# CVEs published 2017-09-18 59 CVEs were published on September 18, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2016-10511](https://cve.now/CVE-2016-10511.md): The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitter's server certificates for the /1.1/help/settings.json configuration (no CVSS) - [CVE-2017-9803](https://cve.now/CVE-2017-9803.md): Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end- (no CVSS, Apache Software Foundation Apache Solr · org.apache.solr:so…) - [CVE-2017-14538](https://cve.now/CVE-2017-14538.md): XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, rel (no CVSS) - [CVE-2017-14539](https://cve.now/CVE-2017-14539.md): IrfanView 4.44 - 32bit allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .svg file, rela (no CVSS) - [CVE-2017-14540](https://cve.now/CVE-2017-14540.md): IrfanView 4.44 - 32bit allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .svg file, rela (no CVSS) - [CVE-2017-14541](https://cve.now/CVE-2017-14541.md): XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafte (no CVSS) - [CVE-2017-14542](https://cve.now/CVE-2017-14542.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .epub file, related to a "Read Acc (no CVSS) - [CVE-2017-14543](https://cve.now/CVE-2017-14543.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .epub file, relate (no CVSS) - [CVE-2017-14544](https://cve.now/CVE-2017-14544.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .epub file, relate (no CVSS) - [CVE-2017-14545](https://cve.now/CVE-2017-14545.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .epub file, relate (no CVSS) - [CVE-2017-14546](https://cve.now/CVE-2017-14546.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .epub file, relate (no CVSS) - [CVE-2017-14547](https://cve.now/CVE-2017-14547.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .mobi file, relate (no CVSS) - [CVE-2017-14548](https://cve.now/CVE-2017-14548.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .djvu file, related to a "User Mod (no CVSS) - [CVE-2017-14549](https://cve.now/CVE-2017-14549.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .djvu file, related to a "Heap Cor (no CVSS) - [CVE-2017-14550](https://cve.now/CVE-2017-14550.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file, relate (no CVSS) - [CVE-2017-14551](https://cve.now/CVE-2017-14551.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file, relate (no CVSS) - [CVE-2017-14552](https://cve.now/CVE-2017-14552.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .djvu file, related to a "User Mod (no CVSS) - [CVE-2017-14553](https://cve.now/CVE-2017-14553.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .djvu file, related to a "User Mod (no CVSS) - [CVE-2017-14554](https://cve.now/CVE-2017-14554.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file, relate (no CVSS) - [CVE-2017-14555](https://cve.now/CVE-2017-14555.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file, relate (no CVSS) - [CVE-2017-14556](https://cve.now/CVE-2017-14556.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .djvu file, related to a "User Mod (no CVSS) - [CVE-2017-14557](https://cve.now/CVE-2017-14557.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .djvu file, related to a "User Mod (no CVSS) - [CVE-2017-14558](https://cve.now/CVE-2017-14558.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .djvu file, related to a "User Mod (no CVSS) - [CVE-2017-14559](https://cve.now/CVE-2017-14559.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "Read Acce (no CVSS) - [CVE-2017-14560](https://cve.now/CVE-2017-14560.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related (no CVSS) - [CVE-2017-14561](https://cve.now/CVE-2017-14561.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to an "Illegal (no CVSS) - [CVE-2017-14562](https://cve.now/CVE-2017-14562.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related (no CVSS) - [CVE-2017-14563](https://cve.now/CVE-2017-14563.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "Read Acce (no CVSS) - [CVE-2017-14564](https://cve.now/CVE-2017-14564.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related (no CVSS) - [CVE-2017-14565](https://cve.now/CVE-2017-14565.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related (no CVSS) - [CVE-2017-14566](https://cve.now/CVE-2017-14566.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "User Mode (no CVSS) - [CVE-2017-14567](https://cve.now/CVE-2017-14567.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to an "Illegal (no CVSS) - [CVE-2017-14568](https://cve.now/CVE-2017-14568.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to an "Illegal (no CVSS) - [CVE-2017-14569](https://cve.now/CVE-2017-14569.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related (no CVSS) - [CVE-2017-14570](https://cve.now/CVE-2017-14570.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "User Mode (no CVSS) - [CVE-2017-14571](https://cve.now/CVE-2017-14571.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to an "Illegal (no CVSS) - [CVE-2017-14572](https://cve.now/CVE-2017-14572.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "User Mode (no CVSS) - [CVE-2017-14573](https://cve.now/CVE-2017-14573.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to an "Illegal (no CVSS) - [CVE-2017-14574](https://cve.now/CVE-2017-14574.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "User Mode (no CVSS) - [CVE-2017-14575](https://cve.now/CVE-2017-14575.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to an "Illegal (no CVSS) - [CVE-2017-14576](https://cve.now/CVE-2017-14576.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related (no CVSS) - [CVE-2017-14577](https://cve.now/CVE-2017-14577.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "Read Acce (no CVSS) - [CVE-2017-14578](https://cve.now/CVE-2017-14578.md): IrfanView 4.44 - 32bit allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .ani file, rela (no CVSS) - [CVE-2017-14579](https://cve.now/CVE-2017-14579.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "Read Acce (no CVSS) - [CVE-2017-14580](https://cve.now/CVE-2017-14580.md): XnView Classic for Windows Version 2.41 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, rel (no CVSS) - [CVE-2017-6147](https://cve.now/CVE-2017-6147.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of respon (no CVSS, F5 Networks F5 BIG-IP) - [CVE-2017-0380](https://cve.now/CVE-2017-0380.md): The rend\_service\_intro\_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0. (no CVSS, Tor before) - [CVE-2014-6106](https://cve.now/CVE-2014-6106.md): Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attackers to hijack the aut (no CVSS) - [CVE-2017-9798](https://cve.now/CVE-2017-9798.md): Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, o (no CVSS, Apache Software Foundation Apache HTTP Server) - [CVE-2017-12156](https://cve.now/CVE-2017-12156.md): Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback. (no CVSS, Moodle 3.x · moodle/moodle) - [CVE-2017-12157](https://cve.now/CVE-2017-12157.md): In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access. (no CVSS, Moodle 3.x · moodle/moodle) - [CVE-2017-14534](https://cve.now/CVE-2017-14534.md): Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH\_INFO to location.php, related to PHP\_SELF. (no CVSS) - [CVE-2017-14530](https://cve.now/CVE-2017-14530.md): WP\_Admin\_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create ope (no CVSS) - [CVE-2017-14531](https://cve.now/CVE-2017-14531.md): ImageMagick 7.0.7-0 has a memory exhaustion issue in ReadSUNImage in coders/sun.c. (no CVSS) - [CVE-2017-14532](https://cve.now/CVE-2017-14532.md): ImageMagick 7.0.7-0 has a NULL Pointer Dereference in TIFFIgnoreTags in coders/tiff.c. (no CVSS) - [CVE-2017-14533](https://cve.now/CVE-2017-14533.md): ImageMagick 7.0.6-6 has a memory leak in ReadMATImage in coders/mat.c. (no CVSS) - [CVE-2017-9333](https://cve.now/CVE-2017-9333.md): OpenWebif 1.2.5 allows remote code execution via a URL to the CallOPKG function in the IpkgController class in plugin/controllers/ipkg.py, w (no CVSS) - [CVE-2017-14528](https://cve.now/CVE-2017-14528.md): The TIFFSetProfiles function in coders/tiff.c in ImageMagick 7.0.6 has incorrect expectations about whether LibTIFF TIFFGetField return valu (no CVSS) - [CVE-2017-14529](https://cve.now/CVE-2017-14529.md): The pe\_print\_idata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mis (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-09-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.