CVEs published October 10, 2017
84 CVEs were published on October 10, 2017: 0 critical, 0 high.
- Published
- 84
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 84
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Apache Software Foundation Apache NiFi · org.apache.nifi:ni…
- 1
- Apache Software Foundation Apache ZooKeeper · org.apache.zo…
- 1
- IBM Financial Transaction Manager
- 1
- IBM WebSphere Application Server
- 1
- Micro Focus HPE Operations Orchestration
- 1
- salt
- 1
- zendframework/zendframework · zendframework/zend-crypt
- 1
Medium, low and unrated 84
- CVE-2017-15225_bfd_dwarf2_cleanup_debug_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, al
- CVE-2017-15226Zyxel NBG6716 V1.00(AAKG.9)C0 devices allow command injection in the ozkerz component because beginIndex and endIndex are used directly in a
- CVE-2017-1503IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks.IBM WebSphere Application Server
- CVE-2017-15189In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop.
- CVE-2017-15190In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash.
- CVE-2017-15191In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash.
- CVE-2017-15192In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash.
- CVE-2017-15193In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory.
- CVE-2017-15219The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting (XSS) affecting a vanity-urls Title field, a containers Descriptio
- CVE-2017-1538IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive informatioIBM Financial Transaction Manager
- CVE-2017-8994A input validation vulnerability in HPE Operations Orchestration product all versions prior to 10.80, allows for the execution of code remotMicro Focus HPE Operations Orchestration
- CVE-2016-10513Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via a crafted search expression to include/functions_search.inc.php.
- CVE-2016-10514url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a UR
- CVE-2017-11046In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when an audio driver ioctl h
- CVE-2017-11048In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a display driver function
- CVE-2017-11050In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when the pktlogconf tool giv
- CVE-2017-11051In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, information disclosure is po
- CVE-2017-11052In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially
- CVE-2017-11053In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when qos map set IE of lengt
- CVE-2017-11054In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially
- CVE-2017-11055In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially
- CVE-2017-11056In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while doing sha and cipher o
- CVE-2017-11057In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in compatibility mode, flash
- CVE-2017-11059In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, setting the HMAC key by diff
- CVE-2017-11060In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observe
- CVE-2017-11061In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing cfg80211 ve
- CVE-2017-11062In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, currently attributes are not
- CVE-2017-11063In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, as a result of a race condit
- CVE-2017-11064In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observe
- CVE-2017-11067In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the Athdiag procfs entry doe
- CVE-2017-15217ImageMagick 7.0.7-2 has a memory leak in ReadSGIImage in coders/sgi.c.
- CVE-2017-15218ImageMagick 7.0.7-2 has a memory leak in ReadOneJNGImage in coders/png.c.
- CVE-2017-9683In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing a meta image,
- CVE-2017-9686In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possible double f
- CVE-2017-9687In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, two concurrent threads/proce
- CVE-2017-9697In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition can allow a
- CVE-2017-9706In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an array out-of-bounds acces
- CVE-2017-9714In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an out of bound memory acces
- CVE-2017-9715In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a vendor co
- CVE-2017-9717In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while parsing Netlink attrib
- CVE-2017-13675A denial of service (DoS) attack in Symantec Endpoint Encryption before SEE 11.1.3HF2 allows remote attackers to make a particular machine o
- CVE-2017-13679A denial of service (DoS) attack in Symantec Encryption Desktop before SED 10.4.1 MP2HF1 allows remote attackers to make a particular machin
- CVE-2017-12623An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attaApache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2017-15216MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/aj
- CVE-2008-7315UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands.
- CVE-2015-2988Rakuten card App for iOS 5.2.0 through 5.2.4 does not verify SSL certificates which might allow remote attackers to execute man-in-the-middl
- CVE-2015-5639niconico App for iOS before 6.38 does not verify SSL certificates which could allow remote attackers to execute man-in-the-middle attacks.
- CVE-2015-5675The sys_amd64 IRET Handler in the kernel in FreeBSD 9.3 and 10.1 allows local users to gain privileges or cause a denial of service (kernel
- CVE-2015-6521Multiple cross-site scripting (XSS) vulnerabilities in ATutor LMS version 2.2.
- CVE-2015-6918salt before 2015.5.5 leaks git usernames and passwords to the log.salt
- CVE-2015-7384Node.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of service.
- CVE-2015-7503Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSAzendframework/zendframework · zendframework/zend-crypt
- CVE-2015-7778Gurunavi App for iOS before 6.0.0 does not verify SSL certificates which could allow remote attackers to perform man-in-the-middle attacks.
- CVE-2015-8239The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command
- CVE-2014-9092libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG file, related to the Exif marker.
- CVE-2015-2856Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA_9_11_210
- CVE-2017-12860The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a
- CVE-2017-12861The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a
- CVE-2017-13706XML external entity (XXE) vulnerability in the import package functionality of the deployment module in Lansweeper before 6.0.100.67 allows
- CVE-2017-14943Trapeze TransitMaster is vulnerable to information disclosure (emails / hashed passwords) via a modified userID field in JSON data to Manage
- CVE-2017-15188A persistent (stored) XSS vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to
- CVE-2017-15194include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.
- CVE-2017-15195In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of another user.
- CVE-2017-15196In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user.
- CVE-2017-15197In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of another user.
- CVE-2017-15198In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a private project of another user.
- CVE-2017-15199In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstra
- CVE-2017-15200In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user.
- CVE-2017-15201In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another user.
- CVE-2017-15202In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user.
- CVE-2017-15203In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user.
- CVE-2017-15204In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user.
- CVE-2017-15205In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user.
- CVE-2017-15206In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user.
- CVE-2017-15207In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user.
- CVE-2017-15208In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user.
- CVE-2017-15209In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user.
- CVE-2017-15210In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another use
- CVE-2017-15211In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user.
- CVE-2017-15212In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another u
- CVE-2017-15213Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via
- CVE-2017-15214Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileg
- CVE-2017-15215Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.
- CVE-2017-5637Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, wApache Software Foundation Apache ZooKeeper · org.apache.zo…