# CVEs published 2017-09-29

48 CVEs were published on September 29, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2015-9233](https://cve.now/CVE-2015-9233.md): The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to (no CVSS)
- [CVE-2015-9234](https://cve.now/CVE-2015-9234.md): The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp\_contactform (no CVSS)
- [CVE-2017-9794](https://cve.now/CVE-2017-9794.md): When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to e (no CVSS, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2016-4434](https://cve.now/CVE-2016-4434.md): Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML Ex (no CVSS, org.apache.tika:tika-core)
- [CVE-2017-13684](https://cve.now/CVE-2017-13684.md): Unisys Libra 64xx and 84xx and FS601 class systems with MCP-FIRMWARE before 43.211 allow remote authenticated users to cause a denial of ser (no CVSS)
- [CVE-2017-14582](https://cve.now/CVE-2017-14582.md): The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allo (no CVSS)
- [CVE-2017-14945](https://cve.now/CVE-2017-14945.md): Artifex GSView 6.0 Beta on Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pd (no CVSS)
- [CVE-2017-14946](https://cve.now/CVE-2017-14946.md): Artifex GSView 6.0 Beta on Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pd (no CVSS)
- [CVE-2017-14947](https://cve.now/CVE-2017-14947.md): Artifex GSView 6.0 Beta on Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related (no CVSS)
- [CVE-2017-14351](https://cve.now/CVE-2017-14351.md): A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.23. (no CVSS)
- [CVE-2017-14352](https://cve.now/CVE-2017-14352.md): A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.23. (no CVSS)
- [CVE-2017-14942](https://cve.now/CVE-2017-14942.md): Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct reques (no CVSS)
- [CVE-2017-14944](https://cve.now/CVE-2017-14944.md): Inedo ProGet before 4.7.14 does not properly address dangerous package IDs during package addition, aka PG-1060. (no CVSS)
- [CVE-2016-10512](https://cve.now/CVE-2016-10512.md): MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. (no CVSS)
- [CVE-2017-14938](https://cve.now/CVE-2017-14938.md): \_bfd\_elf\_slurp\_version\_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows (no CVSS)
- [CVE-2017-14939](https://cve.now/CVE-2017-14939.md): decode\_line\_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a len (no CVSS)
- [CVE-2017-14940](https://cve.now/CVE-2017-14940.md): scan\_unit\_for\_symbols in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remo (no CVSS)
- [CVE-2017-14350](https://cve.now/CVE-2017-14350.md): A potential security vulnerability has been identified in HPE Application Performance Management (BSM) Platform versions 9.26, 9.30, 9.40. (no CVSS, Micro Focus HPE Application Performance Management)
- [CVE-2017-14620](https://cve.now/CVE-2017-14620.md): SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQueries resulting in S (no CVSS)
- [CVE-2017-13982](https://cve.now/CVE-2017-13982.md): A directory traversal vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.4 (no CVSS)
- [CVE-2017-13983](https://cve.now/CVE-2017-13983.md): An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, a (no CVSS)
- [CVE-2017-13984](https://cve.now/CVE-2017-13984.md): An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, a (no CVSS)
- [CVE-2017-13985](https://cve.now/CVE-2017-13985.md): An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, a (no CVSS)
- [CVE-2017-13986](https://cve.now/CVE-2017-13986.md): A reflected Cross-Site Scripting(XSS) vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.1 (no CVSS)
- [CVE-2017-13987](https://cve.now/CVE-2017-13987.md): An insufficient access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Pat (no CVSS)
- [CVE-2017-13988](https://cve.now/CVE-2017-13988.md): An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1 (no CVSS)
- [CVE-2017-13989](https://cve.now/CVE-2017-13989.md): An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1 (no CVSS)
- [CVE-2017-13990](https://cve.now/CVE-2017-13990.md): An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, al (no CVSS)
- [CVE-2017-13991](https://cve.now/CVE-2017-13991.md): An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, al (no CVSS)
- [CVE-2017-14349](https://cve.now/CVE-2017-14349.md): An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interface (no CVSS)
- [CVE-2017-14702](https://cve.now/CVE-2017-14702.md): ERS Data System 1.8.1.0 allows remote attackers to execute arbitrary code, related to "com.branaghgroup.ecers.update.UpdateRequest" object d (no CVSS)
- [CVE-2017-14738](https://cve.now/CVE-2017-14738.md): FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the metafield (no CVSS)
- [CVE-2017-14930](https://cve.now/CVE-2017-14930.md): Memory leak in decode\_line\_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, a (no CVSS)
- [CVE-2017-14931](https://cve.now/CVE-2017-14931.md): ExifImageFile::readDQT in ExifImageFileRead.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service (stack-based buffer o (no CVSS)
- [CVE-2017-14932](https://cve.now/CVE-2017-14932.md): decode\_line\_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote at (no CVSS)
- [CVE-2017-14933](https://cve.now/CVE-2017-14933.md): read\_formatted\_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows rem (no CVSS)
- [CVE-2017-14934](https://cve.now/CVE-2017-14934.md): process\_debug\_info in dwarf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote a (no CVSS)
- [CVE-2017-14935](https://cve.now/CVE-2017-14935.md): Pulse Secure Pulse One On-Premise 2.0.1649 and below does not properly validate requests, which allows remote users to query and obtain sens (no CVSS)
- [CVE-2017-14920](https://cve.now/CVE-2017-14920.md): Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an unauthenticated remote attacker to inject JavaScript (no CVSS, egroupware/egroupware)
- [CVE-2017-14921](https://cve.now/CVE-2017-14921.md): Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated (no CVSS)
- [CVE-2017-14922](https://cve.now/CVE-2017-14922.md): Stored XSS vulnerability via IMG element at "History" of Profile, Calendar, Tasks, and CRM in Tine 2.0 Community Edition before 2017.08.4 al (no CVSS)
- [CVE-2017-14923](https://cve.now/CVE-2017-14923.md): Stored XSS vulnerability via IMG element at "Leadname" of CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to (no CVSS)
- [CVE-2017-14924](https://cve.now/CVE-2017-14924.md): Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS b (no CVSS)
- [CVE-2017-14925](https://cve.now/CVE-2017-14925.md): Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS b (no CVSS)
- [CVE-2017-14926](https://cve.now/CVE-2017-14926.md): In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF document. (no CVSS)
- [CVE-2017-14927](https://cve.now/CVE-2017-14927.md): In Poppler 0.59.0, a NULL Pointer Dereference exists in the SplashOutputDev::type3D0() function in SplashOutputDev.cc via a crafted PDF docu (no CVSS)
- [CVE-2017-14928](https://cve.now/CVE-2017-14928.md): In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Configuration::Configuration in Annot.cc via a crafted PDF document. (no CVSS)
- [CVE-2017-14929](https://cve.now/CVE-2017-14929.md): In Poppler 0.59.0, memory corruption occurs in a call to Object::dictLookup() in Object.h after a repeating series of Gfx::display, Gfx::go, (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-09-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.