# CVEs published 2017-11-15

91 CVEs were published on November 15, 2017: 1 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-15102](https://cve.now/CVE-2017-15102.md): The tower\_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximat (no CVSS, Linux kernel through)
- [CVE-2017-15115](https://cve.now/CVE-2017-15115.md): The sctp\_do\_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a pee (no CVSS, Linux kernel before 4.14-rc6)
- [CVE-2017-5532](https://cve.now/CVE-2017-5532.md): TIBCO JasperReports persistent cross site scripting (CVSS 5.4, TIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +3)
- [CVE-2017-5533](https://cve.now/CVE-2017-5533.md): TIBCO JasperReports Server credentials disclosure (CVSS 9.3, TIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1)
- [CVE-2014-0219](https://cve.now/CVE-2014-0219.md): Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdow (no CVSS, org.apache.karaf:apache-karaf)
- [CVE-2014-2845](https://cve.now/CVE-2014-2845.md): Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP (no CVSS)
- [CVE-2014-3150](https://cve.now/CVE-2014-3150.md): Livebox 1.1 allows remote authenticated users to upload arbitrary configuration files, download the configuration file, or obtain sensitive (no CVSS)
- [CVE-2014-4000](https://cve.now/CVE-2014-4000.md): Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted se (no CVSS)
- [CVE-2017-14961](https://cve.now/CVE-2017-14961.md): In IKARUS anti.virus 2.16.7, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IO (no CVSS)
- [CVE-2017-15269](https://cve.now/CVE-2017-15269.md): The PSFTPd 10.0.4 Build 729 server does not prevent FTP bounce scans by default. (no CVSS)
- [CVE-2017-15270](https://cve.now/CVE-2017-15270.md): The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values (CSV) file. (no CVSS)
- [CVE-2017-15271](https://cve.now/CVE-2017-15271.md): A use-after-free issue could be triggered remotely in the SFTP component of PSFTPd 10.0.4 Build 729. (no CVSS)
- [CVE-2017-15272](https://cve.now/CVE-2017-15272.md): The PSFTPd 10.0.4 Build 729 server stores its configuration inside PSFTPd.dat. (no CVSS)
- [CVE-2017-15288](https://cve.now/CVE-2017-15288.md): The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /t (no CVSS, org.scala-lang:scala-compiler)
- [CVE-2017-15806](https://cve.now/CVE-2017-15806.md): The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters use (no CVSS, zetacomponents/mail)
- [CVE-2017-15923](https://cve.now/CVE-2017-15923.md): Konversation 1.4.x, 1.5.x, 1.6.x, and 1.7.x before 1.7.3 allow remote attackers to cause a denial of service (crash) via vectors related to (no CVSS)
- [CVE-2017-12633](https://cve.now/CVE-2017-12633.md): The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnera (no CVSS, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2017-12634](https://cve.now/CVE-2017-12634.md): The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerab (no CVSS, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2017-16833](https://cve.now/CVE-2017-16833.md): Stored cross-site scripting (XSS) vulnerability in Gemirro before 0.16.0 allows attackers to inject arbitrary web script via a crafted javas (no CVSS, gemirro)
- [CVE-2017-12737](https://cve.now/CVE-2017-12737.md): An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi0 (no CVSS, Siemens SICAM RTUs SM-2556 COM Modules with the firmware va…)
- [CVE-2017-12738](https://cve.now/CVE-2017-12738.md): An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi0 (no CVSS, Siemens SICAM RTUs SM-2556 COM Modules with the firmware va…)
- [CVE-2017-12739](https://cve.now/CVE-2017-12739.md): An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi0 (no CVSS, Siemens SICAM RTUs SM-2556 COM Modules with the firmware va…)
- [CVE-2017-16826](https://cve.now/CVE-2017-16826.md): The coff\_slurp\_line\_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2. (no CVSS)
- [CVE-2017-16827](https://cve.now/CVE-2017-16827.md): The aout\_get\_external\_symbols function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2 (no CVSS)
- [CVE-2017-16828](https://cve.now/CVE-2017-16828.md): The display\_debug\_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (integer overflow a (no CVSS)
- [CVE-2017-16829](https://cve.now/CVE-2017-16829.md): The \_bfd\_elf\_parse\_gnu\_properties function in elf-properties.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in G (no CVSS)
- [CVE-2017-16830](https://cve.now/CVE-2017-16830.md): The print\_gnu\_property\_note function in readelf.c in GNU Binutils 2.29.1 does not have integer-overflow protection on 32-bit platforms, whic (no CVSS)
- [CVE-2017-16831](https://cve.now/CVE-2017-16831.md): coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate the symbol coun (no CVSS)
- [CVE-2017-16832](https://cve.now/CVE-2017-16832.md): The pe\_bfd\_read\_buildid function in peicode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29. (no CVSS)
- [CVE-2017-7851](https://cve.now/CVE-2017-7851.md): D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to b (no CVSS)
- [CVE-2017-8808](https://cve.now/CVE-2017-8808.md): MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has XSS when the $wgShowExceptionDetails setting is false and the br (no CVSS, MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…)
- [CVE-2017-8809](https://cve.now/CVE-2017-8809.md): api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability. (no CVSS, MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…)
- [CVE-2017-8810](https://cve.now/CVE-2017-8810.md): MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error message (no CVSS, MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…)
- [CVE-2017-8811](https://cve.now/CVE-2017-8811.md): The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML (no CVSS, MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…)
- [CVE-2017-8812](https://cve.now/CVE-2017-8812.md): MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows remote attackers to inject \> (greater than) characters via th (no CVSS, MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…)
- [CVE-2017-8814](https://cve.now/CVE-2017-8814.md): The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside ta (no CVSS, MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…)
- [CVE-2017-8815](https://cve.now/CVE-2017-8815.md): The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glo (no CVSS, MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x b…)
- [CVE-2017-11768](https://cve.now/CVE-2017-11768.md): Windows Media Player in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Go (no CVSS, Microsoft Windows Media Player)
- [CVE-2017-11770](https://cve.now/CVE-2017-11770.md): .NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web applicati (no CVSS, Microsoft .NET Core · System.Security.Cryptography.X509C… +1)
- [CVE-2017-11788](https://cve.now/CVE-2017-11788.md): Windows Search in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 15 (no CVSS, Microsoft Windows search)
- [CVE-2017-11791](https://cve.now/CVE-2017-11791.md): ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Ser (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer)
- [CVE-2017-11803](https://cve.now/CVE-2017-11803.md): Microsoft Edge in Microsoft Windows 10 1703, 1709 and Windows Server, version 1709 allows an attacker to obtain information to further compr (no CVSS, Microsoft Edge)
- [CVE-2017-11827](https://cve.now/CVE-2017-11827.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Mi (no CVSS, Internet Explorer, Microsoft Edge)
- [CVE-2017-11830](https://cve.now/CVE-2017-11830.md): Device Guard in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows an attacker to mak (no CVSS, Microsoft Device Guard)
- [CVE-2017-11831](https://cve.now/CVE-2017-11831.md): Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 15 (no CVSS, Microsoft Windows kernel)
- [CVE-2017-11832](https://cve.now/CVE-2017-11832.md): The Microsoft Windows embedded OpenType (EOT) font engine in Windows 7 SP1, Windows Server 2008 SP2 and 2008 R2 SP1, and Windows Server 2012 (no CVSS, Microsoft Graphics Component)
- [CVE-2017-11833](https://cve.now/CVE-2017-11833.md): Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker (no CVSS, Microsoft Edge)
- [CVE-2017-11834](https://cve.now/CVE-2017-11834.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2 (no CVSS, Microsoft Internet Explorer)
- [CVE-2017-11835](https://cve.now/CVE-2017-11835.md): Microsoft graphics in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to potentially read data that was not intended (no CVSS, Microsoft Graphics)
- [CVE-2017-11836](https://cve.now/CVE-2017-11836.md): ChakraCore, and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 al (no CVSS, ChakraCore, Microsoft Edge)
- [CVE-2017-11837](https://cve.now/CVE-2017-11837.md): ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer)
- [CVE-2017-11838](https://cve.now/CVE-2017-11838.md): ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer)
- [CVE-2017-11839](https://cve.now/CVE-2017-11839.md): Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to take c (no CVSS)
- [CVE-2017-11840](https://cve.now/CVE-2017-11840.md): ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an att (no CVSS, ChakraCore, Microsoft Edge)
- [CVE-2017-11841](https://cve.now/CVE-2017-11841.md): ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an att (no CVSS, ChakraCore, Microsoft Edge)
- [CVE-2017-11842](https://cve.now/CVE-2017-11842.md): Windows kernel in Windows 8.1 and RT 8.1, Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows (no CVSS, Microsoft Windows Kernel)
- [CVE-2017-11843](https://cve.now/CVE-2017-11843.md): ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer)
- [CVE-2017-11844](https://cve.now/CVE-2017-11844.md): Microsoft Edge in Microsoft Windows 10 1703, 1709 and Windows Server, version 1709 allows an attacker to obtain information to further compr (no CVSS, Microsoft Edge)
- [CVE-2017-11845](https://cve.now/CVE-2017-11845.md): Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how Micr (no CVSS, Microsoft Edge)
- [CVE-2017-11846](https://cve.now/CVE-2017-11846.md): ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer)
- [CVE-2017-11847](https://cve.now/CVE-2017-11847.md): Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT1, Windows Server 2012 and R2, Windows 10 Gold, 1511, (no CVSS, Microsoft Windows kernel)
- [CVE-2017-11848](https://cve.now/CVE-2017-11848.md): Internet Explorer in Microsoft Microsoft Windows 7 SP1, Windows Server 2008 SP2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, (no CVSS, Microsoft Internet Explorer)
- [CVE-2017-11849](https://cve.now/CVE-2017-11849.md): Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Server 2012 and R2, Windows 10 Gold, 1511, 1607 (no CVSS, Microsoft Windows Kernel)
- [CVE-2017-11850](https://cve.now/CVE-2017-11850.md): Microsoft Graphics Component in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Ser (no CVSS, Microsoft Graphics Component)
- [CVE-2017-11851](https://cve.now/CVE-2017-11851.md): The Windows kernel component on Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windo (no CVSS, Microsoft Windows kernel)
- [CVE-2017-11852](https://cve.now/CVE-2017-11852.md): Microsoft GDI Component in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to log on to an affected system and run a (no CVSS, Microsoft GDI)
- [CVE-2017-11853](https://cve.now/CVE-2017-11853.md): Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Server 2012 and R2, Windows 10 Gold, 1511, 1607 (no CVSS, Microsoft Windows kernel)
- [CVE-2017-11854](https://cve.now/CVE-2017-11854.md): Microsoft Word 2007 Service Pack 3, Microsoft Word 2010 Service Pack 2, Microsoft Office 2010 Service Pack 2, and Microsoft Office Compatibi (no CVSS, Microsoft Office)
- [CVE-2017-11855](https://cve.now/CVE-2017-11855.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2 (no CVSS, Microsoft Internet Explorer)
- [CVE-2017-11856](https://cve.now/CVE-2017-11856.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Wi (no CVSS, Microsoft Internet Explorer)
- [CVE-2017-11858](https://cve.now/CVE-2017-11858.md): ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer)
- [CVE-2017-11861](https://cve.now/CVE-2017-11861.md): Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user (no CVSS, ChakraCore, Microsoft Edge)
- [CVE-2017-11862](https://cve.now/CVE-2017-11862.md): ChakraCore and Microsoft Edge in Windows 10 1709 and Windows Server, version 1709 allows an attacker to gain the same user rights as the cur (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2017-11863](https://cve.now/CVE-2017-11863.md): Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker (no CVSS, Microsoft Edge)
- [CVE-2017-11866](https://cve.now/CVE-2017-11866.md): ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an att (no CVSS, ChakraCore, Microsoft Edge)
- [CVE-2017-11869](https://cve.now/CVE-2017-11869.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Wi (no CVSS, Microsoft Internet Explorer)
- [CVE-2017-11870](https://cve.now/CVE-2017-11870.md): ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2017-11871](https://cve.now/CVE-2017-11871.md): ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore)
- [CVE-2017-11872](https://cve.now/CVE-2017-11872.md): Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to force the browser to send data that would o (no CVSS, Microsoft Edge)
- [CVE-2017-11873](https://cve.now/CVE-2017-11873.md): ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker (no CVSS, ChakraCore, Microsoft Edge)
- [CVE-2017-11874](https://cve.now/CVE-2017-11874.md): Microsoft Edge in Microsoft Windows 10 1703, 1709, Windows Server, version 1709, and ChakraCore allows an attacker to bypass Control Flow Gu (no CVSS, Microsoft Edge)
- [CVE-2017-11876](https://cve.now/CVE-2017-11876.md): Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that th (no CVSS, Microsoft Server)
- [CVE-2017-11877](https://cve.now/CVE-2017-11877.md): Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Servi (no CVSS, Microsoft Office)
- [CVE-2017-11878](https://cve.now/CVE-2017-11878.md): Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Servi (no CVSS, Microsoft Office)
- [CVE-2017-11879](https://cve.now/CVE-2017-11879.md): ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.All +1)
- [CVE-2017-11880](https://cve.now/CVE-2017-11880.md): Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 15 (no CVSS, Microsoft Windows Kernel)
- [CVE-2017-11882](https://cve.now/CVE-2017-11882.md): Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 (CVSS 7.8, KEV, Microsoft Office)
- [CVE-2017-11883](https://cve.now/CVE-2017-11883.md): .NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web applicati (no CVSS, Microsoft ASP.NET · Microsoft.AspNetCore.Server.WebListe… +2)
- [CVE-2017-11884](https://cve.now/CVE-2017-11884.md): Microsoft Excel 2016 Click-to-Run (C2R) allows an attacker to run arbitrary code in the context of the current user by failing to properly h (no CVSS, Microsoft Office)
- [CVE-2017-16821](https://cve.now/CVE-2017-16821.md): b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated by a crafted X-Forwarded-For H (no CVSS)
- [CVE-2017-8700](https://cve.now/CVE-2017-8700.md): ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restric (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.Mvc.Core +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-11-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.