CVEs published November 8, 2017
19 CVEs were published on November 8, 2017: 0 critical, 0 high.
- Published
- 19
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 18
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Red Hat Gluster Storage for RHEL
- 3
- Zoho ManageEngine ServiceDesk
- 2
- com.itextpdf:itextpdf · com.lowagie:itext
- 1
- genix/cms
- 1
- InPage reader
- 1
- Micro Focus HPE Content Manager Workgroup Service
- 1
- mlalchemy
- 1
- owlmixin
- 1
- pyanyapi
- 1
Medium, low and unrated 19
- CVE-2017-11511The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filZoho ManageEngine ServiceDesk
- CVE-2017-11512The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the namZoho ManageEngine ServiceDesk
- CVE-2017-15865bgpd in FRRouting (FRR) before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3 and other products, allows remote attackers
- CVE-2017-15085It was discovered that the fix for CVE-2017-12150 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHERed Hat Gluster Storage for RHEL
- CVE-2017-15086It was discovered that the fix for CVE-2017-12151 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHERed Hat Gluster Storage for RHEL
- CVE-2017-15087It was discovered that the fix for CVE-2017-12163 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHERed Hat Gluster Storage for RHEL
- CVE-2017-16667backintime (aka Back in Time) before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, lead
- CVE-2017-16665RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting (XSS) attack via the service parameter to the
- CVE-2015-3933Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to executegenix/cms
- CVE-2017-9096The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct com.itextpdf:itextpdf · com.lowagie:itext
- CVE-2017-12824Special crafted InPage document leads to arbitrary code execution in InPage reader.InPage reader
- CVE-2017-14360MFSBGN03791 rev.1 - HPE Content Manager Workgroup Service, Denial of Service (DoS)Micro Focus HPE Content Manager Workgroup Service
- CVE-2017-16663In sam2p 0.49.4, there are integer overflows (with resultant heap-based buffer overflows) in input-bmp.ci in the function ReadImage, because
- CVE-2017-16659The Gentoo mail-filter/assp package 1.9.8.13030 and earlier allows local users to gain privileges by leveraging access to the assp user acco
- CVE-2017-16660Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root,
- CVE-2017-16661Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then m
- CVE-2017-16615An exploitable vulnerability exists in the YAML parsing functionality in the parse_yaml_query method in parser.py in MLAlchemy before 0.2.2.mlalchemy
- CVE-2017-16616An exploitable vulnerability exists in the YAML parsing functionality in the YAMLParser method in Interfaces.py in PyAnyAPI before 0.6.1.pyanyapi
- CVE-2017-16618An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12.owlmixin