# CVEs published 2017-10-06

35 CVEs were published on October 6, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2014-8957](https://cve.now/CVE-2014-8957.md): Cross-site scripting (XSS) vulnerability in OpenKM before 6.4.19 allows remote authenticated users to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2015-0296](https://cve.now/CVE-2015-0296.md): The pre-install script in texlive 3.1.20140525\_r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226\_r32488.fc20 and rpm allo (no CVSS)
- [CVE-2015-1429](https://cve.now/CVE-2015-1429.md): Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers (no CVSS)
- [CVE-2015-1828](https://cve.now/CVE-2015-1828.md): The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive informat (no CVSS, http)
- [CVE-2015-2142](https://cve.now/CVE-2015-2142.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to (1 (no CVSS)
- [CVE-2015-2143](https://cve.now/CVE-2015-2143.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to hijack the a (no CVSS)
- [CVE-2015-2144](https://cve.now/CVE-2015-2144.md): Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to inject ar (no CVSS)
- [CVE-2015-2145](https://cve.now/CVE-2015-2145.md): Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to inject arbitrary we (no CVSS)
- [CVE-2015-2146](https://cve.now/CVE-2015-2146.md): Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2015-2147](https://cve.now/CVE-2015-2147.md): Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2015-2148](https://cve.now/CVE-2015-2148.md): Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.2 allow remote attackers to inject arbitrary we (no CVSS)
- [CVE-2015-2673](https://cve.now/CVE-2015-2673.md): The ec\_ajax\_update\_option and ec\_ajax\_clear\_all\_taxrates functions in inc/admin/admin\_ajax\_functions.php in the WP EasyCart plugin 1.1.30 th (no CVSS)
- [CVE-2017-15084](https://cve.now/CVE-2017-15084.md): The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22. (no CVSS)
- [CVE-2017-13069](https://cve.now/CVE-2017-13069.md): QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 (for QTS 4.2.x), 5.0.7 (for QTS 4.3.x), (no CVSS)
- [CVE-2017-15079](https://cve.now/CVE-2017-15079.md): The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal. (no CVSS)
- [CVE-2017-1002153](https://cve.now/CVE-2017-1002153.md): Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission. (no CVSS, Koji Project Koji · koji)
- [CVE-2017-13068](https://cve.now/CVE-2017-13068.md): QNAP has already patched this vulnerability. (no CVSS, QNAP Helpdesk APP)
- [CVE-2017-9272](https://cve.now/CVE-2017-9272.md): The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to a denial of service attack. (no CVSS, \*\*\* n/a \*\*\* IDM 4.5 bidirectional eDir Driver Version)
- [CVE-2017-9273](https://cve.now/CVE-2017-9273.md): The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to unauthorized log configuration changes. (no CVSS, \*\*\* n/a \*\*\* IDM 4.5 bidirectional eDir Driver Version)
- [CVE-2014-0047](https://cve.now/CVE-2014-0047.md): Docker before 1.5 allows local users to have unspecified impact via vectors involving unsafe /tmp usage. (no CVSS)
- [CVE-2014-2903](https://cve.now/CVE-2014-2903.md): CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server cert (no CVSS)
- [CVE-2015-1206](https://cve.now/CVE-2015-1206.md): Heap-based buffer overflow in Google Chrome before M40 allows remote attackers to cause a denial of service (unpaged memory write and proces (no CVSS)
- [CVE-2015-2158](https://cve.now/CVE-2015-2158.md): Off-by-one error in the pngcrush\_measure\_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of (no CVSS)
- [CVE-2015-2297](https://cve.now/CVE-2015-2297.md): nanohttp in libcsoap allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Aut (no CVSS)
- [CVE-2015-5246](https://cve.now/CVE-2015-5246.md): The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors inv (no CVSS)
- [CVE-2014-7240](https://cve.now/CVE-2014-7240.md): Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject (no CVSS)
- [CVE-2014-8492](https://cve.now/CVE-2014-8492.md): Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPres (no CVSS)
- [CVE-2014-8758](https://cve.now/CVE-2014-8758.md): Cross-site scripting (XSS) vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2017-1000254](https://cve.now/CVE-2017-1000254.md): libcurl may read outside of a heap allocated buffer when doing FTP. (no CVSS)
- [CVE-2017-15056](https://cve.now/CVE-2017-15056.md): p\_lx\_elf.cpp in UPX 3.94 mishandles ELF headers, which allows remote attackers to cause a denial of service (application crash) or possibly (no CVSS)
- [CVE-2017-15063](https://cve.now/CVE-2017-15063.md): There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. (no CVSS, intelliants/subrion)
- [CVE-2017-12730](https://cve.now/CVE-2017-12730.md): An Unquoted Search Path issue was discovered in mySCADA myPRO Versions 7.0.26 and prior. (no CVSS, mySCADA myPRO)
- [CVE-2017-15045](https://cve.now/CVE-2017-15045.md): LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3.98.2 and 3.98 has a heap-based buffer over-read in fill\_buffer in libmp3lame/ut (no CVSS)
- [CVE-2017-15046](https://cve.now/CVE-2017-15046.md): LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a stack-based buffer overflow in unpack\_read\_samples in frontend/get\_audio.c, a diff (no CVSS)
- [CVE-2017-15047](https://cve.now/CVE-2017-15047.md): The clusterLoadConfig function in cluster.c in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and appl (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-10-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.