# CVEs published 2017-11-08 19 CVEs were published on November 8, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-11511](https://cve.now/CVE-2017-11511.md): The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the fil (no CVSS, Zoho ManageEngine ServiceDesk) - [CVE-2017-11512](https://cve.now/CVE-2017-11512.md): The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the nam (no CVSS, Zoho ManageEngine ServiceDesk) - [CVE-2017-15865](https://cve.now/CVE-2017-15865.md): bgpd in FRRouting (FRR) before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3 and other products, allows remote attackers (no CVSS) - [CVE-2017-15085](https://cve.now/CVE-2017-15085.md): It was discovered that the fix for CVE-2017-12150 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHE (no CVSS, Red Hat Gluster Storage for RHEL) - [CVE-2017-15086](https://cve.now/CVE-2017-15086.md): It was discovered that the fix for CVE-2017-12151 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHE (no CVSS, Red Hat Gluster Storage for RHEL) - [CVE-2017-15087](https://cve.now/CVE-2017-15087.md): It was discovered that the fix for CVE-2017-12163 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHE (no CVSS, Red Hat Gluster Storage for RHEL) - [CVE-2017-16667](https://cve.now/CVE-2017-16667.md): backintime (aka Back in Time) before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, lead (no CVSS) - [CVE-2017-16665](https://cve.now/CVE-2017-16665.md): RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting (XSS) attack via the service parameter to the (no CVSS) - [CVE-2015-3933](https://cve.now/CVE-2015-3933.md): Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute (no CVSS, genix/cms) - [CVE-2017-9096](https://cve.now/CVE-2017-9096.md): The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct (no CVSS, com.itextpdf:itextpdf ยท com.lowagie:itext) - [CVE-2017-12824](https://cve.now/CVE-2017-12824.md): Special crafted InPage document leads to arbitrary code execution in InPage reader. (no CVSS, InPage reader) - [CVE-2017-14360](https://cve.now/CVE-2017-14360.md): MFSBGN03791 rev.1 - HPE Content Manager Workgroup Service, Denial of Service (DoS) (CVSS 5.9, Micro Focus HPE Content Manager Workgroup Service) - [CVE-2017-16663](https://cve.now/CVE-2017-16663.md): In sam2p 0.49.4, there are integer overflows (with resultant heap-based buffer overflows) in input-bmp.ci in the function ReadImage, because (no CVSS) - [CVE-2017-16659](https://cve.now/CVE-2017-16659.md): The Gentoo mail-filter/assp package 1.9.8.13030 and earlier allows local users to gain privileges by leveraging access to the assp user acco (no CVSS) - [CVE-2017-16660](https://cve.now/CVE-2017-16660.md): Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, (no CVSS) - [CVE-2017-16661](https://cve.now/CVE-2017-16661.md): Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then m (no CVSS) - [CVE-2017-16615](https://cve.now/CVE-2017-16615.md): An exploitable vulnerability exists in the YAML parsing functionality in the parse\_yaml\_query method in parser.py in MLAlchemy before 0.2.2. (no CVSS, mlalchemy) - [CVE-2017-16616](https://cve.now/CVE-2017-16616.md): An exploitable vulnerability exists in the YAML parsing functionality in the YAMLParser method in Interfaces.py in PyAnyAPI before 0.6.1. (no CVSS, pyanyapi) - [CVE-2017-16618](https://cve.now/CVE-2017-16618.md): An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. (no CVSS, owlmixin) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-11-08 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.