CVEs published October 6, 2017
35 CVEs were published on October 6, 2017: 0 critical, 0 high.
- Published
- 35
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 35
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- *** n/a *** IDM 4.5 bidirectional eDir Driver Version
- 2
- http
- 1
- intelliants/subrion
- 1
- Koji Project Koji · koji
- 1
- mySCADA myPRO
- 1
- QNAP Helpdesk APP
- 1
Medium, low and unrated 35
- CVE-2014-8957Cross-site scripting (XSS) vulnerability in OpenKM before 6.4.19 allows remote authenticated users to inject arbitrary web script or HTML vi
- CVE-2015-0296The pre-install script in texlive 3.1.20140525_r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226_r32488.fc20 and rpm allo
- CVE-2015-1429Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers
- CVE-2015-1828The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive informathttp
- CVE-2015-2142Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to (1
- CVE-2015-2143Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to hijack the a
- CVE-2015-2144Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to inject ar
- CVE-2015-2145Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to inject arbitrary we
- CVE-2015-2146Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands v
- CVE-2015-2147Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands v
- CVE-2015-2148Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.2 allow remote attackers to inject arbitrary we
- CVE-2015-2673The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 th
- CVE-2017-15084The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22.
- CVE-2017-13069QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 (for QTS 4.2.x), 5.0.7 (for QTS 4.3.x),
- CVE-2017-15079The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.
- CVE-2017-1002153Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.Koji Project Koji · koji
- CVE-2017-13068QNAP has already patched this vulnerability.QNAP Helpdesk APP
- CVE-2017-9272The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to a denial of service attack.*** n/a *** IDM 4.5 bidirectional eDir Driver Version
- CVE-2017-9273The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to unauthorized log configuration changes.*** n/a *** IDM 4.5 bidirectional eDir Driver Version
- CVE-2014-0047Docker before 1.5 allows local users to have unspecified impact via vectors involving unsafe /tmp usage.
- CVE-2014-2903CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server cert
- CVE-2015-1206Heap-based buffer overflow in Google Chrome before M40 allows remote attackers to cause a denial of service (unpaged memory write and proces
- CVE-2015-2158Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of
- CVE-2015-2297nanohttp in libcsoap allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Aut
- CVE-2015-5246The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors inv
- CVE-2014-7240Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject
- CVE-2014-8492Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPres
- CVE-2014-8758Cross-site scripting (XSS) vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrar
- CVE-2017-1000254libcurl may read outside of a heap allocated buffer when doing FTP.
- CVE-2017-15056p_lx_elf.cpp in UPX 3.94 mishandles ELF headers, which allows remote attackers to cause a denial of service (application crash) or possibly
- CVE-2017-15063There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error.intelliants/subrion
- CVE-2017-12730An Unquoted Search Path issue was discovered in mySCADA myPRO Versions 7.0.26 and prior.mySCADA myPRO
- CVE-2017-15045LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3.98.2 and 3.98 has a heap-based buffer over-read in fill_buffer in libmp3lame/ut
- CVE-2017-15046LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a stack-based buffer overflow in unpack_read_samples in frontend/get_audio.c, a diff
- CVE-2017-15047The clusterLoadConfig function in cluster.c in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and appl