CVEs published September 20, 2017
51 CVEs were published on September 20, 2017: 0 critical, 0 high.
- Published
- 51
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 50
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Apache Software Foundation Apache Struts · org.apache.strut…
- 5
- ipython
- 2
- Mirion Technologies Telemetry Enabled Devices
- 2
- ember-source
- 1
- github.com/go-ldap/ldap
- 1
- Linux kernel before
- 1
- Rockwell Automation MicroLogix 1100 Controllers
- 1
Medium, low and unrated 51
- CVE-2017-14621Portus 2.2.0 has XSS via the Team field, related to typeahead.
- CVE-2017-14623In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password.github.com/go-ldap/ldap
- CVE-2015-9232The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent.
- CVE-2017-14617In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handli
- CVE-2017-14618Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script
- CVE-2017-14619Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "T
- CVE-2015-9231iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries.
- CVE-2017-14615An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0.
- CVE-2017-14616An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0.
- CVE-2014-9758Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1.
- CVE-2015-0162IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges.
- CVE-2015-1865fts.c in coreutils 8.4 allows local users to delete arbitrary files.
- CVE-2015-1866Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.ember-source
- CVE-2015-2826WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.
- CVE-2015-2927node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service (bandwidth consumption).
- CVE-2015-3890Use-after-free vulnerability in Open Litespeed before 1.3.10.
- CVE-2015-4707Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors inipython
- CVE-2015-5395Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.
- CVE-2015-5608Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1.
- CVE-2015-6673Use-after-free vulnerability in Decoder.cpp in libpgf before 6.15.32.
- CVE-2015-7347Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1.
- CVE-2017-14595In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archi
- CVE-2017-14596In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.
- CVE-2017-14609The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a non-root account, which might allow local us
- CVE-2017-14610bareos-dir, bareos-fd, and bareos-sd in bareos-core in Bareos 16.2.6 and earlier create a PID file after dropping privileges to a non-root a
- CVE-2016-6795In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will beApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2016-8738In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is posApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2017-12611In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string liteApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2017-14607In ImageMagick 7.0.7-4 Q16, an out of bounds read flaw related to ReadTIFFImage has been reported in coders/tiff.c.
- CVE-2017-14608In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_c
- CVE-2017-9793The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerableApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2017-9804In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidaApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2015-1329Use-after-free vulnerability in oxide::qt::URLRequestDelegatedJob in oxide-qt in Ubuntu 15.04 and 14.04 LTS might allow remote attackers to
- CVE-2015-4072Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arb
- CVE-2015-4073Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL c
- CVE-2015-4074Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a
- CVE-2015-4075The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task.
- CVE-2015-5179FreeIPA might display user data improperly via vectors involving non-printable characters.
- CVE-2015-5248Reflected file download vulnerability in Red Hat Feedhenry Enterprise Mobile Application Platform.
- CVE-2015-5607Cross-site request forgery in the REST API in IPython 2 and 3.ipython
- CVE-2015-8224Huawei P8 before GRA-CL00C92B210, before GRA-L09C432B200, before GRA-TL00C01B210, and before GRA-UL00C00B210 allows remote attackers to obta
- CVE-2017-14339The DNS packet parser in YADIFA before 2.2.6 does not check for the presence of infinite pointer loops, and thus it is possible to force it
- CVE-2017-7924An Improper Input Validation issue was discovered in Rockwell Automation MicroLogix 1100 controllers 1763-L16BWA, 1763-L16AWA, 1763-L16BBB, Rockwell Automation MicroLogix 1100 Controllers
- CVE-2017-9607The BL1 FWU SMC handling code in ARM Trusted Firmware before 1.4 might allow attackers to write arbitrary data to secure memory, bypass the
- CVE-2017-9645An Inadequate Encryption Strength issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-Mirion Technologies Telemetry Enabled Devices
- CVE-2017-9649A Use of Hard-Coded Cryptographic Key issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, Mirion Technologies Telemetry Enabled Devices
- CVE-2017-8770There is LFD (local file disclosure) on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device vi
- CVE-2017-8771On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username:"r
- CVE-2017-8772On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username:"r
- CVE-2017-12168The access_pmu_evcntr function in arch/arm64/kvm/sys_regs.c in the Linux kernel before 4.8.11 allows privileged KVM guest OS users to cause Linux kernel before
- CVE-2017-14604GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in wh