# CVEs published 2017-10-11

55 CVEs were published on October 11, 2017: 0 critical, 2 high. Days are UTC.

- [CVE-2017-14003](https://cve.now/CVE-2017-14003.md): An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running firmware versions 6.01.00/29.03.2007 and p (no CVSS, LAVA Computer MFG Inc. Ether-Serial Link)
- [CVE-2017-14369](https://cve.now/CVE-2017-14369.md): RSA Archer GRC Platform prior to 6.2.0.5 is affected by a privilege escalation vulnerability. (no CVSS, RSA Archer GRC Platform prior to)
- [CVE-2017-14370](https://cve.now/CVE-2017-14370.md): RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Source Asset ID field. (no CVSS, RSA Archer GRC Platform versions prior to)
- [CVE-2017-14371](https://cve.now/CVE-2017-14371.md): RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting via the request URL. (no CVSS, RSA Archer GRC Platform prior to)
- [CVE-2017-14372](https://cve.now/CVE-2017-14372.md): RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting vulnerabilities via certain RSA Archer Help pages. (no CVSS, RSA Archer GRC Platform prior to)
- [CVE-2017-8016](https://cve.now/CVE-2017-8016.md): RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Questionnaire ID field. (no CVSS, RSA Archer GRC Platform versions prior to)
- [CVE-2017-8017](https://cve.now/CVE-2017-8017.md): EMC Network Configuration Manager (NCM) 9.3.x, 9.4.0.x, 9.4.1.x, and 9.4.2.x is affected by a reflected cross-site scripting Vulnerability t (no CVSS, EMC Network Configuration Manager (NCM) 9.3.x, 9.4.0.x, 9.4…)
- [CVE-2017-8025](https://cve.now/CVE-2017-8025.md): RSA Archer GRC Platform prior to 6.2.0.5 is affected by an arbitrary file upload vulnerability. (no CVSS, RSA Archer GRC Platform prior to)
- [CVE-2017-0903](https://cve.now/CVE-2017-0903.md): RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. (no CVSS, HackerOne RubyGems · rubygems-update)
- [CVE-2017-14587](https://cve.now/CVE-2017-14587.md): The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary (no CVSS, Atlassian Fisheye and Crucible)
- [CVE-2017-14588](https://cve.now/CVE-2017-14588.md): Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a (no CVSS, Atlassian Fisheye and Crucible)
- [CVE-2017-15239](https://cve.now/CVE-2017-15239.md): IrfanView 4.44 - 32bit with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact (no CVSS)
- [CVE-2017-15240](https://cve.now/CVE-2017-15240.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2017-15241](https://cve.now/CVE-2017-15241.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2017-15242](https://cve.now/CVE-2017-15242.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a cr (no CVSS)
- [CVE-2017-15243](https://cve.now/CVE-2017-15243.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2017-15244](https://cve.now/CVE-2017-15244.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2017-15245](https://cve.now/CVE-2017-15245.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2017-15246](https://cve.now/CVE-2017-15246.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a cr (no CVSS)
- [CVE-2017-15247](https://cve.now/CVE-2017-15247.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2017-15248](https://cve.now/CVE-2017-15248.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a cr (no CVSS)
- [CVE-2017-15249](https://cve.now/CVE-2017-15249.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a cr (no CVSS)
- [CVE-2017-15250](https://cve.now/CVE-2017-15250.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2017-15251](https://cve.now/CVE-2017-15251.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a cr (no CVSS)
- [CVE-2017-15252](https://cve.now/CVE-2017-15252.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a cr (no CVSS)
- [CVE-2017-15253](https://cve.now/CVE-2017-15253.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a cr (no CVSS)
- [CVE-2017-15254](https://cve.now/CVE-2017-15254.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2017-15255](https://cve.now/CVE-2017-15255.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2017-15256](https://cve.now/CVE-2017-15256.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2017-15257](https://cve.now/CVE-2017-15257.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a cr (no CVSS)
- [CVE-2017-15258](https://cve.now/CVE-2017-15258.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2017-15259](https://cve.now/CVE-2017-15259.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2017-15260](https://cve.now/CVE-2017-15260.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2017-15261](https://cve.now/CVE-2017-15261.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2017-15262](https://cve.now/CVE-2017-15262.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a cr (no CVSS)
- [CVE-2017-15263](https://cve.now/CVE-2017-15263.md): IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2017-15264](https://cve.now/CVE-2017-15264.md): IrfanView version 4.44 (32bit) allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .tif fi (no CVSS)
- [CVE-2017-2887](https://cve.now/CVE-2017-2887.md): An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL\_image 2.0.1. (CVSS 8.8, Talos Simple Direct Media)
- [CVE-2017-2888](https://cve.now/CVE-2017-2888.md): An exploitable integer overflow vulnerability exists when creating a new RGB Surface in SDL 2.0.5. (CVSS 8.8, Talos Simple Direct Media)
- [CVE-2017-13720](https://cve.now/CVE-2017-13720.md): In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connectio (no CVSS)
- [CVE-2017-13722](https://cve.now/CVE-2017-13722.md): In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary check (for PCF files (no CVSS)
- [CVE-2017-15266](https://cve.now/CVE-2017-15266.md): In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR\_wav\_extract\_method in wav\_extractor.c via a zero sample rate. (no CVSS)
- [CVE-2017-15267](https://cve.now/CVE-2017-15267.md): In GNU Libextractor 1.4, there is a NULL Pointer Dereference in flac\_metadata in flac\_extractor.c. (no CVSS)
- [CVE-2017-12188](https://cve.now/CVE-2017-12188.md): arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entrie (no CVSS, Linux kernel)
- [CVE-2017-15220](https://cve.now/CVE-2017-15220.md): Flexense VX Search Enterprise 10.1.12 is vulnerable to a buffer overflow via an empty POST request to a long URI beginning with a /../ subst (no CVSS)
- [CVE-2013-6924](https://cve.now/CVE-2013-6924.md): Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters (no CVSS)
- [CVE-2017-7352](https://cve.now/CVE-2017-7352.md): Stored Cross-site scripting (XSS) vulnerability in Pure Storage Purity 4.7.5 allows remote authenticated users to inject arbitrary web scrip (no CVSS)
- [CVE-2017-15232](https://cve.now/CVE-2017-15232.md): libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file. (no CVSS)
- [CVE-2017-15235](https://cve.now/CVE-2017-15235.md): The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads (no CVSS)
- [CVE-2017-15236](https://cve.now/CVE-2017-15236.md): Tiandy IP cameras 5.56.17.120 do not properly restrict a certain proprietary protocol, which allows remote attackers to read settings via a (no CVSS)
- [CVE-2017-15238](https://cve.now/CVE-2017-15238.md): ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26 has a use-after-free issue when the height or width is zero, related to ReadJNGImag (no CVSS)
- [CVE-2017-5700](https://cve.now/CVE-2017-5700.md): Insufficient protection of password storage in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN00 (no CVSS, Intel NUC Kits)
- [CVE-2017-5701](https://cve.now/CVE-2017-5701.md): Insecure platform configuration in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below (no CVSS, Intel NUC Kits)
- [CVE-2017-5721](https://cve.now/CVE-2017-5721.md): Insufficient input validation in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below a (no CVSS, Intel NUC Kits)
- [CVE-2017-5722](https://cve.now/CVE-2017-5722.md): Incorrect policy enforcement in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below al (no CVSS, Intel NUC Kits)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-10-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.