# CVEs published 2017-11-10

13 CVEs were published on November 10, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-16780](https://cve.now/CVE-2017-16780.md): The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file. (no CVSS)
- [CVE-2017-16781](https://cve.now/CVE-2017-16781.md): The installer in MyBB before 1.8.13 has XSS. (no CVSS)
- [CVE-2017-16782](https://cve.now/CVE-2017-16782.md): In Home Assistant before 0.57, it is possible to inject JavaScript code into a persistent notification via crafted Markdown text, aka XSS. (no CVSS)
- [CVE-2017-16783](https://cve.now/CVE-2017-16783.md): In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter. (no CVSS)
- [CVE-2017-16784](https://cve.now/CVE-2017-16784.md): In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter. (no CVSS)
- [CVE-2017-16785](https://cve.now/CVE-2017-16785.md): Cacti 1.1.27 has reflected XSS via the PATH\_INFO to host.php. (no CVSS)
- [CVE-2017-16765](https://cve.now/CVE-2017-16765.md): XSS exists on D-Link DWR-933 1.00(WW)B17 devices via cgi-bin/gui.cgi. (no CVSS)
- [CVE-2017-16521](https://cve.now/CVE-2017-16521.md): In Inedo BuildMaster before 5.8.2, XslTransform was used where XslCompiledTransform should have been used. (no CVSS)
- [CVE-2017-16760](https://cve.now/CVE-2017-16760.md): Inedo BuildMaster before 5.8.2 has XSS. (no CVSS)
- [CVE-2017-16761](https://cve.now/CVE-2017-16761.md): An Open Redirect vulnerability in Inedo BuildMaster before 5.8.2 allows remote attackers to redirect users to arbitrary web sites. (no CVSS)
- [CVE-2017-16762](https://cve.now/CVE-2017-16762.md): Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring. (no CVSS, sanic)
- [CVE-2017-16763](https://cve.now/CVE-2017-16763.md): An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. (no CVSS, confire)
- [CVE-2017-16764](https://cve.now/CVE-2017-16764.md): An exploitable vulnerability exists in the YAML parsing functionality in the read\_yaml\_file method in io\_utils.py in django\_make\_app 0.1.3. (no CVSS, django-make-app)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-11-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.