CVEs published October 4, 2017
56 CVEs were published on October 4, 2017: 1 critical, 1 high. 2 are now in CISA KEV.
- Published
- 56
- Critical
- 1
- High
- 1
- Medium
- 2
- Low
- 0
- Unrated
- 52
- Now in CISA KEV
- 2
- Fix available
- 28
Most affected products
- io.jenkins.blueocean:blueocean
- 3
- mercurial
- 2
- org.jenkins-ci.plugins:github-branch-source
- 2
- org.jenkins-ci.plugins:script-security
- 2
- stdlib
- 2
- com.typesafe.akka:akka-http-core_2.12 · com.typesafe.akka:a…
- 1
- Ctek, Inc. SkyRouter
- 1
- i-SENS, Inc. SmartLog Diabetes Management Software
- 1
- iniNet Solutions GmbH SCADA Webserver
- 1
- october/cms
- 1
Critical 1
High 1
Medium, low and unrated 54
- CVE-2017-12728An Improper Privilege Management issue was discovered in SpiderControl SCADA Web Server Version 2.02.0007 and prior.SpiderControl SCADA Web Server
- CVE-2017-13993An Uncontrolled Search Path or Element issue was discovered in i-SENS SmartLog Diabetes Management Software, Version 2.4.0 and prior versioni-SENS, Inc. SmartLog Diabetes Management Software
- CVE-2017-13995An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100.iniNet Solutions GmbH SCADA Webserver
- CVE-2017-14000An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11.Ctek, Inc. SkyRouter
- CVE-2017-15015ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in PDFDelegateMessage in coders/pdf.c.
- CVE-2017-15016ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadEnhMetaFile in coders/emf.c.
- CVE-2017-15017ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c.
- CVE-2017-15018LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file
- CVE-2017-15019LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a malformed mpg file, be
- CVE-2017-15020dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows re
- CVE-2017-15021bfd_get_debug_link_info_1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows
- CVE-2017-15022dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the DW_AT_name dat
- CVE-2017-15023read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not p
- CVE-2017-15024find_abstract_instance_name in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allow
- CVE-2017-15025decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote at
- CVE-2017-9628An Information Exposure issue was discovered in Saia Burgess Controls PCD Controllers with PCD firmware versions prior to 1.28.16 or 1.24.69Saia Burgess Controls PCD Controllers
- CVE-2017-1000084Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication iorg.jenkins-ci.plugins:parameterized-trigger
- CVE-2017-1000085Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g.org.jenkins-ci.plugins:subversion
- CVE-2017-1000086The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, triggerorg.jenkins-ci.plugins:periodicbackup
- CVE-2017-1000087GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use.org.jenkins-ci.plugins:github-branch-source
- CVE-2017-1000088The Sidebar Link plugin allows users able to configure jobs, views, and agents to add entries to the sidebar of these objects.org.jenkins-ci.plugins:sidebar-link
- CVE-2017-1000089Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in org.jenkins-ci.plugins:pipeline-build-step
- CVE-2017-1000090Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Requesorg.jenkins-ci.plugins:role-strategy
- CVE-2017-1000091GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g.org.jenkins-ci.plugins:github-branch-source
- CVE-2017-1000092Git Plugin connects to a user-specified Git repository as part of form validation.org.jenkins-ci.plugins:git
- CVE-2017-1000093Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.org.jenkins-ci.plugins:pollscm
- CVE-2017-1000094Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to org.jenkins-ci.plugins:docker-commons
- CVE-2017-1000095The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(org.jenkins-ci.plugins:script-security
- CVE-2017-1000096Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Piorg.jenkins-ci.plugins.workflow:workflow-cps
- CVE-2017-1000097On Darwin, user's trust preferences for root certificates were not honored.stdlib
- CVE-2017-1000098The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "mstdlib
- CVE-2017-1000099When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers.
- CVE-2017-1000100When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name
- CVE-2017-1000101curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of
- CVE-2017-1000102The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Maliciouorg.jvnet.hudson.plugins:analysis-core
- CVE-2017-1000103The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability:org.jvnet.hudson.plugins:dry
- CVE-2017-1000104The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords.org.jenkins-ci.plugins:config-file-provider
- CVE-2017-1000105The optional Run/Artifacts permission can be enabled by setting a Java system property.io.jenkins.blueocean:blueocean
- CVE-2017-1000106Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches coio.jenkins.blueocean:blueocean
- CVE-2017-1000107Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invorg.jenkins-ci.plugins:script-security
- CVE-2017-1000108The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input.org.jenkins-ci.plugins:pipeline-input-step
- CVE-2017-1000109The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scriporg.jenkins-ci.plugins:dependency-check-jenkins-plugin
- CVE-2017-1000110Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches coio.jenkins.blueocean:blueocean
- CVE-2017-1000111Linux kernel: heap out-of-bounds in AF_PACKET sockets.
- CVE-2017-1000112Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch.
- CVE-2017-1000113The Deploy to container Plugin stored passwords unencrypted as part of its configuration.org.jenkins-ci.plugins:deploy
- CVE-2017-1000114The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration.org.datadog.jenkins.plugins:datadog
- CVE-2017-1000115Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repositomercurial
- CVE-2017-1000116Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.mercurial
- CVE-2017-1000117A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any prog
- CVE-2017-1000118Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Servicecom.typesafe.akka:akka-http-core_2.12 · com.typesafe.akka:a…
- CVE-2017-1000119October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other aoctober/cms
- CVE-2017-1000120[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbit
- CVE-2017-11122On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56, an attacker can trigger an information leak due to insufficient length validation, rela