CVEs published October 24, 2017
34 CVEs were published on October 24, 2017: 0 critical, 0 high.
- Published
- 34
- Critical
- 0
- High
- 0
- Medium
- 2
- Low
- 0
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- IBM Daeja ViewONE
- 4
- keystone
- 3
- org.cloudfoundry.identity:cloudfoundry-identity-server
- 3
- Apache Software Foundation Apache Portable Runtime
- 2
- salt
- 2
- IBM Liberty for Java for Bluemix
- 1
Medium, low and unrated 34
- CVE-2017-15880SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators t
- CVE-2017-15881Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web scrikeystone
- CVE-2016-3049IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection.
- CVE-2017-1209IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to cross-site scripting.IBM Daeja ViewONE
- CVE-2017-1210IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could allow an unauthenticated attacker to inject data into log files mIBM Daeja ViewONE
- CVE-2017-1211IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could disclose sensitive information to a local user when logging is enIBM Daeja ViewONE
- CVE-2017-1212IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to a denial of service when viewing or opening a large fiIBM Daeja ViewONE
- CVE-2017-1375IBM System Storage Storwize V7000 Unified (V7000U) 1.5 and 1.6 uses weaker than expected cryptographic algorithms that could allow an attack
- CVE-2017-1523IBM InfoSphere Master Data Management - Collaborative Edition 11.5 could allow an unauthorized user to download reports without authenticati
- CVE-2017-1583IBM WebSphere Application Server (IBM Liberty for Java for Bluemix 3.13)could allow a remote attacker to obtain sensitive information causedIBM Liberty for Java for Bluemix
- CVE-2017-15878A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contactkeystone
- CVE-2017-15879CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in Keystonekeystone
- CVE-2017-15871The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately
- CVE-2017-15872phpwcms 1.8.9 has XSS in include/inc_tmpl/admin.edituser.tmpl.php and include/inc_tmpl/admin.newuser.tmpl.php via the username (aka new_logi
- CVE-2017-15873The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write a
- CVE-2017-15874archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.
- CVE-2017-15867Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to i
- CVE-2016-10517networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not vali
- CVE-2017-15863Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/
- CVE-2015-5170Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attorg.cloudfoundry.identity:cloudfoundry-identity-server
- CVE-2015-5171The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic org.cloudfoundry.identity:cloudfoundry-identity-server
- CVE-2015-5172Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers org.cloudfoundry.identity:cloudfoundry-identity-server
- CVE-2015-5173Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers
- CVE-2017-14695Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x beforesalt
- CVE-2017-14696SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of servicsalt
- CVE-2017-15186Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file.
- CVE-2017-15222Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code.
- CVE-2017-15223Denial-of-service vulnerability in ArGoSoft Mini Mail Server 1.0.0.2 and earlier allows remote attackers to waste CPU resources (memory cons
- CVE-2013-3734The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which migh
- CVE-2014-0691Cisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy, which makes it easier for remote attackers to bypass auth
- CVE-2014-1203The get_login_ip_config_file function in Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacha
- CVE-2017-15081In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.
- CVE-2017-12613When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and Apache Software Foundation Apache Portable Runtime
- CVE-2017-12618Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functioApache Software Foundation Apache Portable Runtime