CVEs published September 27, 2017
50 CVEs were published on September 27, 2017: 0 critical, 0 high.
- Published
- 50
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 50
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- genix/cms
- 5
- IBM Security Identity Manager
- 2
- Apache Software Foundation Apache Commons Jelly · commons-j…
- 1
- IBM DataPower Gateways
- 1
- IBM WebSphere Portal
- 1
- Inpsyde backwpup
- 1
- laravel/framework · illuminate/auth
- 1
- Symantec Norton Remove & Reinstall
- 1
- ZTE NR8000 Series
- 1
Medium, low and unrated 50
- CVE-2017-14838TeamWork Job Links allows Arbitrary File Upload in profileChange and coverChange.
- CVE-2017-14839TeamWork Photo Fusion allows Arbitrary File Upload in changeAvatar and changeCover.
- CVE-2017-14840TeamWork TicketPlus allows Arbitrary File Upload in updateProfile.
- CVE-2017-14841Mojoomla Annual Maintenance Contract (AMC) Management System allows Arbitrary File Upload in profilesetting image handling.
- CVE-2017-14842Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.
- CVE-2017-14843Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.
- CVE-2017-14844Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.
- CVE-2017-14845Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.
- CVE-2017-14846Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.
- CVE-2017-14847Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.
- CVE-2014-9686The Googlemaps plugin 3.2 and earlier for Joomla! allows remote attackers with control of a sub-domain belonging to a victim domain to cause
- CVE-2015-1526The media_server component in Android allows remote attackers to cause a denial of service via a crafted application.
- CVE-2015-1537Integer overflow in IHDCP.cpp in the media_server component in Android allows remote attackers to execute arbitrary code via a crafted appli
- CVE-2015-7349Cross-site scripting (XSS) vulnerability in the sample feedback.inc file in VASCO DIGIPASS authentication plug-in for Citrix Web Interface a
- CVE-2017-11191FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action
- CVE-2015-3138print-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service (segmentation fault and process crash).
- CVE-2015-7256ZyXEL NWA1100-N, NWA1100-NH, NWA1121-NI, NWA1123-AC, and NWA1123-NI access points; P-660HN-51, P-663HN-51, VMG1312-B10A, VMG1312-B30A, VMG13
- CVE-2014-8878KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote attackers to obtain sensitive i
- CVE-2015-5613Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML
- CVE-2015-8249The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary fil
- CVE-2017-11120On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger
- CVE-2017-11121On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can pote
- CVE-2017-12814Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on Windo
- CVE-2017-1407IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on theIBM Security Identity Manager
- CVE-2017-14524Multiple open redirect vulnerabilities in OpenText Documentum Administrator 7.2.0180.0055 allow remote attackers to redirect users to arbitr
- CVE-2017-14525Multiple open redirect vulnerabilities in OpenText Documentum Webtop 6.8.0160.0073 allow remote attackers to redirect users to arbitrary web
- CVE-2017-14526Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote authenticated users t
- CVE-2017-14527Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Webtop 6.8.0160.0073 allow remote authenticated users to list
- CVE-2017-14622Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attack
- CVE-2017-14795The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (out-of-bounds read and appli
- CVE-2017-14796The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (integer underflow and applic
- CVE-2017-1483IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowinIBM Security Identity Manager
- CVE-2017-1577IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system.IBM WebSphere Portal
- CVE-2017-1591IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vulnerable to cross-site scripting.IBM DataPower Gateways
- CVE-2017-10932All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 ZTE NR8000 Series
- CVE-2017-12621During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entityApache Software Foundation Apache Commons Jelly · commons-j…
- CVE-2017-14775Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token claravel/framework · illuminate/auth
- CVE-2017-2551Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.Inpsyde backwpup
- CVE-2015-1336The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to
- CVE-2015-3643usb-creator before 0.2.38.3ubuntu0.1 on Ubuntu 12.04 LTS, before 0.2.56.3ubuntu0.1 on Ubuntu 14.04 LTS, before 0.2.62ubuntu0.3 on Ubuntu 14.
- CVE-2017-13676Norton Remove & Reinstall can be susceptible to a DLL preloading vulnerability.Symantec Norton Remove & Reinstall
- CVE-2017-14760SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for Wo
- CVE-2017-14761In GeniXCMS 1.1.4, /inc/lib/backend/menus.control.php has XSS via the id parameter.genix/cms
- CVE-2017-14762In GeniXCMS 1.1.4, /inc/lib/Control/Backend/menus.control.php has XSS via the id parameter.genix/cms
- CVE-2017-14763In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of genix/cms
- CVE-2017-14764In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of genix/cms
- CVE-2017-14765In GeniXCMS 1.1.4, gxadmin/index.php has XSS via the Menu ID field in a page=menus request.genix/cms
- CVE-2017-14766The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fn_ssr_add_st_submit() fu
- CVE-2017-14767The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before 3.3.4 mishandles empty sprop-parameter-sets values, wh
- CVE-2017-14753Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject a