# CVEs published 2017-11-06 29 CVEs were published on November 6, 2017: 0 critical, 1 high. Days are UTC. - [CVE-2017-13680](https://cve.now/CVE-2017-13680.md): Prior to SEP 12.1 RU6 MP9 & SEP 14 RU1 Symantec Endpoint Protection Windows endpoint can encounter a situation whereby an attacker could use (no CVSS, Symantec Endpoint Protection) - [CVE-2017-13681](https://cve.now/CVE-2017-13681.md): Symantec Endpoint Protection prior to SEP 12.1 RU6 MP9 could be susceptible to a privilege escalation vulnerability, which is a type of issu (no CVSS, Symantec Endpoint Protection) - [CVE-2017-16638](https://cve.now/CVE-2017-16638.md): The Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the "qemu" group to gain root privileges by creating a hard lin (no CVSS) - [CVE-2017-6331](https://cve.now/CVE-2017-6331.md): Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a type of attack that (no CVSS, Symantec Endpoint Protection) - [CVE-2017-12719](https://cve.now/CVE-2017-12719.md): An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to V8.2\_20170817. (no CVSS, Advantech WebAccess) - [CVE-2017-14016](https://cve.now/CVE-2017-14016.md): A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2\_20170817. (no CVSS, Advantech WebAccess) - [CVE-2017-14023](https://cve.now/CVE-2017-14023.md): An Improper Input Validation issue was discovered in Siemens SIMATIC PCS 7 V8.1 prior to V8.1 SP1 with WinCC V7.3 Upd 13, and V8.2 all versi (no CVSS, Siemens SIMATIC PCS) - [CVE-2017-14025](https://cve.now/CVE-2017-14025.md): An Improper Input Validation issue was discovered in ABB FOX515T release 1.0. (no CVSS, ABB FOX515T) - [CVE-2017-14029](https://cve.now/CVE-2017-14029.md): An Uncontrolled Search Path Element issue was discovered in Trihedral VTScada 11.3.03 and prior. (no CVSS, Trihedral Engineering Limited VTScada) - [CVE-2017-14031](https://cve.now/CVE-2017-14031.md): An Improper Access Control issue was discovered in Trihedral VTScada 11.3.03 and prior. (no CVSS, Trihedral Engineering Limited VTScada) - [CVE-2017-16635](https://cve.now/CVE-2017-16635.md): In TinyWebGallery v2.4, an XSS vulnerability is located in the \`mkname\`, \`mkitem\`, and \`item\` parameters of the \`Add/Create\` module. (no CVSS) - [CVE-2017-16636](https://cve.now/CVE-2017-16636.md): In Bludit v1.5.2 and v2.0.1, an XSS vulnerability is located in the new page, new category, and edit post function body message context. (no CVSS) - [CVE-2017-16637](https://cve.now/CVE-2017-16637.md): In Vectura Perfect Privacy VPN Manager v1.10.10 and v1.10.11, when resetting the network data via the software client, with a running VPN co (no CVSS) - [CVE-2017-15306](https://cve.now/CVE-2017-15306.md): The kvm\_vm\_ioctl\_check\_extension function in arch/powerpc/kvm/powerpc.c in the Linux kernel before 4.13.11 allows local users to cause a den (no CVSS) - [CVE-2015-7529](https://cve.now/CVE-2015-7529.md): sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an a (no CVSS, sosreport) - [CVE-2015-7878](https://cve.now/CVE-2015-7878.md): Cross-site scripting (XSS) vulnerability in the Taxonomy Find module 6.x-2.x through 6.x-1.2 and 7.x-2.x through 7.x-1.0 in Drupal allows re (no CVSS) - [CVE-2017-11177](https://cve.now/CVE-2017-11177.md): TRITON AP-EMAIL 8.2 before 8.2 IB does not properly restrict file access in an unspecified directory. (no CVSS) - [CVE-2017-15672](https://cve.now/CVE-2017-15672.md): The read\_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified im (no CVSS) - [CVE-2017-16001](https://cve.now/CVE-2017-16001.md): In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin upd (no CVSS) - [CVE-2017-7425](https://cve.now/CVE-2017-7425.md): Multiple Reflected XSS in iManager (CVSS 7.6, NetIQ iManager) - [CVE-2017-15039](https://cve.now/CVE-2017-15039.md): Cross-site scripting (XSS) exists in Zurmo 3.2.1.57987acc3018 via a data: URL in the redirectUrl parameter to app/index.php/meetings/default (no CVSS) - [CVE-2017-16524](https://cve.now/CVE-2017-16524.md): Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network\_ssl\_upload.php' allows re (no CVSS) - [CVE-2017-16563](https://cve.now/CVE-2017-16563.md): Cross-Site Request Forgery (CSRF) in the Basic Settings screen on Vonage (Grandstream) HT802 devices allows attackers to modify settings, re (no CVSS) - [CVE-2017-16564](https://cve.now/CVE-2017-16564.md): Stored Cross-site scripting (XSS) vulnerability in /cgi-bin/config2 on Vonage (Grandstream) HT802 devices allows remote authenticated users (no CVSS) - [CVE-2017-16565](https://cve.now/CVE-2017-16565.md): Cross-Site Request Forgery (CSRF) in /cgi-bin/login on Vonage (Grandstream) HT802 devices allows attackers to authenticate a user via the lo (no CVSS) - [CVE-2017-16569](https://cve.now/CVE-2017-16569.md): An Open URL Redirect issue exists in Zurmo 3.2.1.57987acc3018 via an http: URL in the redirectUrl parameter to app/index.php/meetings/defaul (no CVSS) - [CVE-2017-16570](https://cve.now/CVE-2017-16570.md): KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number S (no CVSS, keystone) - [CVE-2017-16547](https://cve.now/CVE-2017-16547.md): The DrawImage function in magick/render.c in GraphicsMagick 1.3.26 does not properly look for pop keywords that are associated with push key (no CVSS) - [CVE-2017-16548](https://cve.now/CVE-2017-16548.md): The receive\_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\\0' character in an xattr name, w (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-11-06 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.