# CVEs published 2017-10-29 30 CVEs were published on October 29, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-16227](https://cve.now/CVE-2017-16227.md): The aspath\_put function in bgpd/bgp\_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via (no CVSS) - [CVE-2017-16228](https://cve.now/CVE-2017-16228.md): Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial (no CVSS, dulwich) - [CVE-2017-15996](https://cve.now/CVE-2017-15996.md): elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly hav (no CVSS) - [CVE-2017-15997](https://cve.now/CVE-2017-15997.md): In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password locally stored in shar (no CVSS) - [CVE-2017-15998](https://cve.now/CVE-2017-15998.md): In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact da (no CVSS) - [CVE-2017-15999](https://cve.now/CVE-2017-15999.md): In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. (no CVSS) - [CVE-2017-16000](https://cve.now/CVE-2017-16000.md): SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbi (no CVSS) - [CVE-2006-5331](https://cve.now/CVE-2006-5331.md): The altivec\_unavailable\_exception function in arch/powerpc/kernel/traps.c in the Linux kernel before 2.6.19 on 64-bit systems mishandles the (no CVSS) - [CVE-2017-15956](https://cve.now/CVE-2017-15956.md): ConverTo Video Downloader & Converter 1.4.1 allows Arbitrary File Download via the token parameter to download.php. (no CVSS) - [CVE-2017-15957](https://cve.now/CVE-2017-15957.md): my\_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file. (no CVSS) - [CVE-2017-15958](https://cve.now/CVE-2017-15958.md): D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php. (no CVSS) - [CVE-2017-15959](https://cve.now/CVE-2017-15959.md): Adult Script Pro 2.2.4 allows SQL Injection via the PATH\_INFO to a /download URI, a different vulnerability than CVE-2007-6576. (no CVSS) - [CVE-2017-15960](https://cve.now/CVE-2017-15960.md): Article Directory Script 3.0 allows SQL Injection via the id parameter to author.php or category.php. (no CVSS) - [CVE-2017-15961](https://cve.now/CVE-2017-15961.md): iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php. (no CVSS) - [CVE-2017-15962](https://cve.now/CVE-2017-15962.md): iStock Management System 1.0 allows Arbitrary File Upload via user/profile. (no CVSS) - [CVE-2017-15963](https://cve.now/CVE-2017-15963.md): iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser parameter. (no CVSS) - [CVE-2017-15964](https://cve.now/CVE-2017-15964.md): Job Board Script Software allows SQL Injection via the PATH\_INFO to a /job-details URI. (no CVSS) - [CVE-2017-15965](https://cve.now/CVE-2017-15965.md): The NS Download Shop (aka com\_ns\_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in an invoice.create ac (no CVSS) - [CVE-2017-15966](https://cve.now/CVE-2017-15966.md): The Zh YandexMap (aka com\_zhyandexmap) component 6.1.1.0 for Joomla! allows SQL Injection via the placemarklistid parameter to index.php. (no CVSS) - [CVE-2017-15967](https://cve.now/CVE-2017-15967.md): Mailing List Manager Pro 3.0 allows SQL Injection via the edit parameter to admin/users in a sort=login action, or the edit parameter to adm (no CVSS) - [CVE-2017-15968](https://cve.now/CVE-2017-15968.md): MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch\_genxml.php subcategory parameter. (no CVSS) - [CVE-2017-15969](https://cve.now/CVE-2017-15969.md): PG All Share Video 1.0 allows SQL Injection via the PATH\_INFO to search/tag, friends/index, users/profile, or video\_catalog/category. (no CVSS) - [CVE-2017-15970](https://cve.now/CVE-2017-15970.md): PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter. (no CVSS) - [CVE-2017-15971](https://cve.now/CVE-2017-15971.md): Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sender\_id parameter, or (no CVSS) - [CVE-2017-15972](https://cve.now/CVE-2017-15972.md): SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sender\_id parameter (no CVSS) - [CVE-2017-15973](https://cve.now/CVE-2017-15973.md): Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members\_view.php. (no CVSS) - [CVE-2017-15974](https://cve.now/CVE-2017-15974.md): tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php. (no CVSS) - [CVE-2017-15975](https://cve.now/CVE-2017-15975.md): Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product\_id' to add\_to\_cart.php, a different vulnerability than CVE-2008-4461. (no CVSS) - [CVE-2017-15976](https://cve.now/CVE-2017-15976.md): ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-2008-3604. (no CVSS) - [CVE-2017-15994](https://cve.now/CVE-2017-15994.md): rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-10-29 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.