# CVEs published 2017-09-25

68 CVEs were published on September 25, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2011-4667](https://cve.now/CVE-2011-4667.md): The encryption library in Cisco IOS Software 15.2(1)T, 15.2(1)T1, and 15.2(2)T, Cisco NX-OS in Cisco MDS 9222i Multiservice Modular Switch, (no CVSS)
- [CVE-2012-6696](https://cve.now/CVE-2012-6696.md): inspircd in Debian before 2.0.7 does not properly handle unsigned integers. (no CVSS)
- [CVE-2015-5169](https://cve.now/CVE-2015-5169.md): Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20. (no CVSS, org.apache.struts:struts2-core)
- [CVE-2015-5181](https://cve.now/CVE-2015-5181.md): The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript. (no CVSS)
- [CVE-2015-5182](https://cve.now/CVE-2015-5182.md): Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ. (no CVSS)
- [CVE-2015-5183](https://cve.now/CVE-2015-5183.md): Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ. (no CVSS)
- [CVE-2015-5184](https://cve.now/CVE-2015-5184.md): Console: CORS headers set to allow all in Red Hat AMQ. (no CVSS)
- [CVE-2015-5263](https://cve.now/CVE-2015-5263.md): pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon (no CVSS)
- [CVE-2015-5327](https://cve.now/CVE-2015-5327.md): Out-of-bounds memory read in the x509\_decode\_time function in x509\_cert\_parser.c in Linux kernels 4.3-rc1 and after. (no CVSS)
- [CVE-2015-5666](https://cve.now/CVE-2015-5666.md): ANA App for Android 3.1.1 and earlier, and ANA App for iOS 3.3.6 and earlier does not verify SSL certificates. (no CVSS)
- [CVE-2015-5704](https://cve.now/CVE-2015-5704.md): scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands. (no CVSS)
- [CVE-2015-6592](https://cve.now/CVE-2015-6592.md): Huawei UAP2105 before V300R012C00SPC160(BootRom) does not require authentication to the serial port or the VxWorks shell. (no CVSS)
- [CVE-2015-7293](https://cve.now/CVE-2015-7293.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x. (no CVSS, plone)
- [CVE-2015-7510](https://cve.now/CVE-2015-7510.md): Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd. (no CVSS)
- [CVE-2015-7544](https://cve.now/CVE-2015-7544.md): redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with (no CVSS)
- [CVE-2015-7785](https://cve.now/CVE-2015-7785.md): GANMA! App for iOS does not verify SSL certificates. (no CVSS)
- [CVE-2015-7846](https://cve.now/CVE-2015-7846.md): Huawei S7700, S9700, S9300 before V200R07C00SPC500, and AR200, AR1200, AR2200, AR3200 before V200R005C20SPC200 allows attackers with physica (no CVSS)
- [CVE-2015-8251](https://cve.now/CVE-2015-8251.md): OpenStage 60 and OpenScape Desk Phone IP 55G SIP V3, OpenStage 15, 20E, 20 and 40 and OpenScape Desk Phone IP 35G SIP V3, OpenScape Desk Pho (no CVSS)
- [CVE-2015-8375](https://cve.now/CVE-2015-8375.md): Cross-site scripting (XSS) vulnerability in PHP-Fusion 9. (no CVSS)
- [CVE-2016-5868](https://cve.now/CVE-2016-5868.md): drivers/net/ethernet/msm/rndis\_ipa.c in the Qualcomm networking driver in Android allows remote attackers to execute arbitrary code via a cr (no CVSS)
- [CVE-2017-14731](https://cve.now/CVE-2017-14731.md): ofx\_proc\_file in ofx\_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and appl (no CVSS)
- [CVE-2017-14733](https://cve.now/CVE-2017-14733.md): ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows remote attackers to c (no CVSS)
- [CVE-2017-14734](https://cve.now/CVE-2017-14734.md): The build\_msps function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (heap-based buffer overflow and app (no CVSS)
- [CVE-2017-14735](https://cve.now/CVE-2017-14735.md): OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL. (no CVSS, org.owasp.antisamy:antisamy)
- [CVE-2014-0997](https://cve.now/CVE-2014-0997.md): WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used in the Samsung SM-T31 (no CVSS)
- [CVE-2014-8156](https://cve.now/CVE-2014-8156.md): The D-Bus security policy files in /etc/dbus-1/system.d/\*.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512-4, and fso-usaged 0. (no CVSS)
- [CVE-2014-8170](https://cve.now/CVE-2014-8170.md): ovirt\_safe\_delete\_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterp (no CVSS)
- [CVE-2014-8889](https://cve.now/CVE-2014-8889.md): Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or via a drive-by down (no CVSS)
- [CVE-2015-0238](https://cve.now/CVE-2015-0238.md): selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack. (no CVSS)
- [CVE-2015-8707](https://cve.now/CVE-2015-8707.md): Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, (no CVSS)
- [CVE-2017-7969](https://cve.now/CVE-2017-7969.md): A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistrib (no CVSS, Schneider Electric SE PowerSCADA Anywhere · Schneider Elect…)
- [CVE-2017-7970](https://cve.now/CVE-2017-7970.md): A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 (no CVSS, Schneider Electric SE PowerSCADA Anywhere · Schneider Elect…)
- [CVE-2017-7971](https://cve.now/CVE-2017-7971.md): A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 (no CVSS, Schneider Electric SE PowerSCADA Anywhere · Schneider Elect…)
- [CVE-2017-7972](https://cve.now/CVE-2017-7972.md): A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 (no CVSS, Schneider Electric SE PowerSCADA Anywhere · Schneider Elect…)
- [CVE-2017-7973](https://cve.now/CVE-2017-7973.md): A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthenticated (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2017-7974](https://cve.now/CVE-2017-7974.md): A path traversal information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in w (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2017-9956](https://cve.now/CVE-2017-9956.md): An authentication bypass vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2017-9957](https://cve.now/CVE-2017-9957.md): A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the web service contains a hidden (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2017-9958](https://cve.now/CVE-2017-9958.md): An improper access control vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an impro (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2017-9959](https://cve.now/CVE-2017-9959.md): A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system accepts reboot in sess (no CVSS)
- [CVE-2017-9960](https://cve.now/CVE-2017-9960.md): An information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the syste (no CVSS, Schneider Electric SE U.Motion)
- [CVE-2017-9961](https://cve.now/CVE-2017-9961.md): A vulnerability exists in Schneider Electric's Pro-Face GP Pro EX version 4.07.000 that allows an attacker to execute arbitrary code. (no CVSS, Schneider Electric SE ProFace GP-Pro EX)
- [CVE-2017-9962](https://cve.now/CVE-2017-9962.md): Schneider Electric's ClearSCADA versions released prior to August 2017 are susceptible to a memory allocation vulnerability, whereby malform (no CVSS, Schneider Electric SE ClearSCADA)
- [CVE-2010-3049](https://cve.now/CVE-2010-3049.md): Cisco IOS before 12.2(33)SXI allows local users to cause a denial of service (device reboot). (no CVSS)
- [CVE-2010-3050](https://cve.now/CVE-2010-3050.md): Cisco IOS before 12.2(33)SXI allows remote authenticated users to cause a denial of service (device reboot). (no CVSS)
- [CVE-2015-4667](https://cve.now/CVE-2015-4667.md): Multiple hardcoded credentials in Xsuite 2.x. (no CVSS)
- [CVE-2015-4668](https://cve.now/CVE-2015-4668.md): Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phish (no CVSS)
- [CVE-2015-4669](https://cve.now/CVE-2015-4669.md): The MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to access databases on the system. (no CVSS)
- [CVE-2015-5237](https://cve.now/CVE-2015-5237.md): protobuf allows remote authenticated attackers to cause a heap-based buffer overflow. (no CVSS, protobuf · Google.Protobuf +3)
- [CVE-2015-5282](https://cve.now/CVE-2015-5282.md): Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after. (no CVSS)
- [CVE-2015-6748](https://cve.now/CVE-2015-6748.md): Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3. (no CVSS, org.jsoup:jsoup)
- [CVE-2015-7315](https://cve.now/CVE-2015-7315.md): Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote att (no CVSS, products-cmfplone · plone)
- [CVE-2015-7316](https://cve.now/CVE-2015-7316.md): Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x (no CVSS, plone)
- [CVE-2015-7317](https://cve.now/CVE-2015-7317.md): Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu (no CVSS)
- [CVE-2015-7318](https://cve.now/CVE-2015-7318.md): Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses. (no CVSS, plone)
- [CVE-2017-12905](https://cve.now/CVE-2017-12905.md): Server Side Request Forgery vulnerability in Vebto Pixie Image Editor 1.4 and 1.7 allows remote attackers to disclose information or execute (no CVSS)
- [CVE-2017-14125](https://cve.now/CVE-2017-14125.md): SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary S (no CVSS)
- [CVE-2017-14730](https://cve.now/CVE-2017-14730.md): The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls for user-writable dire (no CVSS)
- [CVE-2017-1235](https://cve.now/CVE-2017-1235.md): IBM WebSphere MQ 8.0 could allow an authenticated user to cause a premature termination of a client application thread which could potential (no CVSS, IBM MQ)
- [CVE-2017-1346](https://cve.now/CVE-2017-1346.md): IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by (no CVSS)
- [CVE-2017-1362](https://cve.now/CVE-2017-1362.md): IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a local user. (no CVSS, IBM Security Identity Manager)
- [CVE-2017-1424](https://cve.now/CVE-2017-1424.md): IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. (no CVSS, IBM Business Process Manager Advanced)
- [CVE-2017-14729](https://cve.now/CVE-2017-14729.md): The \*\_get\_synthetic\_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not e (no CVSS)
- [CVE-2017-1551](https://cve.now/CVE-2017-1551.md): IBM API Connect 5.0.0.0 through 5.0.7.2 could allow a remote attacker to hijack the clicking action of the victim. (no CVSS, IBM API Connect)
- [CVE-2017-1555](https://cve.now/CVE-2017-1555.md): IBM API Connect 5.0.0.0 through 5.0.7.2 could allow an authenticated user to generate an API token when not subscribed to the application pl (no CVSS, IBM API Connect)
- [CVE-2017-9551](https://cve.now/CVE-2017-9551.md): Mahara 15.04 before 15.04.14 and 16.04 before 16.04.8 and 16.10 before 16.10.5 and 17.04 before 17.04.3 are vulnerable to a user submitting (no CVSS)
- [CVE-2017-14506](https://cve.now/CVE-2017-14506.md): geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .ge (no CVSS, geminabox)
- [CVE-2017-14683](https://cve.now/CVE-2017-14683.md): geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload. (no CVSS, geminabox)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-09-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.