CVEs published September 26, 2017
30 CVEs were published on September 26, 2017: 0 critical, 0 high.
- Published
- 30
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- IBM Business Process Manager Advanced
- 5
- salt
- 2
- Digium Asterisk GUI
- 1
- Linux kernel through
- 1
Medium, low and unrated 30
- CVE-2017-14751The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field.
- CVE-2017-14749JerryScript 1.0 allows remote attackers to cause a denial of service (jmem_heap_alloc_block_internal heap memory corruption) or possibly exe
- CVE-2017-1425IBM Business Process Manager 8.0.1.1 and 8.5.7 is vulnerable to cross-site scripting.IBM Business Process Manager Advanced
- CVE-2017-14748Race condition in Blizzard Overwatch 1.15.0.2 allows remote authenticated users to cause a denial of service (season bans and SR losses for
- CVE-2017-1527IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data.IBM Business Process Manager Advanced
- CVE-2017-1530IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting.IBM Business Process Manager Advanced
- CVE-2017-1531IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting.IBM Business Process Manager Advanced
- CVE-2017-1539IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group membershiIBM Business Process Manager Advanced
- CVE-2017-14745The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpre
- CVE-2015-3248openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when q
- CVE-2015-7390SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to
- CVE-2015-7391Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML
- CVE-2015-7670Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System plugin before 1.2.1 for WordPress allow remote at
- CVE-2015-0874Smartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive
- CVE-2015-5069The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth
- CVE-2015-5070The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth
- CVE-2017-13129Cross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authenticat
- CVE-2017-14602A vulnerability has been identified in the management interface of Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gate
- CVE-2017-14704Multiple unrestricted file upload vulnerabilities in the (1) imageSubmit and (2) proof_submit functions in Claydip Laravel Airbnb Clone 1.0
- CVE-2017-5192When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2salt
- CVE-2017-5200Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on salt
- CVE-2017-14703SQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute arbitrary SQL commands via the PATH_INFO t
- CVE-2017-14743Faleemi FSC-880 00.01.01.0048P2 devices allow unauthenticated SQL injection via the Username element in an XML document to /onvif/device_ser
- CVE-2017-14744UEditor 1.4.3.3 has XSS via the SRC attribute of an IFRAME element.
- CVE-2017-1000252The KVM subsystem in the Linux kernel through 4.13.3 allows guest OS users to cause a denial of service (assertion failure, and hypervisor h
- CVE-2017-12154The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-stLinux kernel through
- CVE-2017-14001An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior.Digium Asterisk GUI
- CVE-2017-14739The AcquireResampleFilterThreadSet function in magick/resample-private.h in ImageMagick 7.0.7-4 mishandles failed memory allocation, which a
- CVE-2017-14741The ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers to cause a denial of service (infinite loop
- CVE-2017-14737A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local