# CVEs published 2017-10-10

84 CVEs were published on October 10, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-15225](https://cve.now/CVE-2017-15225.md): \_bfd\_dwarf2\_cleanup\_debug\_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, al (no CVSS)
- [CVE-2017-15226](https://cve.now/CVE-2017-15226.md): Zyxel NBG6716 V1.00(AAKG.9)C0 devices allow command injection in the ozkerz component because beginIndex and endIndex are used directly in a (no CVSS)
- [CVE-2017-1503](https://cve.now/CVE-2017-1503.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks. (no CVSS, IBM WebSphere Application Server)
- [CVE-2017-15189](https://cve.now/CVE-2017-15189.md): In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. (no CVSS)
- [CVE-2017-15190](https://cve.now/CVE-2017-15190.md): In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. (no CVSS)
- [CVE-2017-15191](https://cve.now/CVE-2017-15191.md): In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. (no CVSS)
- [CVE-2017-15192](https://cve.now/CVE-2017-15192.md): In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. (no CVSS)
- [CVE-2017-15193](https://cve.now/CVE-2017-15193.md): In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. (no CVSS)
- [CVE-2017-15219](https://cve.now/CVE-2017-15219.md): The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting (XSS) affecting a vanity-urls Title field, a containers Descriptio (no CVSS)
- [CVE-2017-1538](https://cve.now/CVE-2017-1538.md): IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive informatio (no CVSS, IBM Financial Transaction Manager)
- [CVE-2017-8994](https://cve.now/CVE-2017-8994.md): A input validation vulnerability in HPE Operations Orchestration product all versions prior to 10.80, allows for the execution of code remot (no CVSS, Micro Focus HPE Operations Orchestration)
- [CVE-2016-10513](https://cve.now/CVE-2016-10513.md): Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via a crafted search expression to include/functions\_search.inc.php. (no CVSS)
- [CVE-2016-10514](https://cve.now/CVE-2016-10514.md): url\_check\_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a UR (no CVSS)
- [CVE-2017-11046](https://cve.now/CVE-2017-11046.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when an audio driver ioctl h (no CVSS)
- [CVE-2017-11048](https://cve.now/CVE-2017-11048.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a display driver function (no CVSS)
- [CVE-2017-11050](https://cve.now/CVE-2017-11050.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when the pktlogconf tool giv (no CVSS)
- [CVE-2017-11051](https://cve.now/CVE-2017-11051.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, information disclosure is po (no CVSS)
- [CVE-2017-11052](https://cve.now/CVE-2017-11052.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially (no CVSS)
- [CVE-2017-11053](https://cve.now/CVE-2017-11053.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when qos map set IE of lengt (no CVSS)
- [CVE-2017-11054](https://cve.now/CVE-2017-11054.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially (no CVSS)
- [CVE-2017-11055](https://cve.now/CVE-2017-11055.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially (no CVSS)
- [CVE-2017-11056](https://cve.now/CVE-2017-11056.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while doing sha and cipher o (no CVSS)
- [CVE-2017-11057](https://cve.now/CVE-2017-11057.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in compatibility mode, flash (no CVSS)
- [CVE-2017-11059](https://cve.now/CVE-2017-11059.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, setting the HMAC key by diff (no CVSS)
- [CVE-2017-11060](https://cve.now/CVE-2017-11060.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observe (no CVSS)
- [CVE-2017-11061](https://cve.now/CVE-2017-11061.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing cfg80211 ve (no CVSS)
- [CVE-2017-11062](https://cve.now/CVE-2017-11062.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, currently attributes are not (no CVSS)
- [CVE-2017-11063](https://cve.now/CVE-2017-11063.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, as a result of a race condit (no CVSS)
- [CVE-2017-11064](https://cve.now/CVE-2017-11064.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observe (no CVSS)
- [CVE-2017-11067](https://cve.now/CVE-2017-11067.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the Athdiag procfs entry doe (no CVSS)
- [CVE-2017-15217](https://cve.now/CVE-2017-15217.md): ImageMagick 7.0.7-2 has a memory leak in ReadSGIImage in coders/sgi.c. (no CVSS)
- [CVE-2017-15218](https://cve.now/CVE-2017-15218.md): ImageMagick 7.0.7-2 has a memory leak in ReadOneJNGImage in coders/png.c. (no CVSS)
- [CVE-2017-9683](https://cve.now/CVE-2017-9683.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing a meta image, (no CVSS)
- [CVE-2017-9686](https://cve.now/CVE-2017-9686.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possible double f (no CVSS)
- [CVE-2017-9687](https://cve.now/CVE-2017-9687.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, two concurrent threads/proce (no CVSS)
- [CVE-2017-9697](https://cve.now/CVE-2017-9697.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition can allow a (no CVSS)
- [CVE-2017-9706](https://cve.now/CVE-2017-9706.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an array out-of-bounds acces (no CVSS)
- [CVE-2017-9714](https://cve.now/CVE-2017-9714.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an out of bound memory acces (no CVSS)
- [CVE-2017-9715](https://cve.now/CVE-2017-9715.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a vendor co (no CVSS)
- [CVE-2017-9717](https://cve.now/CVE-2017-9717.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while parsing Netlink attrib (no CVSS)
- [CVE-2017-13675](https://cve.now/CVE-2017-13675.md): A denial of service (DoS) attack in Symantec Endpoint Encryption before SEE 11.1.3HF2 allows remote attackers to make a particular machine o (no CVSS)
- [CVE-2017-13679](https://cve.now/CVE-2017-13679.md): A denial of service (DoS) attack in Symantec Encryption Desktop before SED 10.4.1 MP2HF1 allows remote attackers to make a particular machin (no CVSS)
- [CVE-2017-12623](https://cve.now/CVE-2017-12623.md): An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) atta (no CVSS, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2017-15216](https://cve.now/CVE-2017-15216.md): MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/aj (no CVSS)
- [CVE-2008-7315](https://cve.now/CVE-2008-7315.md): UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands. (no CVSS)
- [CVE-2015-2988](https://cve.now/CVE-2015-2988.md): Rakuten card App for iOS 5.2.0 through 5.2.4 does not verify SSL certificates which might allow remote attackers to execute man-in-the-middl (no CVSS)
- [CVE-2015-5639](https://cve.now/CVE-2015-5639.md): niconico App for iOS before 6.38 does not verify SSL certificates which could allow remote attackers to execute man-in-the-middle attacks. (no CVSS)
- [CVE-2015-5675](https://cve.now/CVE-2015-5675.md): The sys\_amd64 IRET Handler in the kernel in FreeBSD 9.3 and 10.1 allows local users to gain privileges or cause a denial of service (kernel (no CVSS)
- [CVE-2015-6521](https://cve.now/CVE-2015-6521.md): Multiple cross-site scripting (XSS) vulnerabilities in ATutor LMS version 2.2. (no CVSS)
- [CVE-2015-6918](https://cve.now/CVE-2015-6918.md): salt before 2015.5.5 leaks git usernames and passwords to the log. (no CVSS, salt)
- [CVE-2015-7384](https://cve.now/CVE-2015-7384.md): Node.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of service. (no CVSS)
- [CVE-2015-7503](https://cve.now/CVE-2015-7503.md): Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA (no CVSS, zendframework/zendframework · zendframework/zend-crypt)
- [CVE-2015-7778](https://cve.now/CVE-2015-7778.md): Gurunavi App for iOS before 6.0.0 does not verify SSL certificates which could allow remote attackers to perform man-in-the-middle attacks. (no CVSS)
- [CVE-2015-8239](https://cve.now/CVE-2015-8239.md): The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command (no CVSS)
- [CVE-2014-9092](https://cve.now/CVE-2014-9092.md): libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG file, related to the Exif marker. (no CVSS)
- [CVE-2015-2856](https://cve.now/CVE-2015-2856.md): Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA\_9\_11\_210 (no CVSS)
- [CVE-2017-12860](https://cve.now/CVE-2017-12860.md): The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a (no CVSS)
- [CVE-2017-12861](https://cve.now/CVE-2017-12861.md): The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a (no CVSS)
- [CVE-2017-13706](https://cve.now/CVE-2017-13706.md): XML external entity (XXE) vulnerability in the import package functionality of the deployment module in Lansweeper before 6.0.100.67 allows (no CVSS)
- [CVE-2017-14943](https://cve.now/CVE-2017-14943.md): Trapeze TransitMaster is vulnerable to information disclosure (emails / hashed passwords) via a modified userID field in JSON data to Manage (no CVSS)
- [CVE-2017-15188](https://cve.now/CVE-2017-15188.md): A persistent (stored) XSS vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to (no CVSS)
- [CVE-2017-15194](https://cve.now/CVE-2017-15194.md): include/global\_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page. (no CVSS)
- [CVE-2017-15195](https://cve.now/CVE-2017-15195.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of another user. (no CVSS)
- [CVE-2017-15196](https://cve.now/CVE-2017-15196.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user. (no CVSS)
- [CVE-2017-15197](https://cve.now/CVE-2017-15197.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of another user. (no CVSS)
- [CVE-2017-15198](https://cve.now/CVE-2017-15198.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a private project of another user. (no CVSS)
- [CVE-2017-15199](https://cve.now/CVE-2017-15199.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstra (no CVSS)
- [CVE-2017-15200](https://cve.now/CVE-2017-15200.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user. (no CVSS)
- [CVE-2017-15201](https://cve.now/CVE-2017-15201.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another user. (no CVSS)
- [CVE-2017-15202](https://cve.now/CVE-2017-15202.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user. (no CVSS)
- [CVE-2017-15203](https://cve.now/CVE-2017-15203.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user. (no CVSS)
- [CVE-2017-15204](https://cve.now/CVE-2017-15204.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user. (no CVSS)
- [CVE-2017-15205](https://cve.now/CVE-2017-15205.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user. (no CVSS)
- [CVE-2017-15206](https://cve.now/CVE-2017-15206.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user. (no CVSS)
- [CVE-2017-15207](https://cve.now/CVE-2017-15207.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user. (no CVSS)
- [CVE-2017-15208](https://cve.now/CVE-2017-15208.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user. (no CVSS)
- [CVE-2017-15209](https://cve.now/CVE-2017-15209.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user. (no CVSS)
- [CVE-2017-15210](https://cve.now/CVE-2017-15210.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another use (no CVSS)
- [CVE-2017-15211](https://cve.now/CVE-2017-15211.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user. (no CVSS)
- [CVE-2017-15212](https://cve.now/CVE-2017-15212.md): In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another u (no CVSS)
- [CVE-2017-15213](https://cve.now/CVE-2017-15213.md): Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via (no CVSS)
- [CVE-2017-15214](https://cve.now/CVE-2017-15214.md): Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileg (no CVSS)
- [CVE-2017-15215](https://cve.now/CVE-2017-15215.md): Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index. (no CVSS)
- [CVE-2017-5637](https://cve.now/CVE-2017-5637.md): Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, w (no CVSS, Apache Software Foundation Apache ZooKeeper · org.apache.zo…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-10-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.