CVEs published October 16, 2017
43 CVEs were published on October 16, 2017: 0 critical, 0 high.
- Published
- 43
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 43
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- BlackBerry Workspaces Server
- 2
- Apache Software Foundation Apache Subversion
- 1
- Nvidia GeForce Experience
- 1
- org.apache.struts:struts2-core
- 1
- shopware/shopware
- 1
Medium, low and unrated 43
- CVE-2017-15385The store_versioninfo_gnu_verdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service
- CVE-2017-0316In GeForce Experience (GFE) 3.x before 3.10.0.55, NVIDIA Installer Framework contains a vulnerability in NVISystemService64 where a value paNvidia GeForce Experience
- CVE-2017-9367A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute or upload arbitrary fBlackBerry Workspaces Server
- CVE-2017-9368An information disclosure vulnerability in the BlackBerry Workspaces Server could result in an attacker gaining access to source code for seBlackBerry Workspaces Server
- CVE-2015-7504Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of servi
- CVE-2014-0208Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated use
- CVE-2015-2780Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with
- CVE-2015-3229fedora-cloud-atomic.ks in spin-kickstarts allows remote attackers to conduct man-in-the-middle attacks by leveraging use of HTTP to download
- CVE-2015-4650Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access and execute arbitra
- CVE-2015-7687Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary cod
- CVE-2017-15221ASX to MP3 converter 3.1.3.7.2010.11.05 has a buffer overflow via a crafted M3U file, a related issue to CVE-2009-1324.
- CVE-2017-15265Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or p
- CVE-2017-15289The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service (out-of-
- CVE-2017-15361The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, befor
- CVE-2017-15383Nero 7.10.1.0 has an unquoted BINARY_PATH_NAME for NBService, exploitable via a Trojan horse Nero.exe file in the %PROGRAMFILES(x86)%\Nero d
- CVE-2017-15384rate-me.php in Rate Me 1.0 has XSS via the id field in a rate action.
- CVE-2016-4461Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced doubleorg.apache.struts:struts2-core
- CVE-2017-14952Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arb
- CVE-2017-15293Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal read operations, or c
- CVE-2017-15294The Java administration console in SAP CRM has XSS.
- CVE-2017-15295Xpress Server in SAP POS does not require authentication for read/write/delete file access.
- CVE-2017-15296The Java component in SAP CRM has CSRF.
- CVE-2017-15297SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint.
- CVE-2014-3702Directory traversal vulnerability in eNovance eDeploy allows remote attackers to create arbitrary directories and files and consequently cau
- CVE-2014-7851oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users wi
- CVE-2014-8087Cross-site scripting (XSS) vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrar
- CVE-2014-8621SQL injection vulnerability in the Store Locator plugin 2.3 through 3.11 for WordPress allows remote attackers to execute arbitrary SQL comm
- CVE-2014-9147Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/.
- CVE-2014-9148Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super
- CVE-2014-0029Multiple cross-site scripting (XSS) vulnerabilities in the SAM web application in Red Hat katello-headpin allow remote attackers to inject a
- CVE-2016-8734Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-serviApache Software Foundation Apache Subversion
- CVE-2017-15370There is a heap-based buffer overflow in the ImaExpandS function of ima_rw.c in Sound eXchange (SoX) 14.4.2.
- CVE-2017-15371There is a reachable assertion abort in the function sox_append_comment() in formats.c in Sound eXchange (SoX) 14.4.2.
- CVE-2017-15372There is a stack-based buffer overflow in the lsx_ms_adpcm_block_expand_i function of adpcm.c in Sound eXchange (SoX) 14.4.2.
- CVE-2017-15373E-Sic 1.0 allows SQL injection via the q parameter to esiclivre/restrito/inc/lkpcep.php (aka the search private area).
- CVE-2017-15374Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modushopware/shopware
- CVE-2017-15375Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress.
- CVE-2017-15376The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which allows remote attackers to execute arbitrary commands vi
- CVE-2017-15302In CPUID CPU-Z through 1.81, there are improper access rights to a kernel-mode driver (e.g., cpuz143_x64.sys for version 1.43) that can resu
- CVE-2017-15303In CPUID CPU-Z before 1.43, there is an arbitrary memory write that results directly in elevation of privileges, because any program running
- CVE-2017-15362osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link,
- CVE-2017-15368The wasm_dis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service (stack-based buffer
- CVE-2017-15369The build_filter_chain function in pdf/pdf-stream.c in Artifex MuPDF before 2017-09-25 mishandles a certain case where a variable may reside