# CVEs published 2017-11-07

44 CVEs were published on November 7, 2017: 17 critical, 11 high. Days are UTC.

- [CVE-2017-16643](https://cve.now/CVE-2017-16643.md): The parse\_hid\_report\_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel before 4.13.11 allows local users to cause a den (no CVSS)
- [CVE-2017-16644](https://cve.now/CVE-2017-16644.md): The hdpvr\_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11 allows local users to cause a denial of (no CVSS)
- [CVE-2017-16645](https://cve.now/CVE-2017-16645.md): The ims\_pcu\_get\_cdc\_union\_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through 4.13.11 allows local users to cause a de (no CVSS)
- [CVE-2017-16646](https://cve.now/CVE-2017-16646.md): drivers/media/usb/dvb-usb/dib0700\_devices.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (BUG and sys (no CVSS)
- [CVE-2017-16647](https://cve.now/CVE-2017-16647.md): drivers/net/usb/asix\_devices.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference (no CVSS)
- [CVE-2017-16648](https://cve.now/CVE-2017-16648.md): The dvb\_frontend\_free function in drivers/media/dvb-core/dvb\_frontend.c in the Linux kernel through 4.13.11 allows local users to cause a de (no CVSS)
- [CVE-2017-16649](https://cve.now/CVE-2017-16649.md): The usbnet\_generic\_cdc\_bind function in drivers/net/usb/cdc\_ether.c in the Linux kernel through 4.13.11 allows local users to cause a denial (no CVSS)
- [CVE-2017-16650](https://cve.now/CVE-2017-16650.md): The qmi\_wwan\_bind function in drivers/net/usb/qmi\_wwan.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (no CVSS)
- [CVE-2017-16561](https://cve.now/CVE-2017-16561.md): /view/friend\_profile.php in Ingenious School Management System 2.3.0 is vulnerable to Boolean-based and Time-based SQL injection in the 'fri (no CVSS)
- [CVE-2008-7319](https://cve.now/CVE-2008-7319.md): The Net::Ping::External extension through 0.15 for Perl does not properly sanitize arguments (e.g., invalid hostnames) containing shell meta (no CVSS)
- [CVE-2016-0872](https://cve.now/CVE-2016-0872.md): A Plaintext Storage of a Password issue was discovered in Kabona AB WebDatorCentral (WDC) versions prior to Version 3.4.0. (no CVSS)
- [CVE-2017-16642](https://cve.now/CVE-2017-16642.md): In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib\_meridian handling of 'front of' a (no CVSS)
- [CVE-2017-16641](https://cve.now/CVE-2017-16641.md): lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path\_rrdtool parameter in an (no CVSS)
- [CVE-2017-12083](https://cve.now/CVE-2017-12083.md): An exploitable information disclosure vulnerability exists in the apid daemon of the Circle with Disney running firmware 2.0.1. (CVSS 5.8, Circle Media Circle)
- [CVE-2017-12084](https://cve.now/CVE-2017-12084.md): A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. (CVSS 8.0, Circle Media Circle)
- [CVE-2017-12085](https://cve.now/CVE-2017-12085.md): An exploitable routing vulnerability exists in the Circle with Disney cloud infrastructure. (CVSS 9.0, Circle Media Circle)
- [CVE-2017-12094](https://cve.now/CVE-2017-12094.md): An exploitable vulnerability exists in the WiFi Channel parsing of Circle with Disney running firmware 2.0.1. (CVSS 7.4, Circle Media Circle)
- [CVE-2017-12096](https://cve.now/CVE-2017-12096.md): An exploitable vulnerability exists in the WiFi management of Circle with Disney. (CVSS 6.5, Circle Media Circle)
- [CVE-2017-2864](https://cve.now/CVE-2017-2864.md): An exploitable vulnerability exists in the generation of authentication token functionality of Circle with Disney. (CVSS 8.1, Circle Media Circle)
- [CVE-2017-2865](https://cve.now/CVE-2017-2865.md): An exploitable vulnerability exists in the firmware update functionality of Circle with Disney. (CVSS 9.6, Circle Media Circle)
- [CVE-2017-2866](https://cve.now/CVE-2017-2866.md): An exploitable vulnerability exists in the /api/CONFIG/backup functionality of Circle with Disney. (CVSS 9.9, Circle Media Circle)
- [CVE-2017-2881](https://cve.now/CVE-2017-2881.md): An exploitable vulnerability exists in the torlist update functionality of Circle with Disney running firmware 2.0.1. (CVSS 9.6, Circle Media Circle)
- [CVE-2017-2882](https://cve.now/CVE-2017-2882.md): An exploitable vulnerability exists in the servers update functionality of Circle with Disney running firmware 2.0.1. (CVSS 9.0, Circle Media Circle)
- [CVE-2017-2883](https://cve.now/CVE-2017-2883.md): An exploitable vulnerability exists in the database update functionality of Circle with Disney running firmware 2.0.1. (CVSS 9.0, Circle Media Circle)
- [CVE-2017-2884](https://cve.now/CVE-2017-2884.md): An exploitable vulnerability exists in the user photo update functionality of Circle with Disney running firmware 2.0.1. (CVSS 7.5, Circle Media Circle)
- [CVE-2017-2889](https://cve.now/CVE-2017-2889.md): An exploitable Denial of Service vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. (CVSS 7.5, Circle Media Circle)
- [CVE-2017-2890](https://cve.now/CVE-2017-2890.md): An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. (CVSS 9.9, Circle Media Circle)
- [CVE-2017-2891](https://cve.now/CVE-2017-2891.md): An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. (CVSS 9.8, Cesanta Mongoose)
- [CVE-2017-2892](https://cve.now/CVE-2017-2892.md): An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. (CVSS 9.8, Cesanta Mongoose)
- [CVE-2017-2893](https://cve.now/CVE-2017-2893.md): An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. (CVSS 7.5, Cesanta Mongoose)
- [CVE-2017-2894](https://cve.now/CVE-2017-2894.md): An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. (CVSS 9.8, Cesanta Mongoose)
- [CVE-2017-2895](https://cve.now/CVE-2017-2895.md): An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. (CVSS 8.2, Cesanta Mongoose)
- [CVE-2017-2898](https://cve.now/CVE-2017-2898.md): An exploitable vulnerability exists in the signature verification of the firmware update functionality of Circle with Disney. (CVSS 9.9, Circle Media Circle)
- [CVE-2017-2909](https://cve.now/CVE-2017-2909.md): An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. (CVSS 7.5, Cesanta Mongoose)
- [CVE-2017-2911](https://cve.now/CVE-2017-2911.md): An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. (CVSS 9.0, Circle Media Circle)
- [CVE-2017-2912](https://cve.now/CVE-2017-2912.md): An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. (CVSS 7.4, Circle Media Circle)
- [CVE-2017-2913](https://cve.now/CVE-2017-2913.md): An exploitable vulnerability exists in the filtering functionality of Circle with Disney. (CVSS 8.1, Circle Media Circle)
- [CVE-2017-2914](https://cve.now/CVE-2017-2914.md): An exploitable authentication bypass vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. (CVSS 9.0, Circle Media Circle)
- [CVE-2017-2915](https://cve.now/CVE-2017-2915.md): An exploitable vulnerability exists in the WiFi configuration functionality of Circle with Disney running firmware 2.0.1. (CVSS 9.0, Circle Media Circle)
- [CVE-2017-2916](https://cve.now/CVE-2017-2916.md): An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. (CVSS 9.9, Circle Media Circle)
- [CVE-2017-2917](https://cve.now/CVE-2017-2917.md): An exploitable vulnerability exists in the notifications functionality of Circle with Disney running firmware 2.0.1. (CVSS 9.9, Circle Media Circle)
- [CVE-2017-2921](https://cve.now/CVE-2017-2921.md): An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. (CVSS 8.1, Cesanta Mongoose)
- [CVE-2017-2922](https://cve.now/CVE-2017-2922.md): An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. (CVSS 9.8, Cesanta Mongoose)
- [CVE-2017-15887](https://cve.now/CVE-2017-15887.md): An improper restriction of excessive authentication attempts vulnerability in /principals in Synology CardDAV Server before 6.0.7-0085 allow (no CVSS, Synology CardDAV Server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-11-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.