# CVEs published 2017-10-30

31 CVEs were published on October 30, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-1000255](https://cve.now/CVE-2017-1000255.md): On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn so that the kernel wi (no CVSS)
- [CVE-2017-10151](https://cve.now/CVE-2017-10151.md): Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). (no CVSS, Oracle Identity Manager)
- [CVE-2012-4449](https://cve.now/CVE-2012-4449.md): Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security fe (no CVSS, org.apache.hadoop:hadoop-client)
- [CVE-2012-5636](https://cve.now/CVE-2012-5636.md): Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote (no CVSS)
- [CVE-2013-4366](https://cve.now/CVE-2013-4366.md): http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which (no CVSS, org.apache.httpcomponents:httpclient)
- [CVE-2014-0072](https://cve.now/CVE-2014-0072.md): ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the (no CVSS)
- [CVE-2014-0073](https://cve.now/CVE-2014-0073.md): The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and (no CVSS)
- [CVE-2017-14919](https://cve.now/CVE-2017-14919.md): Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and c (no CVSS)
- [CVE-2017-16230](https://cve.now/CVE-2017-16230.md): In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article c (no CVSS)
- [CVE-2017-15888](https://cve.now/CVE-2017-15888.md): Cross-site scripting (XSS) vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allows remote authenticat (no CVSS, Synology Audio Station)
- [CVE-2009-1197](https://cve.now/CVE-2009-1197.md): Apache jUDDI before 2.0 allows attackers to spoof entries in log files via vectors related to error logging of keys from uddiget.jsp. (no CVSS)
- [CVE-2009-1198](https://cve.now/CVE-2009-1198.md): Cross-site scripting (XSS) vulnerability in Apache jUDDI before 2.0 allows remote attackers to inject arbitrary web script or HTML via the d (no CVSS)
- [CVE-2012-0881](https://cve.now/CVE-2012-0881.md): Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an (no CVSS, xerces:xercesImpl)
- [CVE-2014-0115](https://cve.now/CVE-2014-0115.md): Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (no CVSS, org.apache.storm:storm)
- [CVE-2017-15920](https://cve.now/CVE-2017-15920.md): In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer dereference vulnera (no CVSS)
- [CVE-2017-15921](https://cve.now/CVE-2017-15921.md): In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer dereference vulnera (no CVSS)
- [CVE-2012-5357](https://cve.now/CVE-2012-5357.md): Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remot (no CVSS)
- [CVE-2012-5358](https://cve.now/CVE-2012-5358.md): The XSLTCompiledTransform function in Ektron Content Management System (CMS) before 8.02 SP5 configures the XSL with enableDocumentFunction (no CVSS)
- [CVE-2013-4246](https://cve.now/CVE-2013-4246.md): libsvn\_fs\_fs/fs\_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repos (no CVSS)
- [CVE-2014-3526](https://cve.now/CVE-2014-3526.md): Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vec (no CVSS, org.apache.wicket:wicket-core)
- [CVE-2014-3624](https://cve.now/CVE-2014-3624.md): Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel rema (no CVSS)
- [CVE-2015-0224](https://cve.now/CVE-2015-0224.md): qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence se (no CVSS)
- [CVE-2015-0226](https://cve.now/CVE-2015-0226.md): Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or (no CVSS, org.apache.ws.security:wss4j · org.apache.wss4j:wss4j-ws-se…)
- [CVE-2015-3249](https://cve.now/CVE-2015-3249.md): The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bou (no CVSS)
- [CVE-2015-7549](https://cve.now/CVE-2015-7549.md): The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NU (no CVSS)
- [CVE-2016-3090](https://cve.now/CVE-2016-3090.md): The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a craft (no CVSS, org.apache.struts:struts2-parent)
- [CVE-2017-12460](https://cve.now/CVE-2017-12460.md): An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10. (no CVSS)
- [CVE-2017-15597](https://cve.now/CVE-2017-15597.md): An issue was discovered in Xen through 4.9.x. (no CVSS)
- [CVE-2017-7411](https://cve.now/CVE-2017-7411.md): An issue was discovered in Enalean Tuleap 9.6 and prior versions. (no CVSS)
- [CVE-2017-9377](https://cve.now/CVE-2017-9377.md): A command injection was identified on Barco ClickShare Base Unit devices with CSM-1 firmware before 1.7.0.3 and CSC-1 firmware before 1.10.0 (no CVSS)
- [CVE-2017-9450](https://cve.now/CVE-2017-9450.md): The Amazon Web Services (AWS) CloudFormation bootstrap tools package (aka aws-cfn-bootstrap) before 1.4-19.10 allows local users to execute (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-10-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.