CVEs published September 25, 2017
68 CVEs were published on September 25, 2017: 0 critical, 0 high.
- Published
- 68
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 68
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- Schneider Electric SE U.Motion
- 6
- Schneider Electric SE PowerSCADA Anywhere · Schneider Elect…
- 4
- plone
- 3
- geminabox
- 2
- IBM API Connect
- 2
- IBM Business Process Manager Advanced
- 1
- IBM MQ
- 1
- IBM Security Identity Manager
- 1
- org.apache.struts:struts2-core
- 1
- org.jsoup:jsoup
- 1
Medium, low and unrated 68
- CVE-2011-4667The encryption library in Cisco IOS Software 15.2(1)T, 15.2(1)T1, and 15.2(2)T, Cisco NX-OS in Cisco MDS 9222i Multiservice Modular Switch,
- CVE-2012-6696inspircd in Debian before 2.0.7 does not properly handle unsigned integers.
- CVE-2015-5169Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.org.apache.struts:struts2-core
- CVE-2015-5181The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.
- CVE-2015-5182Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ.
- CVE-2015-5183Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
- CVE-2015-5184Console: CORS headers set to allow all in Red Hat AMQ.
- CVE-2015-5263pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon
- CVE-2015-5327Out-of-bounds memory read in the x509_decode_time function in x509_cert_parser.c in Linux kernels 4.3-rc1 and after.
- CVE-2015-5666ANA App for Android 3.1.1 and earlier, and ANA App for iOS 3.3.6 and earlier does not verify SSL certificates.
- CVE-2015-5704scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands.
- CVE-2015-6592Huawei UAP2105 before V300R012C00SPC160(BootRom) does not require authentication to the serial port or the VxWorks shell.
- CVE-2015-7293Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.plone
- CVE-2015-7510Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
- CVE-2015-7544redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with
- CVE-2015-7785GANMA! App for iOS does not verify SSL certificates.
- CVE-2015-7846Huawei S7700, S9700, S9300 before V200R07C00SPC500, and AR200, AR1200, AR2200, AR3200 before V200R005C20SPC200 allows attackers with physica
- CVE-2015-8251OpenStage 60 and OpenScape Desk Phone IP 55G SIP V3, OpenStage 15, 20E, 20 and 40 and OpenScape Desk Phone IP 35G SIP V3, OpenScape Desk Pho
- CVE-2015-8375Cross-site scripting (XSS) vulnerability in PHP-Fusion 9.
- CVE-2016-5868drivers/net/ethernet/msm/rndis_ipa.c in the Qualcomm networking driver in Android allows remote attackers to execute arbitrary code via a cr
- CVE-2017-14731ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and appl
- CVE-2017-14733ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows remote attackers to c
- CVE-2017-14734The build_msps function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (heap-based buffer overflow and app
- CVE-2017-14735OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.org.owasp.antisamy:antisamy
- CVE-2014-0997WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used in the Samsung SM-T31
- CVE-2014-8156The D-Bus security policy files in /etc/dbus-1/system.d/*.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512-4, and fso-usaged 0.
- CVE-2014-8170ovirt_safe_delete_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterp
- CVE-2014-8889Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or via a drive-by down
- CVE-2015-0238selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack.
- CVE-2015-8707Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use,
- CVE-2017-7969A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistribSchneider Electric SE PowerSCADA Anywhere · Schneider Elect…
- CVE-2017-7970A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2Schneider Electric SE PowerSCADA Anywhere · Schneider Elect…
- CVE-2017-7971A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2Schneider Electric SE PowerSCADA Anywhere · Schneider Elect…
- CVE-2017-7972A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2Schneider Electric SE PowerSCADA Anywhere · Schneider Elect…
- CVE-2017-7973A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthenticated Schneider Electric SE U.Motion
- CVE-2017-7974A path traversal information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in wSchneider Electric SE U.Motion
- CVE-2017-9956An authentication bypass vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the systemSchneider Electric SE U.Motion
- CVE-2017-9957A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the web service contains a hiddenSchneider Electric SE U.Motion
- CVE-2017-9958An improper access control vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an improSchneider Electric SE U.Motion
- CVE-2017-9959A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system accepts reboot in sess
- CVE-2017-9960An information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the systeSchneider Electric SE U.Motion
- CVE-2017-9961A vulnerability exists in Schneider Electric's Pro-Face GP Pro EX version 4.07.000 that allows an attacker to execute arbitrary code.Schneider Electric SE ProFace GP-Pro EX
- CVE-2017-9962Schneider Electric's ClearSCADA versions released prior to August 2017 are susceptible to a memory allocation vulnerability, whereby malformSchneider Electric SE ClearSCADA
- CVE-2010-3049Cisco IOS before 12.2(33)SXI allows local users to cause a denial of service (device reboot).
- CVE-2010-3050Cisco IOS before 12.2(33)SXI allows remote authenticated users to cause a denial of service (device reboot).
- CVE-2015-4667Multiple hardcoded credentials in Xsuite 2.x.
- CVE-2015-4668Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phish
- CVE-2015-4669The MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to access databases on the system.
- CVE-2015-5237protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.protobuf · Google.Protobuf +3
- CVE-2015-5282Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.
- CVE-2015-6748Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.org.jsoup:jsoup
- CVE-2015-7315Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attproducts-cmfplone · plone
- CVE-2015-7316Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.xplone
- CVE-2015-7317Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu
- CVE-2015-7318Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.plone
- CVE-2017-12905Server Side Request Forgery vulnerability in Vebto Pixie Image Editor 1.4 and 1.7 allows remote attackers to disclose information or execute
- CVE-2017-14125SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary S
- CVE-2017-14730The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls for user-writable dire
- CVE-2017-1235IBM WebSphere MQ 8.0 could allow an authenticated user to cause a premature termination of a client application thread which could potentialIBM MQ
- CVE-2017-1346IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by
- CVE-2017-1362IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a local user.IBM Security Identity Manager
- CVE-2017-1424IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting.IBM Business Process Manager Advanced
- CVE-2017-14729The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not e
- CVE-2017-1551IBM API Connect 5.0.0.0 through 5.0.7.2 could allow a remote attacker to hijack the clicking action of the victim.IBM API Connect
- CVE-2017-1555IBM API Connect 5.0.0.0 through 5.0.7.2 could allow an authenticated user to generate an API token when not subscribed to the application plIBM API Connect
- CVE-2017-9551Mahara 15.04 before 15.04.14 and 16.04 before 16.04.8 and 16.10 before 16.10.5 and 17.04 before 17.04.3 are vulnerable to a user submitting
- CVE-2017-14506geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gegeminabox
- CVE-2017-14683geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.geminabox