# CVEs published 2017-10-31

46 CVEs were published on October 31, 2017: 1 critical, 0 high. Days are UTC.

- [CVE-2017-1000257](https://cve.now/CVE-2017-1000257.md): An IMAP FETCH response line indicates the size of the returned data, in number of bytes. (CVSS 9.1)
- [CVE-2017-1000382](https://cve.now/CVE-2017-1000382.md): VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("\[ORIGINAL\_FILENAME\].swp") resulting in files (no CVSS)
- [CVE-2017-1000383](https://cve.now/CVE-2017-1000383.md): GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("\[ORIGINAL\_FILENAME\]~") resulting (no CVSS)
- [CVE-2017-10940](https://cve.now/CVE-2017-10940.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to agents (no CVSS, Joyent Smart Data Center)
- [CVE-2017-10941](https://cve.now/CVE-2017-10941.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. (no CVSS, Foxit Reader)
- [CVE-2017-10942](https://cve.now/CVE-2017-10942.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. (no CVSS, Foxit Reader)
- [CVE-2017-10943](https://cve.now/CVE-2017-10943.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. (no CVSS, Foxit Reader)
- [CVE-2017-10944](https://cve.now/CVE-2017-10944.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. (no CVSS, Foxit Reader)
- [CVE-2017-10945](https://cve.now/CVE-2017-10945.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. (no CVSS, Foxit Reader)
- [CVE-2017-10946](https://cve.now/CVE-2017-10946.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. (no CVSS, Foxit Reader)
- [CVE-2017-10947](https://cve.now/CVE-2017-10947.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. (no CVSS, Foxit Reader)
- [CVE-2017-10948](https://cve.now/CVE-2017-10948.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. (no CVSS, Foxit Reader)
- [CVE-2017-10953](https://cve.now/CVE-2017-10953.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. (no CVSS, Foxit Reader)
- [CVE-2017-10954](https://cve.now/CVE-2017-10954.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security Internet S (no CVSS, Bitdefender Internet Security)
- [CVE-2017-14163](https://cve.now/CVE-2017-14163.md): An issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3. (no CVSS)
- [CVE-2017-14752](https://cve.now/CVE-2017-14752.md): Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a pot (no CVSS)
- [CVE-2017-15273](https://cve.now/CVE-2017-15273.md): Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a pot (no CVSS)
- [CVE-2017-15884](https://cve.now/CVE-2017-15884.md): In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.0, a local attacker or malware can silently subvert the plugin upd (no CVSS)
- [CVE-2017-1000256](https://cve.now/CVE-2017-1000256.md): libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a fa (no CVSS)
- [CVE-2017-14356](https://cve.now/CVE-2017-14356.md): An SQL Injection vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. (no CVSS, Micro Focus HP ArcSight ESM)
- [CVE-2017-14357](https://cve.now/CVE-2017-14357.md): A Reflected and Stored Cross-Site Scripting (XSS) vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to (no CVSS, Micro Focus HP ArcSight ESM)
- [CVE-2017-14358](https://cve.now/CVE-2017-14358.md): A URL redirection to untrusted site vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 (no CVSS, Micro Focus HP ArcSight ESM)
- [CVE-2017-15950](https://cve.now/CVE-2017-15950.md): Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution. (no CVSS)
- [CVE-2017-3933](https://cve.now/CVE-2017-3933.md): Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users t (no CVSS, McAfee Network Data Loss Prevention)
- [CVE-2017-3934](https://cve.now/CVE-2017-3934.md): Missing HTTP Strict Transport Security state information vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x all (no CVSS, McAfee Network Data Loss Prevention)
- [CVE-2017-3935](https://cve.now/CVE-2017-3935.md): Network Data Loss Prevention is vulnerable to MIME type sniffing which allows older versions of Internet Explorer to perform MIME-sniffing o (no CVSS, McAfee Network Data Loss Prevention)
- [CVE-2015-9245](https://cve.now/CVE-2015-9245.md): Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URL (no CVSS)
- [CVE-2016-10699](https://cve.now/CVE-2016-10699.md): D-Link DSL-2740E 1.00\_BG\_20150720 devices are prone to persistent XSS attacks in the username and password fields: a remote unauthenticated (no CVSS)
- [CVE-2017-14373](https://cve.now/CVE-2017-14373.md): EMC RSA Authentication Manager 8.2 SP1 P4 and earlier contains a reflected cross-site scripting vulnerability that could potentially be expl (no CVSS, RSA Authentication Manager 8.2 SP1 P4 and earlier)
- [CVE-2017-15977](https://cve.now/CVE-2017-15977.md): Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter. (no CVSS)
- [CVE-2017-15978](https://cve.now/CVE-2017-15978.md): AROX School ERP PHP Script 1.0 allows SQL Injection via the office\_admin/ id parameter. (no CVSS)
- [CVE-2017-15979](https://cve.now/CVE-2017-15979.md): Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter. (no CVSS)
- [CVE-2017-15980](https://cve.now/CVE-2017-15980.md): US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter. (no CVSS)
- [CVE-2017-15981](https://cve.now/CVE-2017-15981.md): Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin\_process.php for form editing. (no CVSS)
- [CVE-2017-15982](https://cve.now/CVE-2017-15982.md): Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin\_process.php for form editing. (no CVSS)
- [CVE-2017-15983](https://cve.now/CVE-2017-15983.md): MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin\_process.php for form editing. (no CVSS)
- [CVE-2017-15984](https://cve.now/CVE-2017-15984.md): Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php. (no CVSS)
- [CVE-2017-15985](https://cve.now/CVE-2017-15985.md): Basic B2B Script allows SQL Injection via the product\_view1.php pid or id parameter. (no CVSS)
- [CVE-2017-15986](https://cve.now/CVE-2017-15986.md): CPA Lead Reward Script allows SQL Injection via the username parameter. (no CVSS)
- [CVE-2017-15987](https://cve.now/CVE-2017-15987.md): Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter. (no CVSS)
- [CVE-2017-15988](https://cve.now/CVE-2017-15988.md): Nice PHP FAQ Script allows SQL Injection via the index.php nice\_theme parameter, a different vulnerability than CVE-2008-6525. (no CVSS)
- [CVE-2017-15989](https://cve.now/CVE-2017-15989.md): Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action. (no CVSS)
- [CVE-2017-15990](https://cve.now/CVE-2017-15990.md): Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit\_myaccountdetail/. (no CVSS)
- [CVE-2017-15991](https://cve.now/CVE-2017-15991.md): Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property\_type, city, or posted\_by (no CVSS)
- [CVE-2017-15992](https://cve.now/CVE-2017-15992.md): Website Broker Script allows SQL Injection via the 'status\_id' Parameter to status\_list.php. (no CVSS)
- [CVE-2017-15993](https://cve.now/CVE-2017-15993.md): Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-10-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.