# CVEs published 2017-10-24

34 CVEs were published on October 24, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-15880](https://cve.now/CVE-2017-15880.md): SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators t (no CVSS)
- [CVE-2017-15881](https://cve.now/CVE-2017-15881.md): Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web scri (no CVSS, keystone)
- [CVE-2016-3049](https://cve.now/CVE-2016-3049.md): IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. (no CVSS)
- [CVE-2017-1209](https://cve.now/CVE-2017-1209.md): IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to cross-site scripting. (no CVSS, IBM Daeja ViewONE)
- [CVE-2017-1210](https://cve.now/CVE-2017-1210.md): IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could allow an unauthenticated attacker to inject data into log files m (no CVSS, IBM Daeja ViewONE)
- [CVE-2017-1211](https://cve.now/CVE-2017-1211.md): IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could disclose sensitive information to a local user when logging is en (no CVSS, IBM Daeja ViewONE)
- [CVE-2017-1212](https://cve.now/CVE-2017-1212.md): IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to a denial of service when viewing or opening a large fi (no CVSS, IBM Daeja ViewONE)
- [CVE-2017-1375](https://cve.now/CVE-2017-1375.md): IBM System Storage Storwize V7000 Unified (V7000U) 1.5 and 1.6 uses weaker than expected cryptographic algorithms that could allow an attack (no CVSS)
- [CVE-2017-1523](https://cve.now/CVE-2017-1523.md): IBM InfoSphere Master Data Management - Collaborative Edition 11.5 could allow an unauthorized user to download reports without authenticati (no CVSS)
- [CVE-2017-1583](https://cve.now/CVE-2017-1583.md): IBM WebSphere Application Server (IBM Liberty for Java for Bluemix 3.13)could allow a remote attacker to obtain sensitive information caused (no CVSS, IBM Liberty for Java for Bluemix)
- [CVE-2017-15878](https://cve.now/CVE-2017-15878.md): A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact (no CVSS, keystone)
- [CVE-2017-15879](https://cve.now/CVE-2017-15879.md): CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in Keystone (no CVSS, keystone)
- [CVE-2017-15871](https://cve.now/CVE-2017-15871.md): The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately (no CVSS)
- [CVE-2017-15872](https://cve.now/CVE-2017-15872.md): phpwcms 1.8.9 has XSS in include/inc\_tmpl/admin.edituser.tmpl.php and include/inc\_tmpl/admin.newuser.tmpl.php via the username (aka new\_logi (no CVSS)
- [CVE-2017-15873](https://cve.now/CVE-2017-15873.md): The get\_next\_block function in archival/libarchive/decompress\_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write a (CVSS 5.5)
- [CVE-2017-15874](https://cve.now/CVE-2017-15874.md): archival/libarchive/decompress\_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation. (CVSS 5.0)
- [CVE-2017-15867](https://cve.now/CVE-2017-15867.md): Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to i (no CVSS)
- [CVE-2016-10517](https://cve.now/CVE-2016-10517.md): networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not vali (no CVSS)
- [CVE-2017-15863](https://cve.now/CVE-2017-15863.md): Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/ (no CVSS)
- [CVE-2015-5170](https://cve.now/CVE-2015-5170.md): Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote att (no CVSS, org.cloudfoundry.identity:cloudfoundry-identity-server)
- [CVE-2015-5171](https://cve.now/CVE-2015-5171.md): The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic (no CVSS, org.cloudfoundry.identity:cloudfoundry-identity-server)
- [CVE-2015-5172](https://cve.now/CVE-2015-5172.md): Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers (no CVSS, org.cloudfoundry.identity:cloudfoundry-identity-server)
- [CVE-2015-5173](https://cve.now/CVE-2015-5173.md): Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers (no CVSS)
- [CVE-2017-14695](https://cve.now/CVE-2017-14695.md): Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before (no CVSS, salt)
- [CVE-2017-14696](https://cve.now/CVE-2017-14696.md): SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of servic (no CVSS, salt)
- [CVE-2017-15186](https://cve.now/CVE-2017-15186.md): Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file. (no CVSS)
- [CVE-2017-15222](https://cve.now/CVE-2017-15222.md): Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code. (no CVSS)
- [CVE-2017-15223](https://cve.now/CVE-2017-15223.md): Denial-of-service vulnerability in ArGoSoft Mini Mail Server 1.0.0.2 and earlier allows remote attackers to waste CPU resources (memory cons (no CVSS)
- [CVE-2013-3734](https://cve.now/CVE-2013-3734.md): The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which migh (no CVSS)
- [CVE-2014-0691](https://cve.now/CVE-2014-0691.md): Cisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy, which makes it easier for remote attackers to bypass auth (no CVSS)
- [CVE-2014-1203](https://cve.now/CVE-2014-1203.md): The get\_login\_ip\_config\_file function in Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacha (no CVSS)
- [CVE-2017-15081](https://cve.now/CVE-2017-15081.md): In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php. (no CVSS)
- [CVE-2017-12613](https://cve.now/CVE-2017-12613.md): When apr\_time\_exp\*() or apr\_os\_exp\_time\*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and (no CVSS, Apache Software Foundation Apache Portable Runtime)
- [CVE-2017-12618](https://cve.now/CVE-2017-12618.md): Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr\_sdbm\*() functio (no CVSS, Apache Software Foundation Apache Portable Runtime)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-10-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.