# CVEs published 2017-09-23

11 CVEs were published on September 23, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-14627](https://cve.now/CVE-2017-14627.md): Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) author (inside the INF (no CVSS)
- [CVE-2017-14718](https://cve.now/CVE-2017-14718.md): Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. (no CVSS)
- [CVE-2017-14719](https://cve.now/CVE-2017-14719.md): Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip componen (no CVSS)
- [CVE-2017-14720](https://cve.now/CVE-2017-14720.md): Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. (no CVSS)
- [CVE-2017-14721](https://cve.now/CVE-2017-14721.md): Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name. (no CVSS)
- [CVE-2017-14722](https://cve.now/CVE-2017-14722.md): Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename. (no CVSS)
- [CVE-2017-14723](https://cve.now/CVE-2017-14723.md): Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-\>prepare, and thus did not properly addre (no CVSS)
- [CVE-2017-14724](https://cve.now/CVE-2017-14724.md): Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery. (no CVSS)
- [CVE-2017-14725](https://cve.now/CVE-2017-14725.md): Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php. (no CVSS)
- [CVE-2017-14726](https://cve.now/CVE-2017-14726.md): Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor. (no CVSS)
- [CVE-2017-14727](https://cve.now/CVE-2017-14727.md): logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-09-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.