# CVEs published 2017-10-26

31 CVEs were published on October 26, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-1220](https://cve.now/CVE-2017-1220.md): IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) discloses sensitive information to unauthorized users. (no CVSS)
- [CVE-2017-1222](https://cve.now/CVE-2017-1222.md): IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) does not perform an authentication check for a critical resource or functional (no CVSS)
- [CVE-2017-1225](https://cve.now/CVE-2017-1225.md): IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) stores sensitive information in URL parameters. (no CVSS)
- [CVE-2017-1226](https://cve.now/CVE-2017-1226.md): IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) generates an error message in error logs that includes sensitive information a (no CVSS)
- [CVE-2017-1228](https://cve.now/CVE-2017-1228.md): IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) could allow a remote attacker to obtain sensitive information, caused by the f (no CVSS)
- [CVE-2017-1230](https://cve.now/CVE-2017-1230.md): IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) uses insufficiently random numbers or values in a security context that depend (no CVSS)
- [CVE-2017-1232](https://cve.now/CVE-2017-1232.md): IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) transmits sensitive or security-critical data in cleartext in a communication (no CVSS)
- [CVE-2017-1521](https://cve.now/CVE-2017-1521.md): IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications (IBM BigFix Platform 9.2 and 9.5) is vulnerable to cross-s (no CVSS)
- [CVE-2012-1622](https://cve.now/CVE-2012-1622.md): Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors. (no CVSS)
- [CVE-2012-4377](https://cve.now/CVE-2012-4377.md): Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2012-4378](https://cve.now/CVE-2012-4378.md): Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets (no CVSS)
- [CVE-2014-2023](https://cve.now/CVE-2014-2023.md): Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers t (no CVSS)
- [CVE-2017-15366](https://cve.now/CVE-2017-15366.md): Before Thornberry NDoc version 8.0, laptop clients and the server have default database (Cache) users set up with a single password. (no CVSS)
- [CVE-2017-15919](https://cve.now/CVE-2017-15919.md): The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin- (no CVSS)
- [CVE-2017-15922](https://cve.now/CVE-2017-15922.md): In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR\_dvi\_extract\_method function in plugins/dvi\_extractor.c. (no CVSS)
- [CVE-2017-5996](https://cve.now/CVE-2017-5996.md): The agent in Bomgar Remote Support 15.2.x before 15.2.3, 16.1.x before 16.1.5, and 16.2.x before 16.2.4 allows DLL hijacking because of weak (no CVSS)
- [CVE-2017-12158](https://cve.now/CVE-2017-12158.md): It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. (no CVSS, Red Hat keycloak · org.keycloak:keycloak-parent)
- [CVE-2017-12159](https://cve.now/CVE-2017-12159.md): It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. (no CVSS, Red Hat keycloak · org.keycloak:keycloak-parent)
- [CVE-2017-12160](https://cve.now/CVE-2017-12160.md): It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication serve (no CVSS, Red Hat keycloak · org.keycloak:keycloak-parent)
- [CVE-2017-15096](https://cve.now/CVE-2017-15096.md): A flaw was found in GlusterFS in versions prior to 3.10. (no CVSS, Red Hat GlusterFS)
- [CVE-2017-15911](https://cve.now/CVE-2017-15911.md): The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who clic (no CVSS, org.igniterealtime.openfire:parent)
- [CVE-2017-15917](https://cve.now/CVE-2017-15917.md): In Paessler PRTG Network Monitor 17.3.33.2830, it's possible to create a Map as a read-only user, by forging a request and sending it to the (no CVSS)
- [CVE-2017-3771](https://cve.now/CVE-2017-3771.md): System boot process is not adequately secured In Lenovo E95 and ThinkCentre M710s/M710t because systems were shipped from factory without co (no CVSS, Lenovo Group E95, ThinkCentre M710s/M710t)
- [CVE-2017-15908](https://cve.now/CVE-2017-15908.md): In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in th (no CVSS)
- [CVE-2017-7335](https://cve.now/CVE-2017-7335.md): A Cross-Site Scripting (XSS) vulnerability in Fortinet FortiWLC 6.1-x (6.1-2, 6.1-4 and 6.1-5); 7.0-x (7.0-7, 7.0-8, 7.0-9, 7.0-10); and 8.x (no CVSS)
- [CVE-2017-7341](https://cve.now/CVE-2017-7341.md): An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3 (no CVSS)
- [CVE-2017-7732](https://cve.now/CVE-2017-7732.md): A reflected Cross-Site Scripting (XSS) vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 cus (no CVSS)
- [CVE-2017-15882](https://cve.now/CVE-2017-15882.md): The London Trust Media Private Internet Access (PIA) application before 1.3.3.1 for Android allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2017-15907](https://cve.now/CVE-2017-15907.md): SQL injection vulnerability in phpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to (no CVSS)
- [CVE-2017-15909](https://cve.now/CVE-2017-15909.md): D-Link DGS-1500 Ax devices before 2.51B021 have a hardcoded password, which allows remote attackers to obtain shell access. (no CVSS)
- [CVE-2017-15906](https://cve.now/CVE-2017-15906.md): The process\_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows a (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-10-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.