# CVEs published 2017-09-15 26 CVEs were published on September 15, 2017: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2014-7808](https://cve.now/CVE-2014-7808.md): Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection me (no CVSS, org.apache.wicket:wicket-core) - [CVE-2014-9463](https://cve.now/CVE-2014-9463.md): functions\_vbseo\_hook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer (no CVSS) - [CVE-2015-0110](https://cve.now/CVE-2015-0110.md): IBM Business Process Manager (aka BPM) 7.5.x, 8.0.x, and 8.5.x and WebSphere Lombardi Edition (aka WLE) 7.2.x allow remote authenticated use (no CVSS) - [CVE-2015-1527](https://cve.now/CVE-2015-1527.md): Integer overflow in IAudioPolicyService.cpp in Android allows local users to gain privileges via a crafted application, aka Android Bug ID 1 (no CVSS) - [CVE-2017-9328](https://cve.now/CVE-2017-9328.md): Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execu (no CVSS) - [CVE-2017-0898](https://cve.now/CVE-2017-0898.md): Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (\*) with a huge minus val (no CVSS, HackerOne Ruby) - [CVE-2017-9805](https://cve.now/CVE-2017-9805.md): The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStrea (CVSS 8.1, KEV, Apache Software Foundation Apache Struts · org.apache.strut…) - [CVE-2017-14497](https://cve.now/CVE-2017-14497.md): The tpacket\_rcv function in net/packet/af\_packet.c in the Linux kernel before 4.13 mishandles vnet headers, which might allow local users to (no CVSS) - [CVE-2017-14498](https://cve.now/CVE-2017-14498.md): SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an (no CVSS, silverstripe/cms) - [CVE-2017-2299](https://cve.now/CVE-2017-2299.md): Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. (no CVSS, puppetlabs-apache) - [CVE-2017-10813](https://cve.now/CVE-2017-10813.md): CG-WLR300NM Firmware version 1.90 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors. (no CVSS) - [CVE-2017-10814](https://cve.now/CVE-2017-10814.md): Buffer overflow in CG-WLR300NM Firmware version 1.90 and earlier allows an attacker to execute arbitrary code via unspecified vectors. (no CVSS, Corega CG-WLR300NM) - [CVE-2017-10845](https://cve.now/CVE-2017-10845.md): Wi-Fi STATION L-02F Software version V10g and earlier allows remote attackers to access the device with administrative privileges and perfor (no CVSS, NTT DOCOMO Wi-Fi STATION L-02F) - [CVE-2017-10846](https://cve.now/CVE-2017-10846.md): Wi-Fi STATION L-02F Software version V10b and earlier allows remote attackers to bypass access restrictions to obtain information on device (no CVSS, NTT DOCOMO Wi-Fi STATION L-02F) - [CVE-2017-10855](https://cve.now/CVE-2017-10855.md): Untrusted search path vulnerability in FENCE-Explorer for Windows V8.4.1 and earlier allows an attacker to gain privileges via a Trojan hors (no CVSS, FUJITSU LIMITED FENCE-Explorer for Windows) - [CVE-2017-10856](https://cve.now/CVE-2017-10856.md): SEIL/X 4.60 to 5.72, SEIL/B1 4.60 to 5.72, SEIL/x86 3.20 to 5.72, SEIL/BPV4 5.00 to 5.72 allows remote attackers to cause a temporary failur (no CVSS, Internet Initiative Japan SEIL/X · Internet Initiative J… +2) - [CVE-2017-10858](https://cve.now/CVE-2017-10858.md): Untrusted search path vulnerability in "i-filter 6.0 install program" file version 1.0.8.1 and earlier allows an attacker to gain privileges (no CVSS, Digital Arts "i-filter 6.0 install program") - [CVE-2017-10859](https://cve.now/CVE-2017-10859.md): Untrusted search path vulnerability in "i-filter 6.0 installer" timestamp of code signing is before 23 Aug 2017 (JST) allows an attacker to (no CVSS, Digital Arts "i-filter 6.0 installer") - [CVE-2017-10860](https://cve.now/CVE-2017-10860.md): Untrusted search path vulnerability in "i-filter 6.0 installer" timestamp of code signing is before 23 Aug 2017 (JST) allows an attacker to (no CVSS, Digital Arts "i-filter 6.0 installer") - [CVE-2017-4924](https://cve.now/CVE-2017-4924.md): VMware ESXi (ESXi 6.5 without patch ESXi650-201707101-SG), Workstation (12.x before 12.5.7) and Fusion (8.x before 8.5.8) contain an out-of- (no CVSS, VMware ESXi · VMware Workstation +1) - [CVE-2017-4925](https://cve.now/CVE-2017-4925.md): VMware ESXi 6.5 without patch ESXi650-201707101-SG, ESXi 6.0 without patch ESXi600-201706101-SG, ESXi 5.5 without patch ESXi550-201709101-SG (no CVSS, VMware ESXi · VMware Workstation +1) - [CVE-2017-4926](https://cve.now/CVE-2017-4926.md): VMware vCenter Server (6.5 prior to 6.5 U1) contains a vulnerability that may allow for stored cross-site scripting (XSS). (no CVSS, VMware vCenter Server) - [CVE-2017-14340](https://cve.now/CVE-2017-14340.md): The XFS\_IS\_REALTIME\_INODE macro in fs/xfs/xfs\_linux.h in the Linux kernel before 4.13.2 does not verify that a filesystem has a realtime dev (no CVSS) - [CVE-2017-14483](https://cve.now/CVE-2017-14483.md): flower.initd in the Gentoo dev-python/flower package before 0.9.1-r1 for Celery Flower sets PID file ownership to a non-root account, which (no CVSS) - [CVE-2017-14484](https://cve.now/CVE-2017-14484.md): The Gentoo sci-mathematics/gimps package before 28.10-r1 for Great Internet Mersenne Prime Search (GIMPS) allows local users to gain privile (no CVSS) - [CVE-2017-14489](https://cve.now/CVE-2017-14489.md): The iscsi\_if\_rx function in drivers/scsi/scsi\_transport\_iscsi.c in the Linux kernel through 4.13.2 allows local users to cause a denial of s (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-09-15 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.