# CVEs published 2017-10-28

8 CVEs were published on October 28, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-15953](https://cve.now/CVE-2017-15953.md): bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE (.cue (no CVSS)
- [CVE-2017-15954](https://cve.now/CVE-2017-15954.md): bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow (with a resultant invalid free) and crash when (no CVSS)
- [CVE-2017-15955](https://cve.now/CVE-2017-15955.md): bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to an "Access violation near NULL on destination operand" and crash when proces (no CVSS)
- [CVE-2017-15951](https://cve.now/CVE-2017-15951.md): The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the "ne (no CVSS)
- [CVE-2017-15946](https://cve.now/CVE-2017-15946.md): In the com\_tag component 1.7.6 for Joomla!, a SQL injection vulnerability is located in the \`tag\` parameter to index.php. (no CVSS)
- [CVE-2017-15947](https://cve.now/CVE-2017-15947.md): Simple ASC Content Management System v1.2 has XSS in the location field in the sign function, related to guestbook.asp, formgb.asp, and msgg (no CVSS)
- [CVE-2017-15948](https://cve.now/CVE-2017-15948.md): Perch Content Management System 3.0.3 allows unrestricted file upload (with resultant XSS) via the Asset Title field in conjunction with the (no CVSS)
- [CVE-2017-15949](https://cve.now/CVE-2017-15949.md): Xavier PHP Management Panel 2.4 allows SQL injection via the usertoedit parameter to admin/adminuseredit.php or the log\_id parameter to admi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-10-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.