# CVEs published 2017-10-09

13 CVEs were published on October 9, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2014-0030](https://cve.now/CVE-2014-0030.md): The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vec (no CVSS)
- [CVE-2014-9474](https://cve.now/CVE-2014-9474.md): Buffer overflow in the mpfr\_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via (no CVSS)
- [CVE-2015-7842](https://cve.now/CVE-2015-7842.md): Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 (no CVSS)
- [CVE-2017-13721](https://cve.now/CVE-2017-13721.md): In X.Org Server (aka xserver and xorg-server) before 1.19.4, an attacker authenticated to an X server with the X shared memory extension ena (no CVSS)
- [CVE-2017-13723](https://cve.now/CVE-2017-13723.md): In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, (no CVSS)
- [CVE-2017-14603](https://cve.now/CVE-2017-14603.md): In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before (no CVSS)
- [CVE-2017-14614](https://cve.now/CVE-2017-14614.md): Directory traversal vulnerability in the Visor GUI Console in GridGain before 1.7.16, 1.8.x before 1.8.12, 1.9.x before 1.9.7, and 8.x befor (no CVSS)
- [CVE-2017-14980](https://cve.now/CVE-2017-14980.md): Buffer overflow in Sync Breeze Enterprise 10.0.28 allows remote attackers to have unspecified impact via a long username parameter to /login (no CVSS)
- [CVE-2017-15038](https://cve.now/CVE-2017-15038.md): Race condition in the v9fs\_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive i (no CVSS)
- [CVE-2017-14971](https://cve.now/CVE-2017-14971.md): Infocus Mondopad 2.2.08 is vulnerable to a Hashed Credential Disclosure vulnerability. (no CVSS)
- [CVE-2017-14972](https://cve.now/CVE-2017-14972.md): InFocus Mondopad 2.2.08 is vulnerable to authentication bypass when accessing uploaded files by entering Control-Alt-Delete, and then using (no CVSS)
- [CVE-2017-14973](https://cve.now/CVE-2017-14973.md): IDenticard Two-Reader Controller Configuration Manager 1.18.8 (396) is vulnerable to Stored Cross-Site Scripting (XSS) via the notes field i (no CVSS)
- [CVE-2017-15185](https://cve.now/CVE-2017-15185.md): plugins/ogg.c in Libmp3splt 0.9.2 calls the libvorbis vorbis\_block\_clear function with uninitialized data upon detection of invalid input, w (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-10-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.