# CVEs published 2017-11-01

33 CVEs were published on November 1, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-3048](https://cve.now/CVE-2016-3048.md): IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. (no CVSS, IBM OpenPages GRC Platform)
- [CVE-2017-1000121](https://cve.now/CVE-2017-1000121.md): The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised (no CVSS)
- [CVE-2017-1000122](https://cve.now/CVE-2017-1000122.md): The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromi (no CVSS)
- [CVE-2017-1147](https://cve.now/CVE-2017-1147.md): IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. (no CVSS, IBM OpenPages GRC Platform)
- [CVE-2017-1148](https://cve.now/CVE-2017-1148.md): IBM OpenPages GRC Platform 7.2 and 7.3 with OpenPages Loss Event Entry (LEE) application could allow a user to obtain sensitive information (no CVSS, IBM OpenPages GRC Platform)
- [CVE-2017-1290](https://cve.now/CVE-2017-1290.md): IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. (no CVSS, IBM OpenPages GRC Platform)
- [CVE-2017-1300](https://cve.now/CVE-2017-1300.md): IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious (no CVSS, IBM OpenPages GRC Platform)
- [CVE-2017-1333](https://cve.now/CVE-2017-1333.md): IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow an unauthenticated user to obtain sensitive information about the server that could (no CVSS, IBM OpenPages GRC Platform)
- [CVE-2017-1340](https://cve.now/CVE-2017-1340.md): IBM Jazz Reporting Service (JRS) 6.0.4 could allow an authenticated user to obtain information on another server that the current report bui (no CVSS, IBM Jazz Reporting Service)
- [CVE-2017-1552](https://cve.now/CVE-2017-1552.md): IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. (no CVSS, IBM BigInsights)
- [CVE-2017-1553](https://cve.now/CVE-2017-1553.md): IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to cross-site scripting. (no CVSS, IBM BigInsights)
- [CVE-2017-1554](https://cve.now/CVE-2017-1554.md): IBM Infosphere BigInsights 4.2.0 and 4.2.5 could allow a remote attacker to hijack the clicking action of the victim. (no CVSS, IBM BigInsights)
- [CVE-2017-1001001](https://cve.now/CVE-2017-1001001.md): PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalat (no CVSS, PluXml)
- [CVE-2017-14992](https://cve.now/CVE-2017-14992.md): Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06 (no CVSS, github.com/vbatts/tar-split)
- [CVE-2017-15566](https://cve.now/CVE-2017-15566.md): Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, al (no CVSS)
- [CVE-2017-15918](https://cve.now/CVE-2017-15918.md): Sera 1.2 stores the user's login password in plain text in their home directory. (no CVSS)
- [CVE-2017-16357](https://cve.now/CVE-2017-16357.md): In radare 2.0.1, a memory corruption vulnerability exists in store\_versioninfo\_gnu\_verdef() and store\_versioninfo\_gnu\_verneed() in libr/bin/ (no CVSS)
- [CVE-2017-16358](https://cve.now/CVE-2017-16358.md): In radare 2.0.1, an out-of-bounds read vulnerability exists in string\_scan\_range() in libr/bin/bin.c when doing a string search. (no CVSS)
- [CVE-2017-16359](https://cve.now/CVE-2017-16359.md): In radare 2.0.1, a pointer wraparound vulnerability exists in store\_versioninfo\_gnu\_verdef() in libr/bin/format/elf/elf.c. (no CVSS)
- [CVE-2017-16352](https://cve.now/CVE-2017-16352.md): GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overflow vulnerability found in the "Display visual image directory" feature of t (no CVSS)
- [CVE-2017-16353](https://cve.now/CVE-2017-16353.md): GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function of the magick/descr (no CVSS)
- [CVE-2017-1000242](https://cve.now/CVE-2017-1000242.md): Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure (no CVSS, org.jenkins-ci.plugins:git-client)
- [CVE-2017-1000243](https://cve.now/CVE-2017-1000243.md): Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any other (no CVSS, org.jvnet.hudson.plugins:favorite)
- [CVE-2017-1000244](https://cve.now/CVE-2017-1000244.md): Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification (no CVSS, org.jvnet.hudson.plugins:favorite)
- [CVE-2017-1000245](https://cve.now/CVE-2017-1000245.md): The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. (no CVSS, org.jvnet.hudson.plugins:ssh · org.jenkins-ci.plugins:ssh)
- [CVE-2017-12625](https://cve.now/CVE-2017-12625.md): Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined (no CVSS, Apache Software Foundation Apache Hive · org.apache.hive… +2)
- [CVE-2017-14021](https://cve.now/CVE-2017-14021.md): A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G- (no CVSS, Korenix JetNet)
- [CVE-2017-14027](https://cve.now/CVE-2017-14027.md): A Use of Hard-coded Credentials issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX (no CVSS, Korenix JetNet)
- [CVE-2017-14375](https://cve.now/CVE-2017-14375.md): EMC Unisphere for VMAX Virtual Appliance (vApp) versions prior to 8.4.0.15, EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0. (no CVSS, EMC VMAX Virtual Appliance (vApp) EMC Unisphere for VMAX Vi…)
- [CVE-2017-14376](https://cve.now/CVE-2017-14376.md): EMC AppSync Server prior to 3.5.0.1 contains database accounts with hardcoded passwords that could potentially be exploited by malicious use (no CVSS, EMC AppSync Server versions prior to)
- [CVE-2017-15535](https://cve.now/CVE-2017-15535.md): MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire pro (no CVSS)
- [CVE-2017-16244](https://cve.now/CVE-2017-16244.md): Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, all (no CVSS, october/october)
- [CVE-2017-16248](https://cve.now/CVE-2017-16248.md): The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character an (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-11-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.