# CVEs published 2017-11-15

91 CVEs were published on November 15, 2017: 1 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-15102](https://cve.now/CVE-2017-15102.md): The tower\_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically… (no CVSS, Linux kernel through)
- [CVE-2017-15115](https://cve.now/CVE-2017-15115.md): The sctp\_do\_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a… (no CVSS, Linux kernel before 4.14-rc6)
- [CVE-2017-5532](https://cve.now/CVE-2017-5532.md): TIBCO JasperReports persistent cross site scripting (CVSS 5.4, TIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +3)
- [CVE-2017-5533](https://cve.now/CVE-2017-5533.md): TIBCO JasperReports Server credentials disclosure (CVSS 9.3, TIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1)
- [CVE-2014-0219](https://cve.now/CVE-2014-0219.md): Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service… (no CVSS, org.apache.karaf:apache-karaf)
- [CVE-2014-2845](https://cve.now/CVE-2014-2845.md): Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof… (no CVSS)
- [CVE-2014-3150](https://cve.now/CVE-2014-3150.md): Livebox 1.1 allows remote authenticated users to upload arbitrary configuration files, download the configuration file, or obtain… (no CVSS)
- [CVE-2014-4000](https://cve.now/CVE-2014-4000.md): Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted… (no CVSS)
- [CVE-2017-14961](https://cve.now/CVE-2017-14961.md): In IKARUS anti.virus 2.16.7, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from… (no CVSS)
- [CVE-2017-15269](https://cve.now/CVE-2017-15269.md): The PSFTPd 10.0.4 Build 729 server does not prevent FTP bounce scans by default. (no CVSS)
- [CVE-2017-15270](https://cve.now/CVE-2017-15270.md): The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values (CSV) file. (no CVSS)
- [CVE-2017-15271](https://cve.now/CVE-2017-15271.md): A use-after-free issue could be triggered remotely in the SFTP component of PSFTPd 10.0.4 Build 729. (no CVSS)
- [CVE-2017-15272](https://cve.now/CVE-2017-15272.md): The PSFTPd 10.0.4 Build 729 server stores its configuration inside PSFTPd.dat. (no CVSS)
- [CVE-2017-15288](https://cve.now/CVE-2017-15288.md): The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in… (no CVSS, org.scala-lang:scala-compiler)
- [CVE-2017-15806](https://cve.now/CVE-2017-15806.md): The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters… (no CVSS, zetacomponents/mail)
- [CVE-2017-15923](https://cve.now/CVE-2017-15923.md): Konversation 1.4.x, 1.5.x, 1.6.x, and 1.7.x before 1.7.3 allow remote attackers to cause a denial of service (crash) via vectors related… (no CVSS)
- [CVE-2017-12633](https://cve.now/CVE-2017-12633.md): The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation… (no CVSS, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2017-12634](https://cve.now/CVE-2017-12634.md): The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation… (no CVSS, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2017-16833](https://cve.now/CVE-2017-16833.md): Stored cross-site scripting (XSS) vulnerability in Gemirro before 0.16.0 allows attackers to inject arbitrary web script via a crafted… (no CVSS, gemirro)
- [CVE-2017-12737](https://cve.now/CVE-2017-12737.md): An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and… (no CVSS, Siemens SICAM RTUs SM-2556 COM Modules with the firmware va…)
- [CVE-2017-12738](https://cve.now/CVE-2017-12738.md): An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and… (no CVSS, Siemens SICAM RTUs SM-2556 COM Modules with the firmware va…)
- [CVE-2017-12739](https://cve.now/CVE-2017-12739.md): An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and… (no CVSS, Siemens SICAM RTUs SM-2556 COM Modules with the firmware va…)
- [CVE-2017-16826](https://cve.now/CVE-2017-16826.md): The coff\_slurp\_line\_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils… (no CVSS)
- [CVE-2017-16827](https://cve.now/CVE-2017-16827.md): The aout\_get\_external\_symbols function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils… (no CVSS)
- [CVE-2017-16828](https://cve.now/CVE-2017-16828.md): The display\_debug\_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (integer overflow… (no CVSS)
- [CVE-2017-16829](https://cve.now/CVE-2017-16829.md): The \_bfd\_elf\_parse\_gnu\_properties function in elf-properties.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in… (no CVSS)
- [CVE-2017-16830](https://cve.now/CVE-2017-16830.md): The print\_gnu\_property\_note function in readelf.c in GNU Binutils 2.29.1 does not have integer-overflow protection on 32-bit platforms… (no CVSS)
- [CVE-2017-16831](https://cve.now/CVE-2017-16831.md): coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate the symbol… (no CVSS)
- [CVE-2017-16832](https://cve.now/CVE-2017-16832.md): The pe\_bfd\_read\_buildid function in peicode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils… (no CVSS)
- [CVE-2017-7851](https://cve.now/CVE-2017-7851.md): D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to… (no CVSS)
- [CVE-2017-8808](https://cve.now/CVE-2017-8808.md): MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has XSS when the $wgShowExceptionDetails setting is false and the… (no CVSS, MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…)
- [CVE-2017-8809](https://cve.now/CVE-2017-8809.md): api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability. (no CVSS, MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…)
- [CVE-2017-8810](https://cve.now/CVE-2017-8810.md): MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error… (no CVSS, MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…)
- [CVE-2017-8811](https://cve.now/CVE-2017-8811.md): The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows… (no CVSS, MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…)
- [CVE-2017-8812](https://cve.now/CVE-2017-8812.md): MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows remote attackers to inject \> (greater than) characters via… (no CVSS, MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…)
- [CVE-2017-8814](https://cve.now/CVE-2017-8814.md): The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside… (no CVSS, MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…)
- [CVE-2017-8815](https://cve.now/CVE-2017-8815.md): The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via… (no CVSS, MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…)
- [CVE-2017-11768](https://cve.now/CVE-2017-11768.md): Windows Media Player in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10… (no CVSS, Microsoft Windows Media Player)
- [CVE-2017-11770](https://cve.now/CVE-2017-11770.md): .NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web… (no CVSS, Microsoft .NET Core · System.Security.Cryptography.X509C… +1)
- [CVE-2017-11788](https://cve.now/CVE-2017-11788.md): Windows Search in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold… (no CVSS, Microsoft Windows search)
- [CVE-2017-11791](https://cve.now/CVE-2017-11791.md): ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows… (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer)
- [CVE-2017-11803](https://cve.now/CVE-2017-11803.md): Microsoft Edge in Microsoft Windows 10 1703, 1709 and Windows Server, version 1709 allows an attacker to obtain information to further… (no CVSS, Microsoft Edge)
- [CVE-2017-11827](https://cve.now/CVE-2017-11827.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and… (no CVSS, Internet Explorer, Microsoft Edge)
- [CVE-2017-11830](https://cve.now/CVE-2017-11830.md): Device Guard in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows an attacker to… (no CVSS, Microsoft Device Guard)
- [CVE-2017-11831](https://cve.now/CVE-2017-11831.md): Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold… (no CVSS, Microsoft Windows kernel)
- [CVE-2017-11832](https://cve.now/CVE-2017-11832.md): The Microsoft Windows embedded OpenType (EOT) font engine in Windows 7 SP1, Windows Server 2008 SP2 and 2008 R2 SP1, and Windows Server… (no CVSS, Microsoft Graphics Component)
- [CVE-2017-11833](https://cve.now/CVE-2017-11833.md): Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an… (no CVSS, Microsoft Edge)
- [CVE-2017-11834](https://cve.now/CVE-2017-11834.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and… (no CVSS, Microsoft Internet Explorer)
- [CVE-2017-11835](https://cve.now/CVE-2017-11835.md): Microsoft graphics in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to potentially read data that was not… (no CVSS, Microsoft Graphics)
- [CVE-2017-11836](https://cve.now/CVE-2017-11836.md): ChakraCore, and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709… (no CVSS, ChakraCore, Microsoft Edge)
- [CVE-2017-11837](https://cve.now/CVE-2017-11837.md): ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server… (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer)
- [CVE-2017-11838](https://cve.now/CVE-2017-11838.md): ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server… (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer)
- [CVE-2017-11839](https://cve.now/CVE-2017-11839.md): Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to take… (no CVSS)
- [CVE-2017-11840](https://cve.now/CVE-2017-11840.md): ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an… (no CVSS, ChakraCore, Microsoft Edge)
- [CVE-2017-11841](https://cve.now/CVE-2017-11841.md): ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an… (no CVSS, ChakraCore, Microsoft Edge)
- [CVE-2017-11842](https://cve.now/CVE-2017-11842.md): Windows kernel in Windows 8.1 and RT 8.1, Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and… (no CVSS, Microsoft Windows Kernel)
- [CVE-2017-11843](https://cve.now/CVE-2017-11843.md): ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows… (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer)
- [CVE-2017-11844](https://cve.now/CVE-2017-11844.md): Microsoft Edge in Microsoft Windows 10 1703, 1709 and Windows Server, version 1709 allows an attacker to obtain information to further… (no CVSS, Microsoft Edge)
- [CVE-2017-11845](https://cve.now/CVE-2017-11845.md): Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how… (no CVSS, Microsoft Edge)
- [CVE-2017-11846](https://cve.now/CVE-2017-11846.md): ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows… (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer)
- [CVE-2017-11847](https://cve.now/CVE-2017-11847.md): Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT1, Windows Server 2012 and R2, Windows 10 Gold… (no CVSS, Microsoft Windows kernel)
- [CVE-2017-11848](https://cve.now/CVE-2017-11848.md): Internet Explorer in Microsoft Microsoft Windows 7 SP1, Windows Server 2008 SP2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and… (no CVSS, Microsoft Internet Explorer)
- [CVE-2017-11849](https://cve.now/CVE-2017-11849.md): Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Server 2012 and R2, Windows 10 Gold, 1511… (no CVSS, Microsoft Windows Kernel)
- [CVE-2017-11850](https://cve.now/CVE-2017-11850.md): Microsoft Graphics Component in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows… (no CVSS, Microsoft Graphics Component)
- [CVE-2017-11851](https://cve.now/CVE-2017-11851.md): The Windows kernel component on Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2… (no CVSS, Microsoft Windows kernel)
- [CVE-2017-11852](https://cve.now/CVE-2017-11852.md): Microsoft GDI Component in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to log on to an affected system and run… (no CVSS, Microsoft GDI)
- [CVE-2017-11853](https://cve.now/CVE-2017-11853.md): Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Server 2012 and R2, Windows 10 Gold, 1511… (no CVSS, Microsoft Windows kernel)
- [CVE-2017-11854](https://cve.now/CVE-2017-11854.md): Microsoft Word 2007 Service Pack 3, Microsoft Word 2010 Service Pack 2, Microsoft Office 2010 Service Pack 2, and Microsoft Office… (no CVSS, Microsoft Office)
- [CVE-2017-11855](https://cve.now/CVE-2017-11855.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and… (no CVSS, Microsoft Internet Explorer)
- [CVE-2017-11856](https://cve.now/CVE-2017-11856.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2… (no CVSS, Microsoft Internet Explorer)
- [CVE-2017-11858](https://cve.now/CVE-2017-11858.md): ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows… (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer)
- [CVE-2017-11861](https://cve.now/CVE-2017-11861.md): Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same… (no CVSS, ChakraCore, Microsoft Edge)
- [CVE-2017-11862](https://cve.now/CVE-2017-11862.md): ChakraCore and Microsoft Edge in Windows 10 1709 and Windows Server, version 1709 allows an attacker to gain the same user rights as the… (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2017-11863](https://cve.now/CVE-2017-11863.md): Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an… (no CVSS, Microsoft Edge)
- [CVE-2017-11866](https://cve.now/CVE-2017-11866.md): ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an… (no CVSS, ChakraCore, Microsoft Edge)
- [CVE-2017-11869](https://cve.now/CVE-2017-11869.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2… (no CVSS, Microsoft Internet Explorer)
- [CVE-2017-11870](https://cve.now/CVE-2017-11870.md): ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights… (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2017-11871](https://cve.now/CVE-2017-11871.md): ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights… (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2017-11872](https://cve.now/CVE-2017-11872.md): Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to force the browser to send data that would… (no CVSS, Microsoft Edge)
- [CVE-2017-11873](https://cve.now/CVE-2017-11873.md): ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an… (no CVSS, ChakraCore, Microsoft Edge)
- [CVE-2017-11874](https://cve.now/CVE-2017-11874.md): Microsoft Edge in Microsoft Windows 10 1703, 1709, Windows Server, version 1709, and ChakraCore allows an attacker to bypass Control Flow… (no CVSS, Microsoft Edge)
- [CVE-2017-11876](https://cve.now/CVE-2017-11876.md): Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that… (no CVSS, Microsoft Server)
- [CVE-2017-11877](https://cve.now/CVE-2017-11877.md): Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT… (no CVSS, Microsoft Office)
- [CVE-2017-11878](https://cve.now/CVE-2017-11878.md): Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT… (no CVSS, Microsoft Office)
- [CVE-2017-11879](https://cve.now/CVE-2017-11879.md): ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted… (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.All +1)
- [CVE-2017-11880](https://cve.now/CVE-2017-11880.md): Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold… (no CVSS, Microsoft Windows Kernel)
- [CVE-2017-11882](https://cve.now/CVE-2017-11882.md): Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 (CVSS 7.8, KEV, Microsoft Office)
- [CVE-2017-11883](https://cve.now/CVE-2017-11883.md): .NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web… (no CVSS, Microsoft ASP.NET · Microsoft.AspNetCore.Server.WebListe… +2)
- [CVE-2017-11884](https://cve.now/CVE-2017-11884.md): Microsoft Excel 2016 Click-to-Run (C2R) allows an attacker to run arbitrary code in the context of the current user by failing to properly… (no CVSS, Microsoft Office)
- [CVE-2017-16821](https://cve.now/CVE-2017-16821.md): b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated by a crafted X-Forwarded-For… (no CVSS)
- [CVE-2017-8700](https://cve.now/CVE-2017-8700.md): ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally… (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.Mvc.Core +1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-11-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.