# CVEs published 2017-10-02

64 CVEs were published on October 2, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-11496](https://cve.now/CVE-2017-11496.md): Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows (no CVSS)
- [CVE-2017-11497](https://cve.now/CVE-2017-11497.md): Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows (no CVSS)
- [CVE-2017-11498](https://cve.now/CVE-2017-11498.md): Buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remot (no CVSS)
- [CVE-2017-12638](https://cve.now/CVE-2017-12638.md): Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspec (no CVSS)
- [CVE-2017-12639](https://cve.now/CVE-2017-12639.md): Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspec (no CVSS)
- [CVE-2017-13704](https://cve.now/CVE-2017-13704.md): In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. (no CVSS)
- [CVE-2017-14491](https://cve.now/CVE-2017-14491.md): Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (no CVSS)
- [CVE-2017-14492](https://cve.now/CVE-2017-14492.md): Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (no CVSS)
- [CVE-2017-14493](https://cve.now/CVE-2017-14493.md): Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code vi (no CVSS)
- [CVE-2017-14494](https://cve.now/CVE-2017-14494.md): dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handli (no CVSS)
- [CVE-2017-14495](https://cve.now/CVE-2017-14495.md): Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a (no CVSS)
- [CVE-2017-14496](https://cve.now/CVE-2017-14496.md): Integer underflow in the add\_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is speci (no CVSS)
- [CVE-2017-14770](https://cve.now/CVE-2017-14770.md): Skybox Manager Client Application prior to 8.5.501 is prone to an information disclosure vulnerability of user password hashes. (no CVSS)
- [CVE-2017-14771](https://cve.now/CVE-2017-14771.md): Skybox Manager Client Application prior to 8.5.501 is prone to an arbitrary file upload vulnerability due to insufficient input validation o (no CVSS)
- [CVE-2017-14772](https://cve.now/CVE-2017-14772.md): Skybox Manager Client Application is prone to information disclosure via a username enumeration attack. (no CVSS)
- [CVE-2017-14773](https://cve.now/CVE-2017-14773.md): Skybox Manager Client Application prior to 8.5.501 is prone to an elevation of privileges vulnerability during authentication of a valid use (no CVSS)
- [CVE-2017-14848](https://cve.now/CVE-2017-14848.md): WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee\_id parameter. (no CVSS)
- [CVE-2017-1311](https://cve.now/CVE-2017-1311.md): IBM Insights Foundation for Energy 2.0 is vulnerable to SQL injection. (no CVSS, IBM Insights Foundation for Energy)
- [CVE-2017-1324](https://cve.now/CVE-2017-1324.md): IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Engineering Lifecycle Manager)
- [CVE-2017-1334](https://cve.now/CVE-2017-1334.md): IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Engineering Lifecycle Manager)
- [CVE-2017-1335](https://cve.now/CVE-2017-1335.md): IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Engineering Lifecycle Manager)
- [CVE-2017-1345](https://cve.now/CVE-2017-1345.md): IBM Insights Foundation for Energy 2.0 is vulnerable to cross-site scripting. (no CVSS, IBM Insights Foundation for Energy)
- [CVE-2017-1359](https://cve.now/CVE-2017-1359.md): IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Engineering Lifecycle Manager)
- [CVE-2017-1364](https://cve.now/CVE-2017-1364.md): IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Engineering Lifecycle Manager)
- [CVE-2017-1369](https://cve.now/CVE-2017-1369.md): IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Engineering Lifecycle Manager)
- [CVE-2017-1429](https://cve.now/CVE-2017-1429.md): IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Engineering Lifecycle Manager)
- [CVE-2017-1569](https://cve.now/CVE-2017-1569.md): IBM WebSphere Commerce 7.0 and 8.0 contains an unspecified vulnerability in Marketing ESpot's that could cause a denial of service. (no CVSS, IBM WebSphere Commerce Enterprise)
- [CVE-2015-7357](https://cve.now/CVE-2015-7357.md): Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to in (no CVSS)
- [CVE-2015-7358](https://cve.now/CVE-2015-7358.md): The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, doe (no CVSS)
- [CVE-2015-7359](https://cve.now/CVE-2015-7359.md): The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, w (no CVSS)
- [CVE-2015-3321](https://cve.now/CVE-2015-3321.md): Services and files in Lenovo Fingerprint Manager before 8.01.42 have incorrect ACLs, which allows local users to invalidate local checks and (no CVSS)
- [CVE-2015-6576](https://cve.now/CVE-2015-6576.md): Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java cod (no CVSS)
- [CVE-2015-6971](https://cve.now/CVE-2015-6971.md): Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update servi (no CVSS)
- [CVE-2015-7841](https://cve.now/CVE-2015-7841.md): The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software (no CVSS)
- [CVE-2015-7843](https://cve.now/CVE-2015-7843.md): The management interface on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software befo (no CVSS)
- [CVE-2015-7980](https://cve.now/CVE-2015-7980.md): Cross-site scripting (XSS) vulnerability in the Compass Rose module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to inject arbi (no CVSS)
- [CVE-2017-11321](https://cve.now/CVE-2017-11321.md): The restricted shell interface in UCOPIA Wireless Appliance before 5.1.8 allows remote authenticated users to gain 'admin' privileges via sh (no CVSS)
- [CVE-2017-11322](https://cve.now/CVE-2017-11322.md): The chroothole\_client executable in UCOPIA Wireless Appliance before 5.1.8 allows remote attackers to gain root privileges via a dollar sign (no CVSS)
- [CVE-2017-14754](https://cve.now/CVE-2017-14754.md): OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) (no CVSS)
- [CVE-2017-14755](https://cve.now/CVE-2017-14755.md): OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) (no CVSS)
- [CVE-2017-14756](https://cve.now/CVE-2017-14756.md): OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) (no CVSS)
- [CVE-2017-14757](https://cve.now/CVE-2017-14757.md): OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) (no CVSS)
- [CVE-2017-14758](https://cve.now/CVE-2017-14758.md): OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) (no CVSS)
- [CVE-2017-14759](https://cve.now/CVE-2017-14759.md): OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) (no CVSS)
- [CVE-2017-14979](https://cve.now/CVE-2017-14979.md): Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files (no CVSS)
- [CVE-2017-14990](https://cve.now/CVE-2017-14990.md): WordPress 4.8.2 stores cleartext wp\_signups.activation\_key values (but stores the analogous wp\_users.user\_activation\_key values as hashes), (no CVSS)
- [CVE-2017-6089](https://cve.now/CVE-2017-6089.md): SQL injection vulnerability in PhpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) project or (no CVSS)
- [CVE-2017-6090](https://cve.now/CVE-2017-6090.md): Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute (no CVSS)
- [CVE-2017-12620](https://cve.now/CVE-2017-12620.md): When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only a (no CVSS, Apache Software Foundation Apache OpenNLP · org.apache.open…)
- [CVE-2017-12792](https://cve.now/CVE-2017-12792.md): Multiple cross-site request forgery (CSRF) vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack the authentication of administra (no CVSS)
- [CVE-2017-9537](https://cve.now/CVE-2017-9537.md): Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote (no CVSS)
- [CVE-2017-9538](https://cve.now/CVE-2017-9538.md): The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cau (no CVSS)
- [CVE-2014-0043](https://cve.now/CVE-2014-0043.md): In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of parti (no CVSS, Apache Software Foundation Apache Wicket · org.apache.wicke…)
- [CVE-2016-6806](https://cve.now/CVE-2016-6806.md): Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin r (no CVSS, Apache Software Foundation Apache Wicket · org.apache.wicke…)
- [CVE-2017-9797](https://cve.now/CVE-2017-9797.md): When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode a (no CVSS, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2017-13997](https://cve.now/CVE-2017-13997.md): A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch (no CVSS, Schneider Electric InduSoft Web Studio, InTouch Machine Edi…)
- [CVE-2017-14983](https://cve.now/CVE-2017-14983.md): Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to (no CVSS)
- [CVE-2017-14984](https://cve.now/CVE-2017-14984.md): Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject a (no CVSS)
- [CVE-2017-14985](https://cve.now/CVE-2017-14985.md): Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject a (no CVSS)
- [CVE-2017-14988](https://cve.now/CVE-2017-14988.md): Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessive memory allocation) (no CVSS)
- [CVE-2017-14989](https://cve.now/CVE-2017-14989.md): A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a craft (no CVSS)
- [CVE-2017-8018](https://cve.now/CVE-2017-8018.md): EMC AppSync host plug-in versions 3.5 and below (Windows platform only) includes a denial of service (DoS) vulnerability that could potentia (no CVSS, EMC AppSync host plug-in versions 3.5 and below)
- [CVE-2017-8021](https://cve.now/CVE-2017-8021.md): EMC Elastic Cloud Storage (ECS) before 3.1 is affected by an undocumented account vulnerability that could potentially be leveraged by malic (no CVSS, EMC Elastic Cloud Storage all versions prior to)
- [CVE-2017-14981](https://cve.now/CVE-2017-14981.md): Cross-Site Scripting (XSS) was discovered in ATutor before 2.2.3. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-10-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.