CVEs published in October 2017

1,342 vulnerabilities, 197 critical, 6 exploited.

• gnu emacs GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup... CVE-2017-1000383 5.5 MediumOctober 31, 2017
• vim VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("... CVE-2017-1000382 5.5 MediumOctober 31, 2017
• bitdefender internet security, internet security 2018 +1 more This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations... CVE-2017-10954 8.8 HighOctober 31, 2017
• foxit reader, foxitsoftware foxit reader +1 more This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations... CVE-2017-10953 8.8 HighOctober 31, 2017
• foxit reader, foxitsoftware foxit reader +1 more This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations... CVE-2017-10948 8.8 HighOctober 31, 2017
• foxit reader, foxitsoftware foxit reader +1 more This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations... CVE-2017-10947 8.8 HighOctober 31, 2017
• foxit reader, foxitsoftware foxit reader +1 more This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations... CVE-2017-10946 8.8 HighOctober 31, 2017
• foxit reader, foxitsoftware foxit reader +1 more This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations... CVE-2017-10945 8.8 HighOctober 31, 2017
• foxit reader, foxitsoftware foxit reader +1 more This vulnerability allows remote attackers to disclose sensitive information on vulnerable... CVE-2017-10944 6.5 MediumOctober 31, 2017
• foxit reader, foxitsoftware foxit reader +1 more This vulnerability allows remote attackers to disclose sensitive information on vulnerable... CVE-2017-10943 6.5 MediumOctober 31, 2017
• foxit reader, foxitsoftware foxit reader +1 more This vulnerability allows remote attackers to disclose sensitive information on vulnerable... CVE-2017-10942 6.5 MediumOctober 31, 2017
• foxit reader, foxitsoftware foxit reader +1 more This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations... CVE-2017-10941 8.8 HighOctober 31, 2017
• joyent smart data center, triton datacenter +1 more This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations... CVE-2017-10940 8.8 HighOctober 31, 2017
• hashicorp vagrant vmware fusion In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.0, a local attacker or... CVE-2017-15884 Public exploit 7.0 HighOctober 31, 2017
• mahara Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04... CVE-2017-15273 5.4 MediumOctober 31, 2017
• mahara Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04... CVE-2017-14752 5.4 MediumOctober 31, 2017
• mahara An issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5,... CVE-2017-14163 8.8 HighOctober 31, 2017
• micro focus hp arcsight esm, hp arcsight esm express, hp arcsight enterprise security manager +1 more +3 more A URL redirection to untrusted site vulnerability in HP ArcSight ESM and HP ArcSight ESM Express,... CVE-2017-14358 6.1 MediumOctober 31, 2017
• micro focus hp arcsight esm, hp arcsight esm express, hp arcsight enterprise security manager +1 more +3 more A Reflected and Stored Cross-Site Scripting (XSS) vulnerability in HP ArcSight ESM and HP... CVE-2017-14357 6.1 MediumOctober 31, 2017
• micro focus hp arcsight esm, hp arcsight esm express, hp arcsight enterprise security manager +1 more +3 more An SQL Injection vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version... CVE-2017-14356 9.8 CriticalOctober 31, 2017
• mcafee network data loss prevention Network Data Loss Prevention is vulnerable to MIME type sniffing which allows older versions of... CVE-2017-3935 7.5 HighOctober 31, 2017
• mcafee network data loss prevention Missing HTTP Strict Transport Security state information vulnerability in the server in McAfee... CVE-2017-3934 5.9 MediumOctober 31, 2017
• mcafee network data loss prevention Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP... CVE-2017-3933 5.4 MediumOctober 31, 2017
• flexense syncbreeze Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be... CVE-2017-15950 Public exploit 7.8 HighOctober 31, 2017
• zomato clone script project clone script Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter. CVE-2017-15993 Public exploit 9.8 CriticalOctober 31, 2017
• website broker script project broker script Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php. CVE-2017-15992 Public exploit 9.8 CriticalOctober 31, 2017
• vastal agent zone Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial... CVE-2017-15991 Public exploit 9.8 CriticalOctober 31, 2017
• savsofteproducts phpinventory Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard... CVE-2017-15990 Public exploit 9.8 CriticalOctober 31, 2017
• online exam test application project exam test application Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a... CVE-2017-15989 Public exploit 9.8 CriticalOctober 31, 2017
• nicephpscripts nice php faq script Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different... CVE-2017-15988 Public exploit 9.8 CriticalOctober 31, 2017
• fake magazine cover script project magazine cover script Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content... CVE-2017-15987 Public exploit 9.8 CriticalOctober 31, 2017
• cpa lead reward script project lead reward script CPA Lead Reward Script allows SQL Injection via the username parameter. CVE-2017-15986 Public exploit 9.8 CriticalOctober 31, 2017
• readymadeb2bscript basic b2b script Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter. CVE-2017-15985 Public exploit 9.8 CriticalOctober 31, 2017
• bekirk creative management system lite Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php. CVE-2017-15984 Public exploit 9.8 CriticalOctober 31, 2017
• geniusocean mymagazine magazine \& blog cms MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin... CVE-2017-15983 Public exploit 9.8 CriticalOctober 31, 2017
• geniusocean news Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin... CVE-2017-15982 Public exploit 9.8 CriticalOctober 31, 2017
• geniusocean newspaper Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin... CVE-2017-15981 Public exploit 9.8 CriticalOctober 31, 2017
• rowindex us zip codes database script US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter. CVE-2017-15980 Public exploit 9.8 CriticalOctober 31, 2017
• odallated shareet Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter. CVE-2017-15979 Public exploit 9.8 CriticalOctober 31, 2017
• arox school erp php script AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter. CVE-2017-15978 Public exploit 9.8 CriticalOctober 31, 2017
• protectedlinks expiring download links Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter. CVE-2017-15977 Public exploit 9.8 CriticalOctober 31, 2017
• emc rsa authentication manager EMC RSA Authentication Manager 8.2 SP1 P4 and earlier contains a reflected cross-site scripting... CVE-2017-14373 6.1 MediumOctober 31, 2017
• dlink dsl-2740e firmware D-Link DSL-2740E 1.00_BG_20150720 devices are prone to persistent XSS attacks in the username and... CVE-2016-10699 6.1 MediumOctober 31, 2017
• progress openedge Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows... CVE-2015-9245 9.8 CriticalOctober 31, 2017
• libdatetime-timezone-perl Debian libdatetime-timezone-perl - new upstream version DLA-1156-1 Fix available No scoreOctober 31, 2017
• tzdata Debian tzdata - new upstream version DLA-1155-1 Fix available No scoreOctober 31, 2017
• opentext identity manager Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent:... CVE-2017-10151 10.0 CriticalOctober 30, 2017
• procmail Mageia Updated procmail packages fix security vulnerability MGASA-2017-0392 Fix available No scoreOctober 30, 2017
• red hat, inc. rpm It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when... CVE-2017-7501 7.8 HighOctober 30, 2017
• [unknown] rpm It was found that rpm did not properly handle RPM installations when a destination path was a... CVE-2017-7500 Fix available 7.3 HighOctober 30, 2017
• Show olderLoading…