# CVEs published 2017-09-20

51 CVEs were published on September 20, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-14621](https://cve.now/CVE-2017-14621.md): Portus 2.2.0 has XSS via the Team field, related to typeahead. (no CVSS)
- [CVE-2017-14623](https://cve.now/CVE-2017-14623.md): In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. (no CVSS, github.com/go-ldap/ldap)
- [CVE-2015-9232](https://cve.now/CVE-2015-9232.md): The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. (no CVSS)
- [CVE-2017-14617](https://cve.now/CVE-2017-14617.md): In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handli (no CVSS)
- [CVE-2017-14618](https://cve.now/CVE-2017-14618.md): Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2017-14619](https://cve.now/CVE-2017-14619.md): Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "T (no CVSS)
- [CVE-2015-9231](https://cve.now/CVE-2015-9231.md): iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. (no CVSS)
- [CVE-2017-14615](https://cve.now/CVE-2017-14615.md): An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. (no CVSS)
- [CVE-2017-14616](https://cve.now/CVE-2017-14616.md): An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. (no CVSS)
- [CVE-2014-9758](https://cve.now/CVE-2014-9758.md): Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1. (no CVSS)
- [CVE-2015-0162](https://cve.now/CVE-2015-0162.md): IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges. (no CVSS)
- [CVE-2015-1865](https://cve.now/CVE-2015-1865.md): fts.c in coreutils 8.4 allows local users to delete arbitrary files. (CVSS 5.1)
- [CVE-2015-1866](https://cve.now/CVE-2015-1866.md): Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2. (no CVSS, ember-source)
- [CVE-2015-2826](https://cve.now/CVE-2015-2826.md): WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information. (no CVSS)
- [CVE-2015-2927](https://cve.now/CVE-2015-2927.md): node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service (bandwidth consumption). (no CVSS)
- [CVE-2015-3890](https://cve.now/CVE-2015-3890.md): Use-after-free vulnerability in Open Litespeed before 1.3.10. (no CVSS)
- [CVE-2015-4707](https://cve.now/CVE-2015-4707.md): Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors in (no CVSS, ipython)
- [CVE-2015-5395](https://cve.now/CVE-2015-5395.md): Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0. (no CVSS)
- [CVE-2015-5608](https://cve.now/CVE-2015-5608.md): Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1. (no CVSS)
- [CVE-2015-6673](https://cve.now/CVE-2015-6673.md): Use-after-free vulnerability in Decoder.cpp in libpgf before 6.15.32. (no CVSS)
- [CVE-2015-7347](https://cve.now/CVE-2015-7347.md): Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1. (no CVSS)
- [CVE-2017-14595](https://cve.now/CVE-2017-14595.md): In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archi (no CVSS)
- [CVE-2017-14596](https://cve.now/CVE-2017-14596.md): In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password. (no CVSS)
- [CVE-2017-14609](https://cve.now/CVE-2017-14609.md): The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a non-root account, which might allow local us (no CVSS)
- [CVE-2017-14610](https://cve.now/CVE-2017-14610.md): bareos-dir, bareos-fd, and bareos-sd in bareos-core in Bareos 16.2.6 and earlier create a PID file after dropping privileges to a non-root a (no CVSS)
- [CVE-2016-6795](https://cve.now/CVE-2016-6795.md): In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be (no CVSS, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2016-8738](https://cve.now/CVE-2016-8738.md): In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is pos (no CVSS, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2017-12611](https://cve.now/CVE-2017-12611.md): In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string lite (no CVSS, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2017-14607](https://cve.now/CVE-2017-14607.md): In ImageMagick 7.0.7-4 Q16, an out of bounds read flaw related to ReadTIFFImage has been reported in coders/tiff.c. (no CVSS)
- [CVE-2017-14608](https://cve.now/CVE-2017-14608.md): In LibRaw through 0.18.4, an out of bounds read flaw related to kodak\_65000\_load\_raw has been reported in dcraw/dcraw.c and internal/dcraw\_c (no CVSS)
- [CVE-2017-9793](https://cve.now/CVE-2017-9793.md): The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable (no CVSS, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2017-9804](https://cve.now/CVE-2017-9804.md): In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValida (no CVSS, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2015-1329](https://cve.now/CVE-2015-1329.md): Use-after-free vulnerability in oxide::qt::URLRequestDelegatedJob in oxide-qt in Ubuntu 15.04 and 14.04 LTS might allow remote attackers to (no CVSS)
- [CVE-2015-4072](https://cve.now/CVE-2015-4072.md): Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arb (no CVSS)
- [CVE-2015-4073](https://cve.now/CVE-2015-4073.md): Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2015-4074](https://cve.now/CVE-2015-4074.md): Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a (no CVSS)
- [CVE-2015-4075](https://cve.now/CVE-2015-4075.md): The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task. (no CVSS)
- [CVE-2015-5179](https://cve.now/CVE-2015-5179.md): FreeIPA might display user data improperly via vectors involving non-printable characters. (no CVSS)
- [CVE-2015-5248](https://cve.now/CVE-2015-5248.md): Reflected file download vulnerability in Red Hat Feedhenry Enterprise Mobile Application Platform. (no CVSS)
- [CVE-2015-5607](https://cve.now/CVE-2015-5607.md): Cross-site request forgery in the REST API in IPython 2 and 3. (no CVSS, ipython)
- [CVE-2015-8224](https://cve.now/CVE-2015-8224.md): Huawei P8 before GRA-CL00C92B210, before GRA-L09C432B200, before GRA-TL00C01B210, and before GRA-UL00C00B210 allows remote attackers to obta (no CVSS)
- [CVE-2017-14339](https://cve.now/CVE-2017-14339.md): The DNS packet parser in YADIFA before 2.2.6 does not check for the presence of infinite pointer loops, and thus it is possible to force it (no CVSS)
- [CVE-2017-7924](https://cve.now/CVE-2017-7924.md): An Improper Input Validation issue was discovered in Rockwell Automation MicroLogix 1100 controllers 1763-L16BWA, 1763-L16AWA, 1763-L16BBB, (no CVSS, Rockwell Automation MicroLogix 1100 Controllers)
- [CVE-2017-9607](https://cve.now/CVE-2017-9607.md): The BL1 FWU SMC handling code in ARM Trusted Firmware before 1.4 might allow attackers to write arbitrary data to secure memory, bypass the (no CVSS)
- [CVE-2017-9645](https://cve.now/CVE-2017-9645.md): An Inadequate Encryption Strength issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS- (no CVSS, Mirion Technologies Telemetry Enabled Devices)
- [CVE-2017-9649](https://cve.now/CVE-2017-9649.md): A Use of Hard-Coded Cryptographic Key issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, (no CVSS, Mirion Technologies Telemetry Enabled Devices)
- [CVE-2017-8770](https://cve.now/CVE-2017-8770.md): There is LFD (local file disclosure) on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device vi (no CVSS)
- [CVE-2017-8771](https://cve.now/CVE-2017-8771.md): On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username:"r (no CVSS)
- [CVE-2017-8772](https://cve.now/CVE-2017-8772.md): On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username:"r (no CVSS)
- [CVE-2017-12168](https://cve.now/CVE-2017-12168.md): The access\_pmu\_evcntr function in arch/arm64/kvm/sys\_regs.c in the Linux kernel before 4.8.11 allows privileged KVM guest OS users to cause (no CVSS, Linux kernel before)
- [CVE-2017-14604](https://cve.now/CVE-2017-14604.md): GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in wh (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-09-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.