# CVEs published 2017-10-21

12 CVEs were published on October 21, 2017: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-12317](https://cve.now/CVE-2017-12317.md): The Cisco AMP For Endpoints application allows an authenticated, local attacker to access a static key value stored in the local application (no CVSS, Cisco AMP for Endpoints)
- [CVE-2017-15727](https://cve.now/CVE-2017-15727.md): In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment. (no CVSS)
- [CVE-2017-15728](https://cve.now/CVE-2017-15728.md): In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via metaDescription or metaKeywords. (no CVSS)
- [CVE-2017-15729](https://cve.now/CVE-2017-15729.md): In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for adding a glossary. (no CVSS)
- [CVE-2017-15730](https://cve.now/CVE-2017-15730.md): In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. (no CVSS)
- [CVE-2017-15731](https://cve.now/CVE-2017-15731.md): In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.adminlog.php. (no CVSS)
- [CVE-2017-15732](https://cve.now/CVE-2017-15732.md): In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/news.php. (no CVSS)
- [CVE-2017-15733](https://cve.now/CVE-2017-15733.md): In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/ajax.attachment.php and admin/att.main.php. (no CVSS)
- [CVE-2017-15734](https://cve.now/CVE-2017-15734.md): In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. (no CVSS)
- [CVE-2017-15735](https://cve.now/CVE-2017-15735.md): In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. (no CVSS)
- [CVE-2017-15736](https://cve.now/CVE-2017-15736.md): Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a (no CVSS)
- [CVE-2017-11292](https://cve.now/CVE-2017-11292.md): Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be us (CVSS 8.8, KEV, Adobe Flash Player)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-10-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.