CVEs published October 2, 2017
64 CVEs were published on October 2, 2017: 0 critical, 0 high.
- Published
- 64
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 64
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- IBM Rational Engineering Lifecycle Manager
- 7
- Apache Software Foundation Apache Wicket · org.apache.wicke…
- 2
- IBM Insights Foundation for Energy
- 2
- Apache Software Foundation Apache Geode · org.apache.geode:…
- 1
- Apache Software Foundation Apache OpenNLP · org.apache.open…
- 1
- EMC AppSync host plug-in versions 3.5 and below
- 1
- EMC Elastic Cloud Storage all versions prior to
- 1
- IBM WebSphere Commerce Enterprise
- 1
- Schneider Electric InduSoft Web Studio, InTouch Machine Edi…
- 1
Medium, low and unrated 64
- CVE-2017-11496Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows
- CVE-2017-11497Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows
- CVE-2017-11498Buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remot
- CVE-2017-12638Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspec
- CVE-2017-12639Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspec
- CVE-2017-13704In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value.
- CVE-2017-14491Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via
- CVE-2017-14492Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via
- CVE-2017-14493Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code vi
- CVE-2017-14494dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handli
- CVE-2017-14495Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a
- CVE-2017-14496Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is speci
- CVE-2017-14770Skybox Manager Client Application prior to 8.5.501 is prone to an information disclosure vulnerability of user password hashes.
- CVE-2017-14771Skybox Manager Client Application prior to 8.5.501 is prone to an arbitrary file upload vulnerability due to insufficient input validation o
- CVE-2017-14772Skybox Manager Client Application is prone to information disclosure via a username enumeration attack.
- CVE-2017-14773Skybox Manager Client Application prior to 8.5.501 is prone to an elevation of privileges vulnerability during authentication of a valid use
- CVE-2017-14848WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.
- CVE-2017-1311IBM Insights Foundation for Energy 2.0 is vulnerable to SQL injection.IBM Insights Foundation for Energy
- CVE-2017-1324IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting.IBM Rational Engineering Lifecycle Manager
- CVE-2017-1334IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting.IBM Rational Engineering Lifecycle Manager
- CVE-2017-1335IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting.IBM Rational Engineering Lifecycle Manager
- CVE-2017-1345IBM Insights Foundation for Energy 2.0 is vulnerable to cross-site scripting.IBM Insights Foundation for Energy
- CVE-2017-1359IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting.IBM Rational Engineering Lifecycle Manager
- CVE-2017-1364IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting.IBM Rational Engineering Lifecycle Manager
- CVE-2017-1369IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting.IBM Rational Engineering Lifecycle Manager
- CVE-2017-1429IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting.IBM Rational Engineering Lifecycle Manager
- CVE-2017-1569IBM WebSphere Commerce 7.0 and 8.0 contains an unspecified vulnerability in Marketing ESpot's that could cause a denial of service.IBM WebSphere Commerce Enterprise
- CVE-2015-7357Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to in
- CVE-2015-7358The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, doe
- CVE-2015-7359The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, w
- CVE-2015-3321Services and files in Lenovo Fingerprint Manager before 8.01.42 have incorrect ACLs, which allows local users to invalidate local checks and
- CVE-2015-6576Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java cod
- CVE-2015-6971Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update servi
- CVE-2015-7841The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software
- CVE-2015-7843The management interface on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software befo
- CVE-2015-7980Cross-site scripting (XSS) vulnerability in the Compass Rose module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to inject arbi
- CVE-2017-11321The restricted shell interface in UCOPIA Wireless Appliance before 5.1.8 allows remote authenticated users to gain 'admin' privileges via sh
- CVE-2017-11322The chroothole_client executable in UCOPIA Wireless Appliance before 5.1.8 allows remote attackers to gain root privileges via a dollar sign
- CVE-2017-14754OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well)
- CVE-2017-14755OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well)
- CVE-2017-14756OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well)
- CVE-2017-14757OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well)
- CVE-2017-14758OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well)
- CVE-2017-14759OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well)
- CVE-2017-14979Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files
- CVE-2017-14990WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes),
- CVE-2017-6089SQL injection vulnerability in PhpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) project or
- CVE-2017-6090Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute
- CVE-2017-12620When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only aApache Software Foundation Apache OpenNLP · org.apache.open…
- CVE-2017-12792Multiple cross-site request forgery (CSRF) vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack the authentication of administra
- CVE-2017-9537Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote
- CVE-2017-9538The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cau
- CVE-2014-0043In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of partiApache Software Foundation Apache Wicket · org.apache.wicke…
- CVE-2016-6806Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin rApache Software Foundation Apache Wicket · org.apache.wicke…
- CVE-2017-9797When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode aApache Software Foundation Apache Geode · org.apache.geode:…
- CVE-2017-13997A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouchSchneider Electric InduSoft Web Studio, InTouch Machine Edi…
- CVE-2017-14983Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to
- CVE-2017-14984Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject a
- CVE-2017-14985Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject a
- CVE-2017-14988Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessive memory allocation)
- CVE-2017-14989A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a craft
- CVE-2017-8018EMC AppSync host plug-in versions 3.5 and below (Windows platform only) includes a denial of service (DoS) vulnerability that could potentiaEMC AppSync host plug-in versions 3.5 and below
- CVE-2017-8021EMC Elastic Cloud Storage (ECS) before 3.1 is affected by an undocumented account vulnerability that could potentially be leveraged by malicEMC Elastic Cloud Storage all versions prior to
- CVE-2017-14981Cross-Site Scripting (XSS) was discovered in ATutor before 2.2.3.