# CVEs published 2017-09-19

45 CVEs were published on September 19, 2017: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2014-8684](https://cve.now/CVE-2014-8684.md): CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and (no CVSS, codeigniter/framework · kohana/core)
- [CVE-2014-8686](https://cve.now/CVE-2014-8686.md): CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption sch (no CVSS)
- [CVE-2015-4681](https://cve.now/CVE-2015-4681.md): Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users to have unspecified impact via vectors related to weak passwo (no CVSS)
- [CVE-2015-4682](https://cve.now/CVE-2015-4682.md): Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation path via an HTTP PO (no CVSS)
- [CVE-2015-4683](https://cve.now/CVE-2015-4683.md): Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows attackers to obtain sensitive information and potentially gain privileges (no CVSS)
- [CVE-2015-4684](https://cve.now/CVE-2015-4684.md): Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allow (1) remote authenticated u (no CVSS)
- [CVE-2015-4685](https://cve.now/CVE-2015-4685.md): Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain privileges via a scri (no CVSS)
- [CVE-2017-12837](https://cve.now/CVE-2017-12837.md): Heap-based buffer overflow in the S\_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote att (no CVSS)
- [CVE-2017-12883](https://cve.now/CVE-2017-12883.md): Buffer overflow in the S\_grok\_bslash\_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attacker (no CVSS)
- [CVE-2015-1849](https://cve.now/CVE-2015-1849.md): AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information (no CVSS)
- [CVE-2017-10784](https://cve.now/CVE-2017-10784.md): The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers t (no CVSS, webrick)
- [CVE-2017-14033](https://cve.now/CVE-2017-14033.md): The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a (no CVSS, openssl)
- [CVE-2017-6315](https://cve.now/CVE-2017-6315.md): Astaro Security Gateway (aka ASG) 7 allows remote attackers to execute arbitrary code via a crafted request to index.plx. (no CVSS)
- [CVE-2015-7837](https://cve.now/CVE-2015-7837.md): The Linux kernel, as used in Red Hat Enterprise Linux 7, kernel-rt, and Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allo (no CVSS)
- [CVE-2017-14311](https://cve.now/CVE-2017-14311.md): The Winring0x32.sys driver in NetMechanica NetDecision 5.8.2 allows local users to gain privileges via a crafted 0x9C402088 IOCTL call. (no CVSS)
- [CVE-2017-14581](https://cve.now/CVE-2017-14581.md): The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service (service crash) v (no CVSS)
- [CVE-2014-5362](https://cve.now/CVE-2014-5362.md): The admin interface in Landesk Management Suite 9.6 and earlier allows remote attackers to conduct remote file inclusion attacks involving A (no CVSS)
- [CVE-2014-6191](https://cve.now/CVE-2014-6191.md): Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0 SP2, 6.0.4, and 6.0.5 allows remote attackers to inject (no CVSS)
- [CVE-2014-8174](https://cve.now/CVE-2014-8174.md): eDeploy makes it easier for remote attackers to execute arbitrary code by leveraging use of HTTP to download files. (no CVSS)
- [CVE-2014-9610](https://cve.now/CVE-2014-9610.md): Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and remove IP addresse (no CVSS)
- [CVE-2014-9611](https://cve.now/CVE-2014-9611.md): Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmi (no CVSS)
- [CVE-2014-9616](https://cve.now/CVE-2014-9616.md): Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive information by making a req (no CVSS)
- [CVE-2014-9618](https://cve.now/CVE-2014-9618.md): The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass aut (no CVSS)
- [CVE-2014-9619](https://cve.now/CVE-2014-9619.md): Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and (no CVSS)
- [CVE-2015-0689](https://cve.now/CVE-2015-0689.md): Cisco Cloud Web Security before 3.0.1.7 allows remote attackers to bypass intended filtering protection mechanisms by leveraging improper ha (no CVSS)
- [CVE-2015-1854](https://cve.now/CVE-2015-1854.md): 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldap (no CVSS)
- [CVE-2015-1864](https://cve.now/CVE-2015-1864.md): Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject a (no CVSS, kallithea)
- [CVE-2015-3299](https://cve.now/CVE-2015-3299.md): Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbi (no CVSS)
- [CVE-2015-3419](https://cve.now/CVE-2015-3419.md): vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations (no CVSS)
- [CVE-2015-3420](https://cve.now/CVE-2015-3420.md): The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (logi (no CVSS)
- [CVE-2015-3431](https://cve.now/CVE-2015-3431.md): Pydio (formerly AjaXplorer) before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Comman (no CVSS)
- [CVE-2015-3432](https://cve.now/CVE-2015-3432.md): Multiple cross-site scripting (XSS) vulnerabilities in Pydio (formerly AjaXplorer) before 6.0.7 allow remote attackers to inject arbitrary w (no CVSS)
- [CVE-2015-3880](https://cve.now/CVE-2015-3880.md): Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbi (no CVSS, phpbb/phpbb)
- [CVE-2015-4089](https://cve.now/CVE-2015-4089.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before (no CVSS)
- [CVE-2017-10700](https://cve.now/CVE-2017-10700.md): In the medialibrary component in QNAP NAS 4.3.3.0229, an un-authenticated, remote attacker can execute arbitrary system commands as the root (no CVSS)
- [CVE-2017-14141](https://cve.now/CVE-2017-14141.md): The wiki\_decode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object i (no CVSS)
- [CVE-2017-14142](https://cve.now/CVE-2017-14142.md): Multiple cross-site scripting (XSS) vulnerabilities in Kaltura before 13.2.0 allow remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2017-14143](https://cve.now/CVE-2017-14143.md): The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote at (no CVSS)
- [CVE-2017-10930](https://cve.now/CVE-2017-10930.md): The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in ordinary users being a (no CVSS, ZTE ZX10 1800-2S)
- [CVE-2017-10931](https://cve.now/CVE-2017-10931.md): The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to (no CVSS, ZTE ZX10 1800-2S)
- [CVE-2017-12615](https://cve.now/CVE-2017-12615.md): When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. (CVSS 8.1, KEV, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2017-12616](https://cve.now/CVE-2017-12616.md): When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2017-14597](https://cve.now/CVE-2017-14597.md): AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addi (no CVSS)
- [CVE-2017-14600](https://cve.now/CVE-2017-14600.md): Pragyan CMS v3.0 is vulnerable to an Error-Based SQL injection in cms/admin.lib.php via $\_GET\['del\_black'\], resulting in Information Disclos (no CVSS)
- [CVE-2017-14601](https://cve.now/CVE-2017-14601.md): Pragyan CMS v3.0 is vulnerable to a Boolean-based SQL injection in cms/admin.lib.php via $\_GET\['forwhat'\], resulting in Information Disclosu (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-09-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.