CVEs published November 1, 2017
33 CVEs were published on November 1, 2017: 0 critical, 0 high.
- Published
- 33
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- IBM OpenPages GRC Platform
- 6
- IBM BigInsights
- 3
- Korenix JetNet
- 2
- org.jvnet.hudson.plugins:favorite
- 2
- Apache Software Foundation Apache Hive · org.apache.hive… +2
- 1
- EMC AppSync Server versions prior to
- 1
- EMC VMAX Virtual Appliance (vApp) EMC Unisphere for VMAX Vi…
- 1
- github.com/vbatts/tar-split
- 1
- IBM Jazz Reporting Service
- 1
- october/october
- 1
Medium, low and unrated 33
- CVE-2016-3048IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting.IBM OpenPages GRC Platform
- CVE-2017-1000121The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised
- CVE-2017-1000122The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromi
- CVE-2017-1147IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting.IBM OpenPages GRC Platform
- CVE-2017-1148IBM OpenPages GRC Platform 7.2 and 7.3 with OpenPages Loss Event Entry (LEE) application could allow a user to obtain sensitive information IBM OpenPages GRC Platform
- CVE-2017-1290IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting.IBM OpenPages GRC Platform
- CVE-2017-1300IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious IBM OpenPages GRC Platform
- CVE-2017-1333IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow an unauthenticated user to obtain sensitive information about the server that couldIBM OpenPages GRC Platform
- CVE-2017-1340IBM Jazz Reporting Service (JRS) 6.0.4 could allow an authenticated user to obtain information on another server that the current report buiIBM Jazz Reporting Service
- CVE-2017-1552IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection.IBM BigInsights
- CVE-2017-1553IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to cross-site scripting.IBM BigInsights
- CVE-2017-1554IBM Infosphere BigInsights 4.2.0 and 4.2.5 could allow a remote attacker to hijack the clicking action of the victim.IBM BigInsights
- CVE-2017-1001001PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalatPluXml
- CVE-2017-14992Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06github.com/vbatts/tar-split
- CVE-2017-15566Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, al
- CVE-2017-15918Sera 1.2 stores the user's login password in plain text in their home directory.
- CVE-2017-16357In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in libr/bin/
- CVE-2017-16358In radare 2.0.1, an out-of-bounds read vulnerability exists in string_scan_range() in libr/bin/bin.c when doing a string search.
- CVE-2017-16359In radare 2.0.1, a pointer wraparound vulnerability exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c.
- CVE-2017-16352GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overflow vulnerability found in the "Display visual image directory" feature of t
- CVE-2017-16353GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function of the magick/descr
- CVE-2017-1000242Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosureorg.jenkins-ci.plugins:git-client
- CVE-2017-1000243Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any otherorg.jvnet.hudson.plugins:favorite
- CVE-2017-1000244Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modificationorg.jvnet.hudson.plugins:favorite
- CVE-2017-1000245The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol.org.jvnet.hudson.plugins:ssh · org.jenkins-ci.plugins:ssh
- CVE-2017-12625Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be definedApache Software Foundation Apache Hive · org.apache.hive… +2
- CVE-2017-14021A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-Korenix JetNet
- CVE-2017-14027A Use of Hard-coded Credentials issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FXKorenix JetNet
- CVE-2017-14375EMC Unisphere for VMAX Virtual Appliance (vApp) versions prior to 8.4.0.15, EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.EMC VMAX Virtual Appliance (vApp) EMC Unisphere for VMAX Vi…
- CVE-2017-14376EMC AppSync Server prior to 3.5.0.1 contains database accounts with hardcoded passwords that could potentially be exploited by malicious useEMC AppSync Server versions prior to
- CVE-2017-15535MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire pro
- CVE-2017-16244Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, alloctober/october
- CVE-2017-16248The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character an