CVEs published October 30, 2017
31 CVEs were published on October 30, 2017: 0 critical, 0 high.
- Published
- 31
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Oracle Identity Manager
- 1
- org.apache.hadoop:hadoop-client
- 1
- org.apache.httpcomponents:httpclient
- 1
- org.apache.storm:storm
- 1
- org.apache.struts:struts2-parent
- 1
- org.apache.wicket:wicket-core
- 1
- org.apache.ws.security:wss4j · org.apache.wss4j:wss4j-ws-se…
- 1
- Synology Audio Station
- 1
- xerces:xercesImpl
- 1
Medium, low and unrated 31
- CVE-2017-1000255On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn so that the kernel wi
- CVE-2017-10151Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account).Oracle Identity Manager
- CVE-2012-4449Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security feorg.apache.hadoop:hadoop-client
- CVE-2012-5636Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote
- CVE-2013-4366http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, whichorg.apache.httpcomponents:httpclient
- CVE-2014-0072ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the
- CVE-2014-0073The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and
- CVE-2017-14919Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and c
- CVE-2017-16230In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article c
- CVE-2017-15888Cross-site scripting (XSS) vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allows remote authenticatSynology Audio Station
- CVE-2009-1197Apache jUDDI before 2.0 allows attackers to spoof entries in log files via vectors related to error logging of keys from uddiget.jsp.
- CVE-2009-1198Cross-site scripting (XSS) vulnerability in Apache jUDDI before 2.0 allows remote attackers to inject arbitrary web script or HTML via the d
- CVE-2012-0881Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an xerces:xercesImpl
- CVE-2014-0115Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a ..org.apache.storm:storm
- CVE-2017-15920In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer dereference vulnera
- CVE-2017-15921In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer dereference vulnera
- CVE-2012-5357Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remot
- CVE-2012-5358The XSLTCompiledTransform function in Ektron Content Management System (CMS) before 8.02 SP5 configures the XSL with enableDocumentFunction
- CVE-2013-4246libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repos
- CVE-2014-3526Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vecorg.apache.wicket:wicket-core
- CVE-2014-3624Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel rema
- CVE-2015-0224qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence se
- CVE-2015-0226Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key ororg.apache.ws.security:wss4j · org.apache.wss4j:wss4j-ws-se…
- CVE-2015-3249The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bou
- CVE-2015-7549The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NU
- CVE-2016-3090The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a craftorg.apache.struts:struts2-parent
- CVE-2017-12460An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10.
- CVE-2017-15597An issue was discovered in Xen through 4.9.x.
- CVE-2017-7411An issue was discovered in Enalean Tuleap 9.6 and prior versions.
- CVE-2017-9377A command injection was identified on Barco ClickShare Base Unit devices with CSM-1 firmware before 1.7.0.3 and CSC-1 firmware before 1.10.0
- CVE-2017-9450The Amazon Web Services (AWS) CloudFormation bootstrap tools package (aka aws-cfn-bootstrap) before 1.4-19.10 allows local users to execute