CVEs published October 29, 2017
30 CVEs were published on October 29, 2017: 0 critical, 0 high.
- Published
- 30
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- dulwich
- 1
Medium, low and unrated 30
- CVE-2017-16227The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via
- CVE-2017-16228Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dulwich
- CVE-2017-15996elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly hav
- CVE-2017-15997In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password locally stored in shar
- CVE-2017-15998In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact da
- CVE-2017-15999In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data.
- CVE-2017-16000SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbi
- CVE-2006-5331The altivec_unavailable_exception function in arch/powerpc/kernel/traps.c in the Linux kernel before 2.6.19 on 64-bit systems mishandles the
- CVE-2017-15956ConverTo Video Downloader & Converter 1.4.1 allows Arbitrary File Download via the token parameter to download.php.
- CVE-2017-15957my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.
- CVE-2017-15958D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.
- CVE-2017-15959Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-2007-6576.
- CVE-2017-15960Article Directory Script 3.0 allows SQL Injection via the id parameter to author.php or category.php.
- CVE-2017-15961iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php.
- CVE-2017-15962iStock Management System 1.0 allows Arbitrary File Upload via user/profile.
- CVE-2017-15963iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser parameter.
- CVE-2017-15964Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.
- CVE-2017-15965The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in an invoice.create ac
- CVE-2017-15966The Zh YandexMap (aka com_zhyandexmap) component 6.1.1.0 for Joomla! allows SQL Injection via the placemarklistid parameter to index.php.
- CVE-2017-15967Mailing List Manager Pro 3.0 allows SQL Injection via the edit parameter to admin/users in a sort=login action, or the edit parameter to adm
- CVE-2017-15968MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter.
- CVE-2017-15969PG All Share Video 1.0 allows SQL Injection via the PATH_INFO to search/tag, friends/index, users/profile, or video_catalog/category.
- CVE-2017-15970PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.
- CVE-2017-15971Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sender_id parameter, or
- CVE-2017-15972SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sender_id parameter
- CVE-2017-15973Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view.php.
- CVE-2017-15974tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.
- CVE-2017-15975Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability than CVE-2008-4461.
- CVE-2017-15976ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-2008-3604.
- CVE-2017-15994rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access