# CVEs published 2017-10-17

41 CVEs were published on October 17, 2017: 0 critical, 1 high. Days are UTC.

- [CVE-2017-13999](https://cve.now/CVE-2017-13999.md): A Stack-based Buffer Overflow issue was discovered in WECON LEVI Studio HMI Editor v1.8.1 and prior. (no CVSS, WECON Technology Co., Ltd. LeviStudio HMI Editor)
- [CVE-2017-14005](https://cve.now/CVE-2017-14005.md): An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. (no CVSS, ProMinent MultiFLEX M10a Controller)
- [CVE-2017-14007](https://cve.now/CVE-2017-14007.md): An Insufficient Session Expiration issue was discovered in ProMinent MultiFLEX M10a Controller web interface. (no CVSS, ProMinent MultiFLEX M10a Controller)
- [CVE-2017-14009](https://cve.now/CVE-2017-14009.md): An Information Exposure issue was discovered in ProMinent MultiFLEX M10a Controller web interface. (no CVSS, ProMinent MultiFLEX M10a Controller)
- [CVE-2017-14011](https://cve.now/CVE-2017-14011.md): A Cross-Site Request Forgery issue was discovered in ProMinent MultiFLEX M10a Controller web interface. (no CVSS, ProMinent MultiFLEX M10a Controller)
- [CVE-2017-14013](https://cve.now/CVE-2017-14013.md): A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface. (no CVSS, ProMinent MultiFLEX M10a Controller)
- [CVE-2017-15565](https://cve.now/CVE-2017-15565.md): In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF docume (no CVSS)
- [CVE-2017-9625](https://cve.now/CVE-2017-9625.md): An Improper Authentication issue was discovered in Envitech EnviDAS Ultimate Versions prior to v1.0.0.5. (no CVSS, Envitech Ltd. EnviDAS Ultimate)
- [CVE-2017-15539](https://cve.now/CVE-2017-15539.md): SQL Injection exists in zorovavi/blog through 2017-10-17 via the id parameter to recept.php. (no CVSS)
- [CVE-2017-15538](https://cve.now/CVE-2017-15538.md): Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject (no CVSS)
- [CVE-2017-3758](https://cve.now/CVE-2017-3758.md): Improper access controls on several Android components in the Lenovo Service Framework application can be exploited to enable remote code ex (no CVSS, Lenovo Group Service Framework application)
- [CVE-2017-3759](https://cve.now/CVE-2017-3759.md): The Lenovo Service Framework Android application accepts some responses from the server without proper validation. (no CVSS, Lenovo Group Service Framework application)
- [CVE-2017-3760](https://cve.now/CVE-2017-3760.md): The Lenovo Service Framework Android application uses a set of nonsecure credentials when performing integrity verification of downloaded ap (no CVSS, Lenovo Group Service Framework application)
- [CVE-2017-3761](https://cve.now/CVE-2017-3761.md): The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. (no CVSS, Lenovo Group Service Framework application)
- [CVE-2017-5531](https://cve.now/CVE-2017-5531.md): Deployments of TIBCO Managed File Transfer Command Center versions 8.0.0 and 8.0.1 and TIBCO Managed File Transfer Internet Server versions (CVSS 8.0, TIBCO Software TIBCO Managed File Transfer Command Center ·…)
- [CVE-2017-6273](https://cve.now/CVE-2017-6273.md): NVIDIA ADSP Firmware contains a vulnerability in the ADSP Loader component where there is the potential to write to a memory location that i (no CVSS, Nvidia Jetson)
- [CVE-2017-15537](https://cve.now/CVE-2017-15537.md): The x86/fpu (Floating Point Unit) subsystem in the Linux kernel before 4.13.5, when a processor supports the xsave feature but not the xsave (no CVSS)
- [CVE-2017-8805](https://cve.now/CVE-2017-8805.md): Debian ftpsync before 20171017 does not use the rsync --safe-links option, which allows remote attackers to conduct directory traversal atta (no CVSS, Debian ftpsync before)
- [CVE-2014-8357](https://cve.now/CVE-2014-8357.md): backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows re (no CVSS)
- [CVE-2014-9118](https://cve.now/CVE-2014-9118.md): The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metac (no CVSS)
- [CVE-2015-7806](https://cve.now/CVE-2015-7806.md): Eval injection vulnerability in the fm\_saveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allo (no CVSS)
- [CVE-2014-2277](https://cve.now/CVE-2014-2277.md): The make\_temporary\_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbit (no CVSS)
- [CVE-2014-2664](https://cve.now/CVE-2014-2664.md): Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in (no CVSS)
- [CVE-2014-8323](https://cve.now/CVE-2014-8323.md): buddy-ng.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a (no CVSS)
- [CVE-2014-8324](https://cve.now/CVE-2014-8324.md): network.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a c (no CVSS)
- [CVE-2014-9487](https://cve.now/CVE-2014-9487.md): The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial o (no CVSS)
- [CVE-2014-9489](https://cve.now/CVE-2014-9489.md): The gollum-grit\_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the str (no CVSS, gollum · gollum-lib)
- [CVE-2014-9677](https://cve.now/CVE-2014-9677.md): Cross-site scripting (XSS) vulnerability in FlexPaperViewer.swf in Flexpaper before 2.3.1 allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2014-9678](https://cve.now/CVE-2014-9678.md): FlexPaperViewer.swf in Flexpaper before 2.3.1 allows remote attackers to conduct content-spoofing attacks via the Swfile parameter. (no CVSS)
- [CVE-2014-9697](https://cve.now/CVE-2014-9697.md): Huawei USG9560/9520/9580 before V300R001C01SPC300 allows remote attackers to cause a memory leak or denial of service (memory exhaustion, re (no CVSS)
- [CVE-2014-9733](https://cve.now/CVE-2014-9733.md): nw.js before 0.11.5 can simulate user input events in a normal frame, which allows remote attackers to have unspecified impact via unknown v (no CVSS)
- [CVE-2017-13078](https://cve.now/CVE-2017-13078.md): Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attac (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13079](https://cve.now/CVE-2017-13079.md): Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13080](https://cve.now/CVE-2017-13080.md): Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an atta (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13081](https://cve.now/CVE-2017-13081.md): Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13082](https://cve.now/CVE-2017-13082.md): Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13084](https://cve.now/CVE-2017-13084.md): Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey han (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13086](https://cve.now/CVE-2017-13086.md): Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshak (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13087](https://cve.now/CVE-2017-13087.md): Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless (no CVSS)
- [CVE-2017-13088](https://cve.now/CVE-2017-13088.md): Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)
- [CVE-2017-13077](https://cve.now/CVE-2017-13077.md): Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handsh (no CVSS, Wi-Fi Alliance Wi-Fi Protected Access)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-10-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.