way Microsoft Edge
- CVE-2017-8731Microsoft Edge in Microsoft Windows 10 1607 and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the curre
- CVE-2017-8733Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2Microsoft Internet Explorer
- CVE-2017-8734Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the cMicrosoft Edge
- CVE-2017-8735Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to trick a user by redirecting theMicrosoft Edge
- CVE-2017-8736Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and MicrosInternet Explorer, Microsoft Edge
- CVE-2017-8737Microsoft Windows PDF Library in Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, anMicrosoft Windows PDF Library
- CVE-2017-8738Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows an attacker to execute arbitrary code in the contextMicrosoft Edge
- CVE-2017-8739Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system, due to the wayMicrosoft Edge
- CVE-2017-8740Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way Microsoft Edge
- CVE-2017-8741Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2Internet Explorer, Microsoft Edge
- CVE-2017-8742A remote code execution vulnerability exists in Microsoft PowerPoint 2007 Service Pack 3, Microsoft PowerPoint 2010 Service Pack 2, MicrosofMicrosoft Office
- CVE-2017-8743A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016, and Office Online SeMicrosoft Office
- CVE-2017-8744A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, MiMicrosoft Office
- CVE-2017-8745An elevation of privilege vulnerability exists in Microsoft SharePoint Foundation 2013 Service Pack 1 when it does not properly sanitize a sMicrosoft Office
- CVE-2017-8746Windows Device Guard in Windows 10 1607, 1703, and Windows Server 2016 allows A security feature bypass vulnerability due to how PowerShell Microsoft Windows Device Guard
- CVE-2017-8747Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, WindowMicrosoft Internet Explorer
- CVE-2017-8748Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and MicrosInternet Explorer, Microsoft Edge
- CVE-2017-8749Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2Microsoft Internet Explorer
- CVE-2017-8750Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and MicrosInternet Explorer, Microsoft Edge
- CVE-2017-8751Microsoft Edge in Microsoft Windows 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way thaMicrosoft Edge
- CVE-2017-8752Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the contextMicrosoft Edge
- CVE-2017-8753Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the cMicrosoft Edge
- CVE-2017-8754Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to trick a user into loading a pagMicrosoft Edge
- CVE-2017-8755Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the contextMicrosoft Edge
- CVE-2017-8756Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the cMicrosoft Edge
- CVE-2017-8757Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the cMicrosoft Edge
- CVE-2017-8758Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access (OWA) fails to propMicrosoft Exchange Server