CVEs published November 9, 2017
33 CVEs were published on November 9, 2017: 0 critical, 1 high. 1 is now in CISA KEV.
- Published
- 33
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 32
- Now in CISA KEV
- 1
- Fix available
- 3
Most affected products
- bolt/bolt
- 1
- commons-collections:commons-collections · org.apache.com… +3
- 1
- librenms/librenms
- 1
- NetApp OnCommand Unified Manager
- 1
High 1
Medium, low and unrated 32
- CVE-2017-16758Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for
- CVE-2017-16759The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php.librenms/librenms
- CVE-2017-16757Hola VPN 1.34 has weak permissions (Everyone:F) under %PROGRAMFILES%, which allows local users to gain privileges via a Trojan horse 7za.exe
- CVE-2017-11309Buffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allows remote servers to execute arbitrary code via a long respon
- CVE-2017-11461NetApp OnCommand Unified Manager for 7-mode (core package) versions prior to 5.2.1 are susceptible to a clickjacking or "UI redress attack" NetApp OnCommand Unified Manager
- CVE-2017-12779The Node_GetData function in corec/corec/node/node.c in mkvalidator 0.5.1 allows remote attackers to cause a denial of service (Null pointer
- CVE-2017-12780The ReadData function in ebmlstring.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (invalid free and
- CVE-2017-12781The EBML_BufferToID function in ebmlelement.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (Null poin
- CVE-2017-12782The ReadData function in ebmlmaster.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via
- CVE-2017-12783The ReadDataFloat function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault
- CVE-2017-12800The EBML_FindNextElement function in ebmlmain.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (Null po
- CVE-2017-12801The UpdateDataSize function in ebmlmaster.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert faul
- CVE-2017-12802The EBML_IntegerValue function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert f
- CVE-2017-12803The Node_ValidatePtr function in corec/corec/node/node.c in mkclean 0.8.9 allows remote attackers to cause a denial of service (assert fault
- CVE-2017-12969Buffer overflow in the ViewerCtrlLib.ViewerCtrl ActiveX control in Avaya IP Office Contact Center before 10.1.1 allows remote attackers to c
- CVE-2017-15638The SuSEfirewall2 package before 3.6.312-2.13.1 in SUSE Linux Enterprise (SLE) Desktop 12 SP2, Server 12 SP2, and Server for Raspberry Pi 12
- CVE-2017-16249The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST request can cause the se
- CVE-2017-16562The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentic
- CVE-2017-16567Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature.
- CVE-2017-16568Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality.
- CVE-2017-16633In Joomla! before 3.8.2, a logic bug in com_fields exposed read-only information about a site's custom fields to unauthorized users.
- CVE-2017-16634In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.
- CVE-2017-16754Bolt before 3.3.6 does not properly restrict access to _profiler routes, related to EventListener/ProfilerListener.php and Provider/EventLisbolt/bolt
- CVE-2017-5201NetApp Clustered Data ONTAP before 8.3.2P8 and 9.0 before P2 allow remote authenticated users to obtain sensitive cluster and tenant informa
- CVE-2017-9758Savitech driver packages for Windows silently install a self-signed certificate into the Trusted Root Certification Authorities store, aka "
- CVE-2017-16711The swf_DefineLosslessBitsTagToImage function in lib/modules/swfbits.c in SWFTools 0.9.2 mishandles an uncompress failure, which allows remo
- CVE-2017-16673Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections.
- CVE-2017-16674Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation,
- CVE-2015-7501Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Applicommons-collections:commons-collections · org.apache.com… +3
- CVE-2017-16669coders/wpg.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash
- CVE-2017-16671A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Aster
- CVE-2017-16672An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 befor