# CVEs published 2017-10-12

23 CVEs were published on October 12, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-8736](https://cve.now/CVE-2016-8736.md): Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack. (no CVSS, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2016-9263](https://cve.now/CVE-2016-9263.md): WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Fla (no CVSS)
- [CVE-2017-15290](https://cve.now/CVE-2017-15290.md): Mirasys Video Management System (VMS) 6.x before 6.4.6, 7.x before 7.5.15, and 8.x before 8.1.1 has a login process in which cleartext data (no CVSS)
- [CVE-2015-6358](https://cve.now/CVE-2015-6358.md): Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers t (no CVSS)
- [CVE-2017-12849](https://cve.now/CVE-2017-12849.md): Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers t (no CVSS, silverstripe/cms)
- [CVE-2017-15268](https://cve.now/CVE-2017-15268.md): Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-we (no CVSS)
- [CVE-2017-15287](https://cve.now/CVE-2017-15287.md): There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices, as demonstrated by the "Name des Bouquets" field, or the (no CVSS)
- [CVE-2017-10857](https://cve.now/CVE-2017-10857.md): Cybozu Office 10.0.0 to 10.6.1 allows authenticated attackers to bypass access restriction to perform arbitrary actions via "Cabinet" functi (no CVSS, Cybozu Office)
- [CVE-2017-10862](https://cve.now/CVE-2017-10862.md): jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JW (no CVSS, reallyl IO jwt-scala · io.really:jwt-scala)
- [CVE-2017-10863](https://cve.now/CVE-2017-10863.md): Untrusted search path vulnerability in HIBUN Confidential File Decryption program prior to 10.50.0.5 allows an attacker to gain privileges v (no CVSS, Hitachi Solutions HIBUN Confidential File Decryption program)
- [CVE-2017-10864](https://cve.now/CVE-2017-10864.md): Untrusted search path vulnerability in Installer of HIBUN Confidential File Viewer prior to 11.20.0001 allows an attacker to gain privileges (no CVSS, Hitachi Solutions Installer of HIBUN Confidential File View…)
- [CVE-2017-10865](https://cve.now/CVE-2017-10865.md): Untrusted search path vulnerability in HIBUN Confidential File Decryption program prior to 10.50.0.5 allows an attacker to gain privileges v (no CVSS, Hitachi Solutions HIBUN Confidential File Decryption program)
- [CVE-2017-9514](https://cve.now/CVE-2017-9514.md): Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restric (no CVSS, Atlassian Bamboo)
- [CVE-2017-15277](https://cve.now/CVE-2017-15277.md): ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file th (no CVSS)
- [CVE-2017-15278](https://cve.now/CVE-2017-15278.md): Cross-Site Scripting (XSS) was discovered in TeamPass before 2.1.27.9. (no CVSS, nilsteampassnet/teampass)
- [CVE-2017-15279](https://cve.now/CVE-2017-15279.md): Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS, UmbracoCMS.Web)
- [CVE-2017-15280](https://cve.now/CVE-2017-15280.md): XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the (no CVSS, UmbracoCms.Web)
- [CVE-2017-15281](https://cve.now/CVE-2017-15281.md): ReadPSDImage in coders/psd.c in ImageMagick 7.0.7-6 allows remote attackers to cause a denial of service (application crash) or possibly hav (no CVSS)
- [CVE-2017-15284](https://cve.now/CVE-2017-15284.md): Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicio (no CVSS, october/rain)
- [CVE-2017-15285](https://cve.now/CVE-2017-15285.md): X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. (no CVSS)
- [CVE-2017-15286](https://cve.now/CVE-2017-15286.md): SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where \`sqlite3\_step(pS (no CVSS)
- [CVE-2017-12192](https://cve.now/CVE-2017-12192.md): The keyctl\_read\_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properl (no CVSS)
- [CVE-2017-15274](https://cve.now/CVE-2017-15274.md): security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in conjunction with a nonzero length v (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-10-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.