CVEs published September 28, 2017
40 CVEs were published on September 28, 2017: 1 critical, 5 high. 8 are now in CISA KEV.
- Published
- 40
- Critical
- 1
- High
- 5
- Medium
- 2
- Low
- 0
- Unrated
- 32
- Now in CISA KEV
- 8
- Fix available
- 2
Most affected products
- Cisco IOS
- 6
- Cisco IOS XE
- 6
- Cisco IOS and IOS XE
- 3
- Apache Software Foundation Apache Mesos · org.apache.mesos:…
- 2
- Elastic Cloud Enterprise
- 1
- Elastic X-Pack Alerting
- 1
- Elastic X-Pack Security
- 1
Critical 1
High 5
- CVE-2017-12231A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS 12.4 through 15.6 could allow an unautCisco IOS
- CVE-2017-12233Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow anCisco IOS
- CVE-2017-12234Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow anCisco IOS
- CVE-2017-12235A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could alCisco IOS
- CVE-2017-12237A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 couldCisco IOS and IOS XE
Medium, low and unrated 34
- CVE-2017-7552A flaw was discovered in the file editor of millicore, affecting versions before 3.19.0 and 4.x before 4.5.0, which allows files to be execu
- CVE-2017-7553The external_request api call in App Studio (millicore) allows server side request forgery (SSRF).
- CVE-2017-7554It was found that the App Studio component of RHMAP 4.4 executes javascript provided by a user.
- CVE-2017-7687When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1Apache Software Foundation Apache Mesos · org.apache.mesos:…
- CVE-2017-9790When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3Apache Software Foundation Apache Mesos · org.apache.mesos:…
- CVE-2014-2029The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive informa
- CVE-2015-1027The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks
- CVE-2017-10701Cross site scripting (XSS) vulnerability in SAP Enterprise Portal 7.50 allows remote attackers to inject arbitrary web script or HTML, aka S
- CVE-2017-11479Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive i
- CVE-2017-14507Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL co
- CVE-2017-8444The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper.Elastic Cloud Enterprise
- CVE-2017-8447An error was found in the X-Pack Security 5.3.0 to 5.5.2 privilege enforcement.Elastic X-Pack Security
- CVE-2017-8448An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could creatElastic X-Pack Alerting
- CVE-2017-14867Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to su
- CVE-2017-12222A vulnerability in the wireless controller manager of Cisco IOS XE could allow an unauthenticated, adjacent attacker to cause a restart of tCisco IOS XE
- CVE-2017-12226A vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software for Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 45Cisco IOS XE
- CVE-2017-12228A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow Cisco IOS and IOS XE
- CVE-2017-12229A vulnerability in the REST API of the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 could allow an unauthenticated, reCisco IOS XE
- CVE-2017-12230A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate theirCisco IOS XE
- CVE-2017-12232A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15.Cisco IOS
- CVE-2017-12236A vulnerability in the implementation of the Locator/ID Separation Protocol (LISP) in Cisco IOS XE 3.2 through 16.5 could allow an unauthentCisco IOS XE
- CVE-2017-12238A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could Cisco IOS
- CVE-2017-12239A vulnerability in motherboard console ports of line cards for Cisco ASR 1000 Series Aggregation Services Routers and Cisco cBR-8 Converged Cisco IOS XE
- CVE-2017-14857In Exiv2 0.26, there is an invalid free in the Image class in image.cpp that leads to a Segmentation fault.
- CVE-2017-14858There is a heap-based buffer overflow in the Exiv2::l2Data function of types.cpp in Exiv2 0.26.
- CVE-2017-14860There is a heap-based buffer over-read in the Exiv2::Jp2Image::readMetadata function of jp2image.cpp in Exiv2 0.26.
- CVE-2017-14861There is a stack consumption vulnerability in the Exiv2::Internal::stringFormat function of image.cpp in Exiv2 0.26.
- CVE-2017-14863A NULL pointer dereference was discovered in Exiv2::Image::printIFDStructure in image.cpp in Exiv2 0.26.
- CVE-2017-14865There is a heap-based buffer overflow in the Exiv2::us2Data function of types.cpp in Exiv2 0.26.
- CVE-2017-14866There is a heap-based buffer overflow in the Exiv2::s2Data function of types.cpp in Exiv2 0.26.
- CVE-2017-14849Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the p
- CVE-2017-14859An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26.
- CVE-2017-14862An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26.
- CVE-2017-14864An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26.