CVEs published November 6, 2017
29 CVEs were published on November 6, 2017: 0 critical, 1 high.
- Published
- 29
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Symantec Endpoint Protection
- 3
- Advantech WebAccess
- 2
- Trihedral Engineering Limited VTScada
- 2
- ABB FOX515T
- 1
- keystone
- 1
- NetIQ iManager
- 1
- Siemens SIMATIC PCS
- 1
- sosreport
- 1
High 1
Medium, low and unrated 28
- CVE-2017-13680Prior to SEP 12.1 RU6 MP9 & SEP 14 RU1 Symantec Endpoint Protection Windows endpoint can encounter a situation whereby an attacker could useSymantec Endpoint Protection
- CVE-2017-13681Symantec Endpoint Protection prior to SEP 12.1 RU6 MP9 could be susceptible to a privilege escalation vulnerability, which is a type of issuSymantec Endpoint Protection
- CVE-2017-16638The Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the "qemu" group to gain root privileges by creating a hard lin
- CVE-2017-6331Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a type of attack that Symantec Endpoint Protection
- CVE-2017-12719An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to V8.2_20170817.Advantech WebAccess
- CVE-2017-14016A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817.Advantech WebAccess
- CVE-2017-14023An Improper Input Validation issue was discovered in Siemens SIMATIC PCS 7 V8.1 prior to V8.1 SP1 with WinCC V7.3 Upd 13, and V8.2 all versiSiemens SIMATIC PCS
- CVE-2017-14025An Improper Input Validation issue was discovered in ABB FOX515T release 1.0.ABB FOX515T
- CVE-2017-14029An Uncontrolled Search Path Element issue was discovered in Trihedral VTScada 11.3.03 and prior.Trihedral Engineering Limited VTScada
- CVE-2017-14031An Improper Access Control issue was discovered in Trihedral VTScada 11.3.03 and prior.Trihedral Engineering Limited VTScada
- CVE-2017-16635In TinyWebGallery v2.4, an XSS vulnerability is located in the `mkname`, `mkitem`, and `item` parameters of the `Add/Create` module.
- CVE-2017-16636In Bludit v1.5.2 and v2.0.1, an XSS vulnerability is located in the new page, new category, and edit post function body message context.
- CVE-2017-16637In Vectura Perfect Privacy VPN Manager v1.10.10 and v1.10.11, when resetting the network data via the software client, with a running VPN co
- CVE-2017-15306The kvm_vm_ioctl_check_extension function in arch/powerpc/kvm/powerpc.c in the Linux kernel before 4.13.11 allows local users to cause a den
- CVE-2015-7529sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an asosreport
- CVE-2015-7878Cross-site scripting (XSS) vulnerability in the Taxonomy Find module 6.x-2.x through 6.x-1.2 and 7.x-2.x through 7.x-1.0 in Drupal allows re
- CVE-2017-11177TRITON AP-EMAIL 8.2 before 8.2 IB does not properly restrict file access in an unspecified directory.
- CVE-2017-15672The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified im
- CVE-2017-16001In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin upd
- CVE-2017-15039Cross-site scripting (XSS) exists in Zurmo 3.2.1.57987acc3018 via a data: URL in the redirectUrl parameter to app/index.php/meetings/default
- CVE-2017-16524Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_upload.php' allows re
- CVE-2017-16563Cross-Site Request Forgery (CSRF) in the Basic Settings screen on Vonage (Grandstream) HT802 devices allows attackers to modify settings, re
- CVE-2017-16564Stored Cross-site scripting (XSS) vulnerability in /cgi-bin/config2 on Vonage (Grandstream) HT802 devices allows remote authenticated users
- CVE-2017-16565Cross-Site Request Forgery (CSRF) in /cgi-bin/login on Vonage (Grandstream) HT802 devices allows attackers to authenticate a user via the lo
- CVE-2017-16569An Open URL Redirect issue exists in Zurmo 3.2.1.57987acc3018 via an http: URL in the redirectUrl parameter to app/index.php/meetings/defaul
- CVE-2017-16570KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number Skeystone
- CVE-2017-16547The DrawImage function in magick/render.c in GraphicsMagick 1.3.26 does not properly look for pop keywords that are associated with push key
- CVE-2017-16548The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, w