CVEs published November 15, 2017
91 CVEs were published on November 15, 2017: 1 critical, 1 high. 1 is now in CISA KEV.
- Published
- 91
- Critical
- 1
- High
- 1
- Medium
- 1
- Low
- 0
- Unrated
- 88
- Now in CISA KEV
- 1
- Fix available
- 13
Most affected products
- MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…
- 7
- Microsoft Edge
- 7
- ChakraCore, Microsoft Edge
- 6
- ChakraCore, Microsoft Edge, Internet Explorer
- 6
- Microsoft Internet Explorer
- 5
- Microsoft Office
- 5
- Microsoft Windows kernel
- 4
- ChakraCore, Microsoft Edge · Microsoft.ChakraCore
- 3
- Microsoft Windows Kernel
- 3
- Siemens SICAM RTUs SM-2556 COM Modules with the firmware va…
- 3
Critical 1
High 1
Medium, low and unrated 89
- CVE-2017-15102The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximatLinux kernel through
- CVE-2017-15115The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peeLinux kernel before 4.14-rc6
- CVE-2017-5532TIBCO JasperReports persistent cross site scriptingTIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +3
- CVE-2014-0219Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdoworg.apache.karaf:apache-karaf
- CVE-2014-2845Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP
- CVE-2014-3150Livebox 1.1 allows remote authenticated users to upload arbitrary configuration files, download the configuration file, or obtain sensitive
- CVE-2014-4000Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted se
- CVE-2017-14961In IKARUS anti.virus 2.16.7, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IO
- CVE-2017-15269The PSFTPd 10.0.4 Build 729 server does not prevent FTP bounce scans by default.
- CVE-2017-15270The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values (CSV) file.
- CVE-2017-15271A use-after-free issue could be triggered remotely in the SFTP component of PSFTPd 10.0.4 Build 729.
- CVE-2017-15272The PSFTPd 10.0.4 Build 729 server stores its configuration inside PSFTPd.dat.
- CVE-2017-15288The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /torg.scala-lang:scala-compiler
- CVE-2017-15806The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters usezetacomponents/mail
- CVE-2017-15923Konversation 1.4.x, 1.5.x, 1.6.x, and 1.7.x before 1.7.3 allow remote attackers to cause a denial of service (crash) via vectors related to
- CVE-2017-12633The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulneraApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2017-12634The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerabApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2017-16833Stored cross-site scripting (XSS) vulnerability in Gemirro before 0.16.0 allows attackers to inject arbitrary web script via a crafted javasgemirro
- CVE-2017-12737An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi0Siemens SICAM RTUs SM-2556 COM Modules with the firmware va…
- CVE-2017-12738An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi0Siemens SICAM RTUs SM-2556 COM Modules with the firmware va…
- CVE-2017-12739An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi0Siemens SICAM RTUs SM-2556 COM Modules with the firmware va…
- CVE-2017-16826The coff_slurp_line_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.
- CVE-2017-16827The aout_get_external_symbols function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2
- CVE-2017-16828The display_debug_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (integer overflow a
- CVE-2017-16829The _bfd_elf_parse_gnu_properties function in elf-properties.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in G
- CVE-2017-16830The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 does not have integer-overflow protection on 32-bit platforms, whic
- CVE-2017-16831coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate the symbol coun
- CVE-2017-16832The pe_bfd_read_buildid function in peicode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.
- CVE-2017-7851D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to b
- CVE-2017-8808MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has XSS when the $wgShowExceptionDetails setting is false and the brMediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…
- CVE-2017-8809api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability.MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…
- CVE-2017-8810MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messageMediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…
- CVE-2017-8811The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTMLMediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…
- CVE-2017-8812MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows remote attackers to inject > (greater than) characters via thMediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…
- CVE-2017-8814The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside taMediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…
- CVE-2017-8815The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via gloMediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…
- CVE-2017-11768Windows Media Player in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 GoMicrosoft Windows Media Player
- CVE-2017-11770.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web applicatiMicrosoft .NET Core · System.Security.Cryptography.X509C… +1
- CVE-2017-11788Windows Search in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 15Microsoft Windows search
- CVE-2017-11791ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows SerChakraCore, Microsoft Edge, Internet Explorer
- CVE-2017-11803Microsoft Edge in Microsoft Windows 10 1703, 1709 and Windows Server, version 1709 allows an attacker to obtain information to further comprMicrosoft Edge
- CVE-2017-11827Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and MiInternet Explorer, Microsoft Edge
- CVE-2017-11830Device Guard in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows an attacker to makMicrosoft Device Guard
- CVE-2017-11831Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 15Microsoft Windows kernel
- CVE-2017-11832The Microsoft Windows embedded OpenType (EOT) font engine in Windows 7 SP1, Windows Server 2008 SP2 and 2008 R2 SP1, and Windows Server 2012Microsoft Graphics Component
- CVE-2017-11833Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attackerMicrosoft Edge
- CVE-2017-11834Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2Microsoft Internet Explorer
- CVE-2017-11835Microsoft graphics in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to potentially read data that was not intendedMicrosoft Graphics
- CVE-2017-11836ChakraCore, and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 alChakraCore, Microsoft Edge
- CVE-2017-11837ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012ChakraCore, Microsoft Edge, Internet Explorer
- CVE-2017-11838ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012ChakraCore, Microsoft Edge, Internet Explorer
- CVE-2017-11839Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to take c
- CVE-2017-11840ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attChakraCore, Microsoft Edge
- CVE-2017-11841ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attChakraCore, Microsoft Edge
- CVE-2017-11842Windows kernel in Windows 8.1 and RT 8.1, Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Microsoft Windows Kernel
- CVE-2017-11843ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server ChakraCore, Microsoft Edge, Internet Explorer
- CVE-2017-11844Microsoft Edge in Microsoft Windows 10 1703, 1709 and Windows Server, version 1709 allows an attacker to obtain information to further comprMicrosoft Edge
- CVE-2017-11845Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how MicrMicrosoft Edge
- CVE-2017-11846ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server ChakraCore, Microsoft Edge, Internet Explorer
- CVE-2017-11847Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT1, Windows Server 2012 and R2, Windows 10 Gold, 1511,Microsoft Windows kernel
- CVE-2017-11848Internet Explorer in Microsoft Microsoft Windows 7 SP1, Windows Server 2008 SP2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2,Microsoft Internet Explorer
- CVE-2017-11849Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Server 2012 and R2, Windows 10 Gold, 1511, 1607Microsoft Windows Kernel
- CVE-2017-11850Microsoft Graphics Component in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows SerMicrosoft Graphics Component
- CVE-2017-11851The Windows kernel component on Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, WindoMicrosoft Windows kernel
- CVE-2017-11852Microsoft GDI Component in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to log on to an affected system and run aMicrosoft GDI
- CVE-2017-11853Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Server 2012 and R2, Windows 10 Gold, 1511, 1607Microsoft Windows kernel
- CVE-2017-11854Microsoft Word 2007 Service Pack 3, Microsoft Word 2010 Service Pack 2, Microsoft Office 2010 Service Pack 2, and Microsoft Office CompatibiMicrosoft Office
- CVE-2017-11855Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2Microsoft Internet Explorer
- CVE-2017-11856Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, WiMicrosoft Internet Explorer
- CVE-2017-11858ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server ChakraCore, Microsoft Edge, Internet Explorer
- CVE-2017-11861Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same userChakraCore, Microsoft Edge
- CVE-2017-11862ChakraCore and Microsoft Edge in Windows 10 1709 and Windows Server, version 1709 allows an attacker to gain the same user rights as the curChakraCore, Microsoft Edge · Microsoft.ChakraCore
- CVE-2017-11863Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attackerMicrosoft Edge
- CVE-2017-11866ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attChakraCore, Microsoft Edge
- CVE-2017-11869Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, WiMicrosoft Internet Explorer
- CVE-2017-11870ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as ChakraCore, Microsoft Edge · Microsoft.ChakraCore
- CVE-2017-11871ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as ChakraCore, Microsoft Edge · Microsoft.ChakraCore
- CVE-2017-11872Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to force the browser to send data that would oMicrosoft Edge
- CVE-2017-11873ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker ChakraCore, Microsoft Edge
- CVE-2017-11874Microsoft Edge in Microsoft Windows 10 1703, 1709, Windows Server, version 1709, and ChakraCore allows an attacker to bypass Control Flow GuMicrosoft Edge
- CVE-2017-11876Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that thMicrosoft Server
- CVE-2017-11877Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT ServiMicrosoft Office
- CVE-2017-11878Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT ServiMicrosoft Office
- CVE-2017-11879ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URLMicrosoft ASP.NET Core · Microsoft.AspNetCore.All +1
- CVE-2017-11880Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 15Microsoft Windows Kernel
- CVE-2017-11883.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web applicatiMicrosoft ASP.NET · Microsoft.AspNetCore.Server.WebListe… +2
- CVE-2017-11884Microsoft Excel 2016 Click-to-Run (C2R) allows an attacker to run arbitrary code in the context of the current user by failing to properly hMicrosoft Office
- CVE-2017-16821b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated by a crafted X-Forwarded-For H
- CVE-2017-8700ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricMicrosoft ASP.NET Core · Microsoft.AspNetCore.Mvc.Core +1