CVEs published October 23, 2017
118 CVEs were published on October 23, 2017: 0 critical, 1 high.
- Published
- 118
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 0
- Unrated
- 116
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- APOGEE PXC and TALON TC BACnet Automation Controllers All v…
- 2
- Apache Software Foundation Apache Derby · org.apache.derby:…
- 1
- codem-transcode
- 1
- printer
- 1
- st
- 1
- Symantec Encryption Desktop
- 1
- Symantec Endpoint Encryption
- 1
- werkzeug
- 1
High 1
Medium, low and unrated 117
- CVE-2017-13682In Symantec Encryption Desktop before SED 10.4.1 MP2HF1, a kernel memory leak is a type of resource leak that can occur when a computer progSymantec Encryption Desktop
- CVE-2017-13683In Symantec Endpoint Encryption before SEE 11.1.3HF3, a kernel memory leak is a type of resource leak that can occur when a computer programSymantec Endpoint Encryption
- CVE-2011-2683reseed seeds random numbers from an insecure HTTP request to random.org during installation, which makes it easier for remote attackers to d
- CVE-2011-2684foo2zjs before 20110722dfsg-3ubuntu1 as packaged in Ubuntu, 20110722dfsg-1 as packaged in Debian unstable, and 20090908dfsg-5.1+squeeze0 as
- CVE-2011-4333Multiple cross-site scripting (XSS) vulnerabilities in LabWiki 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML
- CVE-2011-4334edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated users to upload arbitrar
- CVE-2012-4567Multiple cross-site scripting (XSS) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to inject arbitrary web
- CVE-2012-4568Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to hijack the aut
- CVE-2012-4569Multiple cross-site scripting (XSS) vulnerabilities in out/out.UsrMgr.php in LetoDMS (formerly MyDMS) before 3.3.9 allow remote attackers to
- CVE-2012-4570SQL injection vulnerability in LetoDMS_Core/Core/inc.ClassDMS.php in LetoDMS (formerly MyDMS) before 3.3.8 allows remote attackers to execut
- CVE-2013-7377The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POcodem-transcode
- CVE-2014-3741The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitprinter
- CVE-2014-3744Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (enst
- CVE-2015-2878Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication
- CVE-2015-5379Cross-site scripting (XSS) vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attacke
- CVE-2015-5532Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote att
- CVE-2015-5533SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated admini
- CVE-2015-6839The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physically proximate attac
- CVE-2017-13772Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated users to execute arb
- CVE-2017-15808In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.
- CVE-2017-15809In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag.
- CVE-2017-15810The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php.
- CVE-2017-15811The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admi
- CVE-2017-15812The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.
- CVE-2016-10516Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 werkzeug
- CVE-2010-2232In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file.Apache Software Foundation Apache Derby · org.apache.derby:…
- CVE-2017-14327Extreme EXOS 16.x, 21.x, and 22.x allows administrators to read arbitrary files.
- CVE-2017-14328Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to trigger a buffer overflow leading to a reboot.
- CVE-2017-14329Extreme EXOS 16.x, 21.x, and 22.x allows administrators to obtain a root shell via vectors involving an exsh debug shell.
- CVE-2017-14330Extreme EXOS 16.x, 21.x, and 22.x allows administrators to obtain a root shell via vectors involving a privileged process.
- CVE-2017-14331Extreme EXOS 16.x, 21.x, and 22.x allows administrators to bypass the "exsh restricted shell" protection mechanism and obtain an interactive
- CVE-2017-14332Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to hijack sessions by determining SessionID values.
- CVE-2017-15377In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic with a certain signatu
- CVE-2017-15378SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI).
- CVE-2017-15379An authentication bypass exists in the E-Sic 1.0 /index (aka login) URI via '=''or' values for the username and password.
- CVE-2017-15380XSS exists in the E-Sic 1.0 /cadastro/index.php URI (aka the requester's registration area) via the nome parameter.
- CVE-2017-15381SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php (aka the zip code search script).
- CVE-2017-15567The certificate import component in IDEMIA (formerly Morpho) MorphoSmart 1300 Series (aka MSO 1300 Series) devices allows local users to obt
- CVE-2017-15580osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats.
- CVE-2017-15687DOM Based Cross Site Scripting (XSS) exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI.
- CVE-2017-15805Cisco Small Business SA520 and SA540 devices with firmware 2.1.71 and 2.2.0.7 allow ../ directory traversal in scgi-bin/platform.cgi via the
- CVE-2017-12796The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenti
- CVE-2017-7072An issue was discovered in certain Apple products.
- CVE-2017-7074An issue was discovered in certain Apple products.
- CVE-2017-7076An issue was discovered in certain Apple products.
- CVE-2017-7077An issue was discovered in certain Apple products.
- CVE-2017-7078An issue was discovered in certain Apple products.
- CVE-2017-7079An issue was discovered in certain Apple products.
- CVE-2017-7080An issue was discovered in certain Apple products.
- CVE-2017-7081An issue was discovered in certain Apple products.
- CVE-2017-7082An issue was discovered in certain Apple products.
- CVE-2017-7083An issue was discovered in certain Apple products.
- CVE-2017-7084An issue was discovered in certain Apple products.
- CVE-2017-7085An issue was discovered in certain Apple products.
- CVE-2017-7086An issue was discovered in certain Apple products.
- CVE-2017-7087An issue was discovered in certain Apple products.
- CVE-2017-7088An issue was discovered in certain Apple products.
- CVE-2017-7089An issue was discovered in certain Apple products.
- CVE-2017-7090An issue was discovered in certain Apple products.
- CVE-2017-7091An issue was discovered in certain Apple products.
- CVE-2017-7092An issue was discovered in certain Apple products.
- CVE-2017-7093An issue was discovered in certain Apple products.
- CVE-2017-7094An issue was discovered in certain Apple products.
- CVE-2017-7095An issue was discovered in certain Apple products.
- CVE-2017-7096An issue was discovered in certain Apple products.
- CVE-2017-7097An issue was discovered in certain Apple products.
- CVE-2017-7098An issue was discovered in certain Apple products.
- CVE-2017-7099An issue was discovered in certain Apple products.
- CVE-2017-7100An issue was discovered in certain Apple products.
- CVE-2017-7102An issue was discovered in certain Apple products.
- CVE-2017-7103An issue was discovered in certain Apple products.
- CVE-2017-7104An issue was discovered in certain Apple products.
- CVE-2017-7105An issue was discovered in certain Apple products.
- CVE-2017-7106An issue was discovered in certain Apple products.
- CVE-2017-7107An issue was discovered in certain Apple products.
- CVE-2017-7108An issue was discovered in certain Apple products.
- CVE-2017-7109An issue was discovered in certain Apple products.
- CVE-2017-7110An issue was discovered in certain Apple products.
- CVE-2017-7111An issue was discovered in certain Apple products.
- CVE-2017-7112An issue was discovered in certain Apple products.
- CVE-2017-7114An issue was discovered in certain Apple products.
- CVE-2017-7115An issue was discovered in certain Apple products.
- CVE-2017-7116An issue was discovered in certain Apple products.
- CVE-2017-7117An issue was discovered in certain Apple products.
- CVE-2017-7118An issue was discovered in certain Apple products.
- CVE-2017-7119An issue was discovered in certain Apple products.
- CVE-2017-7120An issue was discovered in certain Apple products.
- CVE-2017-7121An issue was discovered in certain Apple products.
- CVE-2017-7122An issue was discovered in certain Apple products.
- CVE-2017-7123An issue was discovered in certain Apple products.
- CVE-2017-7124An issue was discovered in certain Apple products.
- CVE-2017-7125An issue was discovered in certain Apple products.
- CVE-2017-7126An issue was discovered in certain Apple products.
- CVE-2017-7127An issue was discovered in certain Apple products.
- CVE-2017-7128An issue was discovered in certain Apple products.
- CVE-2017-7129An issue was discovered in certain Apple products.
- CVE-2017-7130An issue was discovered in certain Apple products.
- CVE-2017-7131An issue was discovered in certain Apple products.
- CVE-2017-7133An issue was discovered in certain Apple products.
- CVE-2017-7134An issue was discovered in certain Apple products.
- CVE-2017-7135An issue was discovered in certain Apple products.
- CVE-2017-7136An issue was discovered in certain Apple products.
- CVE-2017-7137An issue was discovered in certain Apple products.
- CVE-2017-7138An issue was discovered in certain Apple products.
- CVE-2017-7139An issue was discovered in certain Apple products.
- CVE-2017-7140An issue was discovered in certain Apple products.
- CVE-2017-7141An issue was discovered in certain Apple products.
- CVE-2017-7142An issue was discovered in certain Apple products.
- CVE-2017-7143An issue was discovered in certain Apple products.
- CVE-2017-7144An issue was discovered in certain Apple products.
- CVE-2017-7145An issue was discovered in certain Apple products.
- CVE-2017-7146An issue was discovered in certain Apple products.
- CVE-2017-7147An issue was discovered in certain Apple products.
- CVE-2017-7148An issue was discovered in certain Apple products.
- CVE-2017-7149An issue was discovered in certain Apple products.
- CVE-2017-7150An issue was discovered in certain Apple products.
- CVE-2017-9947A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5.APOGEE PXC and TALON TC BACnet Automation Controllers All v…