CVEs published October 31, 2017
46 CVEs were published on October 31, 2017: 1 critical, 0 high.
- Published
- 46
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 45
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- Foxit Reader
- 9
- McAfee Network Data Loss Prevention
- 3
- Micro Focus HP ArcSight ESM
- 3
- Bitdefender Internet Security
- 1
- Joyent Smart Data Center
- 1
- RSA Authentication Manager 8.2 SP1 P4 and earlier
- 1
Critical 1
Medium, low and unrated 45
- CVE-2017-1000382VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files
- CVE-2017-1000383GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting
- CVE-2017-10940This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to agentsJoyent Smart Data Center
- CVE-2017-10941This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878.Foxit Reader
- CVE-2017-10942This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878.Foxit Reader
- CVE-2017-10943This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878.Foxit Reader
- CVE-2017-10944This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878.Foxit Reader
- CVE-2017-10945This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878.Foxit Reader
- CVE-2017-10946This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871.Foxit Reader
- CVE-2017-10947This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871.Foxit Reader
- CVE-2017-10948This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871.Foxit Reader
- CVE-2017-10953This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878.Foxit Reader
- CVE-2017-10954This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security Internet SBitdefender Internet Security
- CVE-2017-14163An issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3.
- CVE-2017-14752Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a pot
- CVE-2017-15273Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a pot
- CVE-2017-15884In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.0, a local attacker or malware can silently subvert the plugin upd
- CVE-2017-1000256libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a fa
- CVE-2017-14356An SQL Injection vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1.Micro Focus HP ArcSight ESM
- CVE-2017-14357A Reflected and Stored Cross-Site Scripting (XSS) vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to Micro Focus HP ArcSight ESM
- CVE-2017-14358A URL redirection to untrusted site vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4Micro Focus HP ArcSight ESM
- CVE-2017-15950Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution.
- CVE-2017-3933Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users tMcAfee Network Data Loss Prevention
- CVE-2017-3934Missing HTTP Strict Transport Security state information vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allMcAfee Network Data Loss Prevention
- CVE-2017-3935Network Data Loss Prevention is vulnerable to MIME type sniffing which allows older versions of Internet Explorer to perform MIME-sniffing oMcAfee Network Data Loss Prevention
- CVE-2015-9245Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URL
- CVE-2016-10699D-Link DSL-2740E 1.00_BG_20150720 devices are prone to persistent XSS attacks in the username and password fields: a remote unauthenticated
- CVE-2017-14373EMC RSA Authentication Manager 8.2 SP1 P4 and earlier contains a reflected cross-site scripting vulnerability that could potentially be explRSA Authentication Manager 8.2 SP1 P4 and earlier
- CVE-2017-15977Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter.
- CVE-2017-15978AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter.
- CVE-2017-15979Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter.
- CVE-2017-15980US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter.
- CVE-2017-15981Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
- CVE-2017-15982Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
- CVE-2017-15983MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
- CVE-2017-15984Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php.
- CVE-2017-15985Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter.
- CVE-2017-15986CPA Lead Reward Script allows SQL Injection via the username parameter.
- CVE-2017-15987Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter.
- CVE-2017-15988Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008-6525.
- CVE-2017-15989Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action.
- CVE-2017-15990Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/.
- CVE-2017-15991Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by
- CVE-2017-15992Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php.
- CVE-2017-15993Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.