CVEs published October 17, 2017
41 CVEs were published on October 17, 2017: 0 critical, 1 high.
- Published
- 41
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 40
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Wi-Fi Alliance Wi-Fi Protected Access
- 9
- ProMinent MultiFLEX M10a Controller
- 5
- Lenovo Group Service Framework application
- 4
- Debian ftpsync before
- 1
- Envitech Ltd. EnviDAS Ultimate
- 1
- gollum · gollum-lib
- 1
- Nvidia Jetson
- 1
- TIBCO Software TIBCO Managed File Transfer Command Center ·…
- 1
- WECON Technology Co., Ltd. LeviStudio HMI Editor
- 1
High 1
Medium, low and unrated 40
- CVE-2017-13999A Stack-based Buffer Overflow issue was discovered in WECON LEVI Studio HMI Editor v1.8.1 and prior.WECON Technology Co., Ltd. LeviStudio HMI Editor
- CVE-2017-14005An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface.ProMinent MultiFLEX M10a Controller
- CVE-2017-14007An Insufficient Session Expiration issue was discovered in ProMinent MultiFLEX M10a Controller web interface.ProMinent MultiFLEX M10a Controller
- CVE-2017-14009An Information Exposure issue was discovered in ProMinent MultiFLEX M10a Controller web interface.ProMinent MultiFLEX M10a Controller
- CVE-2017-14011A Cross-Site Request Forgery issue was discovered in ProMinent MultiFLEX M10a Controller web interface.ProMinent MultiFLEX M10a Controller
- CVE-2017-14013A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface.ProMinent MultiFLEX M10a Controller
- CVE-2017-15565In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF docume
- CVE-2017-9625An Improper Authentication issue was discovered in Envitech EnviDAS Ultimate Versions prior to v1.0.0.5.Envitech Ltd. EnviDAS Ultimate
- CVE-2017-15539SQL Injection exists in zorovavi/blog through 2017-10-17 via the id parameter to recept.php.
- CVE-2017-15538Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject
- CVE-2017-3758Improper access controls on several Android components in the Lenovo Service Framework application can be exploited to enable remote code exLenovo Group Service Framework application
- CVE-2017-3759The Lenovo Service Framework Android application accepts some responses from the server without proper validation.Lenovo Group Service Framework application
- CVE-2017-3760The Lenovo Service Framework Android application uses a set of nonsecure credentials when performing integrity verification of downloaded apLenovo Group Service Framework application
- CVE-2017-3761The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input.Lenovo Group Service Framework application
- CVE-2017-6273NVIDIA ADSP Firmware contains a vulnerability in the ADSP Loader component where there is the potential to write to a memory location that iNvidia Jetson
- CVE-2017-15537The x86/fpu (Floating Point Unit) subsystem in the Linux kernel before 4.13.5, when a processor supports the xsave feature but not the xsave
- CVE-2017-8805Debian ftpsync before 20171017 does not use the rsync --safe-links option, which allows remote attackers to conduct directory traversal attaDebian ftpsync before
- CVE-2014-8357backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows re
- CVE-2014-9118The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metac
- CVE-2015-7806Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allo
- CVE-2014-2277The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbit
- CVE-2014-2664Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in
- CVE-2014-8323buddy-ng.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a
- CVE-2014-8324network.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a c
- CVE-2014-9487The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial o
- CVE-2014-9489The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the strgollum · gollum-lib
- CVE-2014-9677Cross-site scripting (XSS) vulnerability in FlexPaperViewer.swf in Flexpaper before 2.3.1 allows remote attackers to inject arbitrary web sc
- CVE-2014-9678FlexPaperViewer.swf in Flexpaper before 2.3.1 allows remote attackers to conduct content-spoofing attacks via the Swfile parameter.
- CVE-2014-9697Huawei USG9560/9520/9580 before V300R001C01SPC300 allows remote attackers to cause a memory leak or denial of service (memory exhaustion, re
- CVE-2014-9733nw.js before 0.11.5 can simulate user input events in a normal frame, which allows remote attackers to have unspecified impact via unknown v
- CVE-2017-13078Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacWi-Fi Alliance Wi-Fi Protected Access
- CVE-2017-13079Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during theWi-Fi Alliance Wi-Fi Protected Access
- CVE-2017-13080Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attaWi-Fi Alliance Wi-Fi Protected Access
- CVE-2017-13081Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during theWi-Fi Alliance Wi-Fi Protected Access
- CVE-2017-13082Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK)Wi-Fi Alliance Wi-Fi Protected Access
- CVE-2017-13084Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey hanWi-Fi Alliance Wi-Fi Protected Access
- CVE-2017-13086Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshakWi-Fi Alliance Wi-Fi Protected Access
- CVE-2017-13087Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless
- CVE-2017-13088Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing Wi-Fi Alliance Wi-Fi Protected Access
- CVE-2017-13077Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshWi-Fi Alliance Wi-Fi Protected Access