CVEs published November 10, 2017
13 CVEs were published on November 10, 2017: 0 critical, 0 high.
- Published
- 13
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 13
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- confire
- 1
- django-make-app
- 1
- sanic
- 1
Medium, low and unrated 13
- CVE-2017-16780The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file.
- CVE-2017-16781The installer in MyBB before 1.8.13 has XSS.
- CVE-2017-16782In Home Assistant before 0.57, it is possible to inject JavaScript code into a persistent notification via crafted Markdown text, aka XSS.
- CVE-2017-16783In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter.
- CVE-2017-16784In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter.
- CVE-2017-16785Cacti 1.1.27 has reflected XSS via the PATH_INFO to host.php.
- CVE-2017-16765XSS exists on D-Link DWR-933 1.00(WW)B17 devices via cgi-bin/gui.cgi.
- CVE-2017-16521In Inedo BuildMaster before 5.8.2, XslTransform was used where XslCompiledTransform should have been used.
- CVE-2017-16760Inedo BuildMaster before 5.8.2 has XSS.
- CVE-2017-16761An Open Redirect vulnerability in Inedo BuildMaster before 5.8.2 allows remote attackers to redirect users to arbitrary web sites.
- CVE-2017-16762Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring.sanic
- CVE-2017-16763An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0.confire
- CVE-2017-16764An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3.django-make-app