# CVEs published 2017-10-18

54 CVEs were published on October 18, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-15600](https://cve.now/CVE-2017-15600.md): In GNU Libextractor 1.4, there is a NULL Pointer Dereference in the EXTRACTOR\_nsf\_extract\_method function of plugins/nsf\_extractor.c. (no CVSS)
- [CVE-2017-15601](https://cve.now/CVE-2017-15601.md): In GNU Libextractor 1.4, there is a heap-based buffer overflow in the EXTRACTOR\_png\_extract\_method function in plugins/png\_extractor.c, rela (no CVSS)
- [CVE-2017-15602](https://cve.now/CVE-2017-15602.md): In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR\_nsfe\_extract\_method function in plugins/ns (no CVSS)
- [CVE-2015-5227](https://cve.now/CVE-2015-5227.md): The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter. (no CVSS)
- [CVE-2015-5376](https://cve.now/CVE-2015-5376.md): SQL injection vulnerability in the login form in GSI WiNPAT Portal 3.2.0.1001 through 3.6.1.0 allows remote attackers to execute arbitrary S (no CVSS)
- [CVE-2015-5739](https://cve.now/CVE-2015-5739.md): The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers t (no CVSS, stdlib)
- [CVE-2015-5740](https://cve.now/CVE-2015-5740.md): The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to condu (no CVSS, stdlib)
- [CVE-2015-6961](https://cve.now/CVE-2015-6961.md): Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and conduct (no CVSS)
- [CVE-2015-7714](https://cve.now/CVE-2015-7714.md): Multiple SQL injection vulnerabilities in the Realtyna RPL (com\_rpl) component before 8.9.5 for Joomla! allow remote administrators to execu (no CVSS)
- [CVE-2015-7715](https://cve.now/CVE-2015-7715.md): Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com\_rpl) component before 8.9.5 for Joomla! allows remote attackers to (no CVSS)
- [CVE-2015-7943](https://cve.now/CVE-2015-7943.md): Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and (no CVSS)
- [CVE-2016-5714](https://cve.now/CVE-2016-5714.md): Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelis (no CVSS)
- [CVE-2017-14322](https://cve.now/CVE-2017-14322.md): The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remo (no CVSS)
- [CVE-2017-14956](https://cve.now/CVE-2017-14956.md): AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/ossim/report/wizard\_ (no CVSS)
- [CVE-2017-15359](https://cve.now/CVE-2017-15359.md): In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/a (no CVSS)
- [CVE-2015-1239](https://cve.now/CVE-2015-1239.md): Double free vulnerability in the j2k\_read\_ppm\_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attack (no CVSS)
- [CVE-2015-5164](https://cve.now/CVE-2015-5164.md): The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative (no CVSS)
- [CVE-2015-2156](https://cve.now/CVE-2015-2156.md): Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before (no CVSS, io.netty:netty-parent · org.jboss.netty:netty +1)
- [CVE-2015-3400](https://cve.now/CVE-2015-3400.md): sharenfs 0.6.4, when built with commits bcdd594 and 7d08880 from the zfs repository, provides world readable access to the shared zfs file s (no CVSS)
- [CVE-2017-8022](https://cve.now/CVE-2017-8022.md): An issue was discovered in EMC NetWorker (prior to 8.2.4.9, all supported 9.0.x versions, prior to 9.1.1.3, prior to 9.2.0.4). (no CVSS, EMC NetWorker prior to 8.2.4.9, 9.0.x (all supported versio…)
- [CVE-2011-5320](https://cve.now/CVE-2011-5320.md): scanf and related functions in glibc before 2.15 allow local users to cause a denial of service (segmentation fault) via a large string of 0 (no CVSS)
- [CVE-2014-3164](https://cve.now/CVE-2014-3164.md): cmds/servicemanager/service\_manager.c in Android before commit 7d42a3c31ba78a418f9bdde0e0ab951469f321b5 allows attackers to cause a denial o (no CVSS)
- [CVE-2014-3531](https://cve.now/CVE-2014-3531.md): Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web script (no CVSS)
- [CVE-2014-3706](https://cve.now/CVE-2014-3706.md): ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes i (no CVSS)
- [CVE-2014-3709](https://cve.now/CVE-2014-3709.md): The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct c (no CVSS, org.keycloak:keycloak-services)
- [CVE-2014-7242](https://cve.now/CVE-2014-7242.md): The SumaHo application 3.0.0 and earlier for Android and the SumaHo "driving capability" diagnosis result transmission application 1.2.2 and (no CVSS)
- [CVE-2014-7813](https://cve.now/CVE-2014-7813.md): Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vect (no CVSS)
- [CVE-2014-8491](https://cve.now/CVE-2014-8491.md): The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a request to (1) flagaller (no CVSS)
- [CVE-2017-13083](https://cve.now/CVE-2017-13083.md): Akeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over HTTP, allowing an att (CVSS 5.3, Akeo Consulting Rufus)
- [CVE-2017-8024](https://cve.now/CVE-2017-8024.md): EMC Isilon OneFS (versions prior to 8.1.0.1, versions prior to 8.0.1.2, versions prior to 8.0.0.6, version 7.2.1.x) is impacted by a reflect (no CVSS, EMC Isilon OneFS EMC Isilon OneFS versions prior to 8.1.0.1…)
- [CVE-2017-15583](https://cve.now/CVE-2017-15583.md): The embedded web server on ABB Fox515T 1.0 devices is vulnerable to Local File Inclusion. (no CVSS)
- [CVE-2017-15587](https://cve.now/CVE-2017-15587.md): An integer overflow was discovered in pdf\_read\_new\_xref\_section in pdf/pdf-xref.c in Artifex MuPDF 1.11. (no CVSS)
- [CVE-2017-15588](https://cve.now/CVE-2017-15588.md): An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condi (no CVSS)
- [CVE-2017-15589](https://cve.now/CVE-2017-15589.md): An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the host OS (or an arbitra (no CVSS)
- [CVE-2017-15590](https://cve.now/CVE-2017-15590.md): An issue was discovered in Xen through 4.9.x allowing x86 guest OS users to cause a denial of service (hypervisor crash) or possibly gain pr (no CVSS)
- [CVE-2017-15591](https://cve.now/CVE-2017-15591.md): An issue was discovered in Xen 4.5.x through 4.9.x allowing attackers (who control a stub domain kernel or tool stack) to cause a denial of (no CVSS)
- [CVE-2017-15592](https://cve.now/CVE-2017-15592.md): An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service (hypervisor crash) or possibly gai (no CVSS)
- [CVE-2017-15593](https://cve.now/CVE-2017-15593.md): An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (memory leak) because reference cou (no CVSS)
- [CVE-2017-15594](https://cve.now/CVE-2017-15594.md): An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service (hypervisor crash) or gain priv (no CVSS)
- [CVE-2017-15595](https://cve.now/CVE-2017-15595.md): An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recursion, stack consump (no CVSS)
- [CVE-2017-15596](https://cve.now/CVE-2017-15596.md): An issue was discovered in Xen 4.4.x through 4.9.x allowing ARM guest OS users to cause a denial of service (prevent physical CPU usage) bec (no CVSS)
- [CVE-2016-10515](https://cve.now/CVE-2016-10515.md): In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages. (no CVSS)
- [CVE-2017-15568](https://cve.now/CVE-2017-15568.md): In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application\_helper.rb via a multi-value field (no CVSS)
- [CVE-2017-15569](https://cve.now/CVE-2017-15569.md): In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries\_helper.rb via a multi-value field wit (no CVSS)
- [CVE-2017-15570](https://cve.now/CVE-2017-15570.md): In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/\_list.html.erb via crafted column data. (no CVSS)
- [CVE-2017-15571](https://cve.now/CVE-2017-15571.md): In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/\_list.html.erb via crafted column data. (no CVSS)
- [CVE-2017-15572](https://cve.now/CVE-2017-15572.md): In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Refer (no CVSS)
- [CVE-2017-15573](https://cve.now/CVE-2017-15573.md): In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content. (no CVSS)
- [CVE-2017-15574](https://cve.now/CVE-2017-15574.md): In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment. (no CVSS)
- [CVE-2017-15575](https://cve.now/CVE-2017-15575.md): In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's setting (no CVSS)
- [CVE-2017-15576](https://cve.now/CVE-2017-15576.md): Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensi (no CVSS)
- [CVE-2017-15577](https://cve.now/CVE-2017-15577.md): Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive inform (no CVSS)
- [CVE-2017-15578](https://cve.now/CVE-2017-15578.md): In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/edit\_category.php. (no CVSS)
- [CVE-2017-15579](https://cve.now/CVE-2017-15579.md): In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa\_pages\_per\_page cookie in a playlist action to watch.php. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-10-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.