# CVEs published 2017-09-26 30 CVEs were published on September 26, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-14751](https://cve.now/CVE-2017-14751.md): The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field. (no CVSS) - [CVE-2017-14749](https://cve.now/CVE-2017-14749.md): JerryScript 1.0 allows remote attackers to cause a denial of service (jmem\_heap\_alloc\_block\_internal heap memory corruption) or possibly exe (no CVSS) - [CVE-2017-1425](https://cve.now/CVE-2017-1425.md): IBM Business Process Manager 8.0.1.1 and 8.5.7 is vulnerable to cross-site scripting. (no CVSS, IBM Business Process Manager Advanced) - [CVE-2017-14748](https://cve.now/CVE-2017-14748.md): Race condition in Blizzard Overwatch 1.15.0.2 allows remote authenticated users to cause a denial of service (season bans and SR losses for (no CVSS) - [CVE-2017-1527](https://cve.now/CVE-2017-1527.md): IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. (no CVSS, IBM Business Process Manager Advanced) - [CVE-2017-1530](https://cve.now/CVE-2017-1530.md): IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. (no CVSS, IBM Business Process Manager Advanced) - [CVE-2017-1531](https://cve.now/CVE-2017-1531.md): IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. (no CVSS, IBM Business Process Manager Advanced) - [CVE-2017-1539](https://cve.now/CVE-2017-1539.md): IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group membershi (no CVSS, IBM Business Process Manager Advanced) - [CVE-2017-14745](https://cve.now/CVE-2017-14745.md): The \*\_get\_synthetic\_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpre (no CVSS) - [CVE-2015-3248](https://cve.now/CVE-2015-3248.md): openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when q (no CVSS) - [CVE-2015-7390](https://cve.now/CVE-2015-7390.md): SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to (no CVSS) - [CVE-2015-7391](https://cve.now/CVE-2015-7391.md): Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2015-7670](https://cve.now/CVE-2015-7670.md): Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System plugin before 1.2.1 for WordPress allow remote at (no CVSS) - [CVE-2015-0874](https://cve.now/CVE-2015-0874.md): Smartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive (no CVSS) - [CVE-2015-5069](https://cve.now/CVE-2015-5069.md): The (1) filesystem::get\_wml\_location function in filesystem.cpp and (2) is\_legal\_file function in filesystem\_boost.cpp in Battle for Wesnoth (no CVSS) - [CVE-2015-5070](https://cve.now/CVE-2015-5070.md): The (1) filesystem::get\_wml\_location function in filesystem.cpp and (2) is\_legal\_file function in filesystem\_boost.cpp in Battle for Wesnoth (no CVSS) - [CVE-2017-13129](https://cve.now/CVE-2017-13129.md): Cross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authenticat (no CVSS) - [CVE-2017-14602](https://cve.now/CVE-2017-14602.md): A vulnerability has been identified in the management interface of Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gate (no CVSS) - [CVE-2017-14704](https://cve.now/CVE-2017-14704.md): Multiple unrestricted file upload vulnerabilities in the (1) imageSubmit and (2) proof\_submit functions in Claydip Laravel Airbnb Clone 1.0 (no CVSS) - [CVE-2017-5192](https://cve.now/CVE-2017-5192.md): When using the local\_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 (no CVSS, salt) - [CVE-2017-5200](https://cve.now/CVE-2017-5200.md): Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on (no CVSS, salt) - [CVE-2017-14703](https://cve.now/CVE-2017-14703.md): SQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute arbitrary SQL commands via the PATH\_INFO t (no CVSS) - [CVE-2017-14743](https://cve.now/CVE-2017-14743.md): Faleemi FSC-880 00.01.01.0048P2 devices allow unauthenticated SQL injection via the Username element in an XML document to /onvif/device\_ser (no CVSS) - [CVE-2017-14744](https://cve.now/CVE-2017-14744.md): UEditor 1.4.3.3 has XSS via the SRC attribute of an IFRAME element. (no CVSS) - [CVE-2017-1000252](https://cve.now/CVE-2017-1000252.md): The KVM subsystem in the Linux kernel through 4.13.3 allows guest OS users to cause a denial of service (assertion failure, and hypervisor h (no CVSS) - [CVE-2017-12154](https://cve.now/CVE-2017-12154.md): The prepare\_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-st (no CVSS, Linux kernel through) - [CVE-2017-14001](https://cve.now/CVE-2017-14001.md): An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior. (no CVSS, Digium Asterisk GUI) - [CVE-2017-14739](https://cve.now/CVE-2017-14739.md): The AcquireResampleFilterThreadSet function in magick/resample-private.h in ImageMagick 7.0.7-4 mishandles failed memory allocation, which a (no CVSS) - [CVE-2017-14741](https://cve.now/CVE-2017-14741.md): The ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers to cause a denial of service (infinite loop (no CVSS) - [CVE-2017-14737](https://cve.now/CVE-2017-14737.md): A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-09-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.