# CVEs published 2017-11-09

33 CVEs were published on November 9, 2017: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-16758](https://cve.now/CVE-2017-16758.md): Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for (no CVSS)
- [CVE-2017-16759](https://cve.now/CVE-2017-16759.md): The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php. (no CVSS, librenms/librenms)
- [CVE-2017-16757](https://cve.now/CVE-2017-16757.md): Hola VPN 1.34 has weak permissions (Everyone:F) under %PROGRAMFILES%, which allows local users to gain privileges via a Trojan horse 7za.exe (no CVSS)
- [CVE-2017-11309](https://cve.now/CVE-2017-11309.md): Buffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allows remote servers to execute arbitrary code via a long respon (no CVSS)
- [CVE-2017-11461](https://cve.now/CVE-2017-11461.md): NetApp OnCommand Unified Manager for 7-mode (core package) versions prior to 5.2.1 are susceptible to a clickjacking or "UI redress attack" (no CVSS, NetApp OnCommand Unified Manager)
- [CVE-2017-12779](https://cve.now/CVE-2017-12779.md): The Node\_GetData function in corec/corec/node/node.c in mkvalidator 0.5.1 allows remote attackers to cause a denial of service (Null pointer (no CVSS)
- [CVE-2017-12780](https://cve.now/CVE-2017-12780.md): The ReadData function in ebmlstring.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (invalid free and (no CVSS)
- [CVE-2017-12781](https://cve.now/CVE-2017-12781.md): The EBML\_BufferToID function in ebmlelement.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (Null poin (no CVSS)
- [CVE-2017-12782](https://cve.now/CVE-2017-12782.md): The ReadData function in ebmlmaster.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via (no CVSS)
- [CVE-2017-12783](https://cve.now/CVE-2017-12783.md): The ReadDataFloat function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault (no CVSS)
- [CVE-2017-12800](https://cve.now/CVE-2017-12800.md): The EBML\_FindNextElement function in ebmlmain.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (Null po (no CVSS)
- [CVE-2017-12801](https://cve.now/CVE-2017-12801.md): The UpdateDataSize function in ebmlmaster.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert faul (no CVSS)
- [CVE-2017-12802](https://cve.now/CVE-2017-12802.md): The EBML\_IntegerValue function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert f (no CVSS)
- [CVE-2017-12803](https://cve.now/CVE-2017-12803.md): The Node\_ValidatePtr function in corec/corec/node/node.c in mkclean 0.8.9 allows remote attackers to cause a denial of service (assert fault (no CVSS)
- [CVE-2017-12969](https://cve.now/CVE-2017-12969.md): Buffer overflow in the ViewerCtrlLib.ViewerCtrl ActiveX control in Avaya IP Office Contact Center before 10.1.1 allows remote attackers to c (no CVSS)
- [CVE-2017-15638](https://cve.now/CVE-2017-15638.md): The SuSEfirewall2 package before 3.6.312-2.13.1 in SUSE Linux Enterprise (SLE) Desktop 12 SP2, Server 12 SP2, and Server for Raspberry Pi 12 (no CVSS)
- [CVE-2017-16249](https://cve.now/CVE-2017-16249.md): The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST request can cause the se (no CVSS)
- [CVE-2017-16562](https://cve.now/CVE-2017-16562.md): The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentic (no CVSS)
- [CVE-2017-16567](https://cve.now/CVE-2017-16567.md): Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. (no CVSS)
- [CVE-2017-16568](https://cve.now/CVE-2017-16568.md): Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality. (no CVSS)
- [CVE-2017-16633](https://cve.now/CVE-2017-16633.md): In Joomla! before 3.8.2, a logic bug in com\_fields exposed read-only information about a site's custom fields to unauthorized users. (no CVSS)
- [CVE-2017-16634](https://cve.now/CVE-2017-16634.md): In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method. (no CVSS)
- [CVE-2017-16754](https://cve.now/CVE-2017-16754.md): Bolt before 3.3.6 does not properly restrict access to \_profiler routes, related to EventListener/ProfilerListener.php and Provider/EventLis (no CVSS, bolt/bolt)
- [CVE-2017-5201](https://cve.now/CVE-2017-5201.md): NetApp Clustered Data ONTAP before 8.3.2P8 and 9.0 before P2 allow remote authenticated users to obtain sensitive cluster and tenant informa (no CVSS)
- [CVE-2017-9758](https://cve.now/CVE-2017-9758.md): Savitech driver packages for Windows silently install a self-signed certificate into the Trusted Root Certification Authorities store, aka " (no CVSS)
- [CVE-2017-16711](https://cve.now/CVE-2017-16711.md): The swf\_DefineLosslessBitsTagToImage function in lib/modules/swfbits.c in SWFTools 0.9.2 mishandles an uncompress failure, which allows remo (no CVSS)
- [CVE-2017-16651](https://cve.now/CVE-2017-16651.md): Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's file (CVSS 7.8, KEV)
- [CVE-2017-16673](https://cve.now/CVE-2017-16673.md): Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections. (no CVSS)
- [CVE-2017-16674](https://cve.now/CVE-2017-16674.md): Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, (no CVSS)
- [CVE-2015-7501](https://cve.now/CVE-2015-7501.md): Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Appli (no CVSS, commons-collections:commons-collections · org.apache.com… +3)
- [CVE-2017-16669](https://cve.now/CVE-2017-16669.md): coders/wpg.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash (no CVSS)
- [CVE-2017-16671](https://cve.now/CVE-2017-16671.md): A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Aster (no CVSS)
- [CVE-2017-16672](https://cve.now/CVE-2017-16672.md): An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 befor (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-11-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.