CVEs published October 26, 2017
31 CVEs were published on October 26, 2017: 0 critical, 0 high.
- Published
- 31
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Red Hat keycloak · org.keycloak:keycloak-parent
- 3
- Lenovo Group E95, ThinkCentre M710s/M710t
- 1
- org.igniterealtime.openfire:parent
- 1
- Red Hat GlusterFS
- 1
Medium, low and unrated 31
- CVE-2017-1220IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) discloses sensitive information to unauthorized users.
- CVE-2017-1222IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) does not perform an authentication check for a critical resource or functional
- CVE-2017-1225IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) stores sensitive information in URL parameters.
- CVE-2017-1226IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) generates an error message in error logs that includes sensitive information a
- CVE-2017-1228IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) could allow a remote attacker to obtain sensitive information, caused by the f
- CVE-2017-1230IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) uses insufficiently random numbers or values in a security context that depend
- CVE-2017-1232IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) transmits sensitive or security-critical data in cleartext in a communication
- CVE-2017-1521IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications (IBM BigFix Platform 9.2 and 9.5) is vulnerable to cross-s
- CVE-2012-1622Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors.
- CVE-2012-4377Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web
- CVE-2012-4378Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets
- CVE-2014-2023Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers t
- CVE-2017-15366Before Thornberry NDoc version 8.0, laptop clients and the server have default database (Cache) users set up with a single password.
- CVE-2017-15919The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin-
- CVE-2017-15922In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c.
- CVE-2017-5996The agent in Bomgar Remote Support 15.2.x before 15.2.3, 16.1.x before 16.1.5, and 16.2.x before 16.2.4 allows DLL hijacking because of weak
- CVE-2017-12158It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations.Red Hat keycloak · org.keycloak:keycloak-parent
- CVE-2017-12159It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session.Red Hat keycloak · org.keycloak:keycloak-parent
- CVE-2017-12160It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication serveRed Hat keycloak · org.keycloak:keycloak-parent
- CVE-2017-15096A flaw was found in GlusterFS in versions prior to 3.10.Red Hat GlusterFS
- CVE-2017-15911The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who clicorg.igniterealtime.openfire:parent
- CVE-2017-15917In Paessler PRTG Network Monitor 17.3.33.2830, it's possible to create a Map as a read-only user, by forging a request and sending it to the
- CVE-2017-3771System boot process is not adequately secured In Lenovo E95 and ThinkCentre M710s/M710t because systems were shipped from factory without coLenovo Group E95, ThinkCentre M710s/M710t
- CVE-2017-15908In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in th
- CVE-2017-7335A Cross-Site Scripting (XSS) vulnerability in Fortinet FortiWLC 6.1-x (6.1-2, 6.1-4 and 6.1-5); 7.0-x (7.0-7, 7.0-8, 7.0-9, 7.0-10); and 8.x
- CVE-2017-7341An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3
- CVE-2017-7732A reflected Cross-Site Scripting (XSS) vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 cus
- CVE-2017-15882The London Trust Media Private Internet Access (PIA) application before 1.3.3.1 for Android allows remote attackers to cause a denial of ser
- CVE-2017-15907SQL injection vulnerability in phpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to
- CVE-2017-15909D-Link DGS-1500 Ax devices before 2.51B021 have a hardcoded password, which allows remote attackers to obtain shell access.
- CVE-2017-15906The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows a