# CVEs published 2017-09-22

41 CVEs were published on September 22, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-14694](https://cve.now/CVE-2017-14694.md): Foxit Reader 8.3.2.25013 and earlier and Foxit PhantomPDF 8.3.2.25013 and earlier, when running in single instance mode, allows attackers to (no CVSS)
- [CVE-2017-14712](https://cve.now/CVE-2017-14712.md): In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Phonecall Notes Title parameter. (no CVSS)
- [CVE-2017-14713](https://cve.now/CVE-2017-14713.md): In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Description parameter. (no CVSS)
- [CVE-2017-14714](https://cve.now/CVE-2017-14714.md): In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Subject parameter. (no CVSS)
- [CVE-2017-14715](https://cve.now/CVE-2017-14715.md): In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Alerts Title parameter. (no CVSS)
- [CVE-2017-14716](https://cve.now/CVE-2017-14716.md): In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Title parameter. (no CVSS)
- [CVE-2017-14717](https://cve.now/CVE-2017-14717.md): In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Description parameter. (no CVSS)
- [CVE-2017-14705](https://cve.now/CVE-2017-14705.md): DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into (no CVSS)
- [CVE-2017-14706](https://cve.now/CVE-2017-14706.md): DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /w (no CVSS)
- [CVE-2017-6266](https://cve.now/CVE-2017-6266.md): NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where improper access controls could allow unprivileged (no CVSS, Nvidia GPU Display Driver)
- [CVE-2017-6267](https://cve.now/CVE-2017-6267.md): NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where an incorrect initialization of internal objects ca (no CVSS, Nvidia GPU Display Driver)
- [CVE-2017-6268](https://cve.now/CVE-2017-6268.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value p (no CVSS, Nvidia GPU Display Driver)
- [CVE-2017-6269](https://cve.now/CVE-2017-6269.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer (no CVSS, Nvidia GPU Display Driver)
- [CVE-2017-6270](https://cve.now/CVE-2017-6270.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiCreateAllocation where untrusted user (no CVSS, Nvidia GPU Display Driver)
- [CVE-2017-6271](https://cve.now/CVE-2017-6271.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiCreateAllocation where untrusted user (no CVSS, Nvidia GPU Display Driver)
- [CVE-2017-6272](https://cve.now/CVE-2017-6272.md): NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not co (no CVSS, Nvidia GPU Display Driver)
- [CVE-2017-6277](https://cve.now/CVE-2017-6277.md): NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value p (no CVSS, Nvidia GPU Display Driver)
- [CVE-2017-11395](https://cve.now/CVE-2017-11395.md): Command injection vulnerability in Trend Micro Smart Protection Server (Standalone) 3.1 and 3.2 server administration UI allows attackers wi (no CVSS, Trend Micro Smart Protection Server)
- [CVE-2017-11396](https://cve.now/CVE-2017-11396.md): Vulnerability issues with the web service inspection of input parameters in Trend Micro Web Security Virtual Appliance 6.5 may allow potenti (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2017-14078](https://cve.now/CVE-2017-14078.md): SQL Injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbi (no CVSS, Trend Micro Mobile Security)
- [CVE-2017-14079](https://cve.now/CVE-2017-14079.md): Unrestricted file uploads in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbitrar (no CVSS, Trend Micro Mobile Security)
- [CVE-2017-14080](https://cve.now/CVE-2017-14080.md): Authentication bypass vulnerability in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allows attackers to access a spe (no CVSS, Trend Micro Mobile Security)
- [CVE-2017-14081](https://cve.now/CVE-2017-14081.md): Proxy command injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to ex (no CVSS)
- [CVE-2017-3763](https://cve.now/CVE-2017-3763.md): An attacker who obtains access to the location where the LXCA file system is stored may be able to access credentials of local LXCA accounts (no CVSS, Lenovo Group Lenovo XClarity Administrator)
- [CVE-2017-3770](https://cve.now/CVE-2017-3770.md): Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse certain web interfac (no CVSS, Lenovo Group Lenovo XClarity Administrator)
- [CVE-2017-9393](https://cve.now/CVE-2017-9393.md): CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through (no CVSS, CA Technologies Identity Manager)
- [CVE-2017-14688](https://cve.now/CVE-2017-14688.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file, relate (no CVSS)
- [CVE-2017-14689](https://cve.now/CVE-2017-14689.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file, relate (no CVSS)
- [CVE-2017-14690](https://cve.now/CVE-2017-14690.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from F (no CVSS)
- [CVE-2017-14691](https://cve.now/CVE-2017-14691.md): STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related (no CVSS)
- [CVE-2017-14692](https://cve.now/CVE-2017-14692.md): STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mode (no CVSS)
- [CVE-2017-14693](https://cve.now/CVE-2017-14693.md): IrfanView 4.44 - 32bit allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file, rel (no CVSS)
- [CVE-2017-14636](https://cve.now/CVE-2017-14636.md): Because of an integer overflow in sam2p 0.49.3, a loop executes 0xffffffff times, ending with an invalid read of size 1 in the Image::Indexe (no CVSS)
- [CVE-2017-14637](https://cve.now/CVE-2017-14637.md): In sam2p 0.49.3, there is an invalid read of size 2 in the parse\_rgb function in in\_xpm.cpp. (no CVSS)
- [CVE-2017-14653](https://cve.now/CVE-2017-14653.md): member/Orderinfo.asp in ASP4CMS AspCMS 2.7.2 allows remote authenticated users to read arbitrary order information via a modified OrderNo pa (no CVSS)
- [CVE-2017-14685](https://cve.now/CVE-2017-14685.md): Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related (no CVSS)
- [CVE-2017-14686](https://cve.now/CVE-2017-14686.md): Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "User Mode (no CVSS)
- [CVE-2017-14687](https://cve.now/CVE-2017-14687.md): Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related (no CVSS)
- [CVE-2017-14684](https://cve.now/CVE-2017-14684.md): In ImageMagick 7.0.7-4 Q16, a memory leak vulnerability was found in the function ReadVIPSImage in coders/vips.c, which allows attackers to (no CVSS)
- [CVE-2017-8007](https://cve.now/CVE-2017-8007.md): In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Webservice Gateway is affected by a directory travers (no CVSS, EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4…)
- [CVE-2017-8012](https://cve.now/CVE-2017-8012.md): In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Java Management Extensions (JMX) protocol used to com (no CVSS, EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-09-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.