CVEs published November 16, 2017
124 CVEs were published on November 16, 2017: 0 critical, 1 high.
- Published
- 124
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 123
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- 32
- Google Android
- 31
- Cisco Registered Envelope Service
- 7
- FreeBSD
- 3
- Moxa NPort 5110, 5130, and
- 3
- VMware AirWatch Console
- 2
- Cisco ASA Next-Generation Firewall Services
- 1
- Cisco Email Security Appliance
- 1
- Cisco FindIT Discovery Utility
- 1
- Cisco Firepower System Software
- 1
High 1
Medium, low and unrated 123
- CVE-2017-0830An elevation of privilege vulnerability in the Android framework (device policy client).Google Android
- CVE-2017-0831An elevation of privilege vulnerability in the Android framework (window manager).Google Android
- CVE-2017-0832A remote code execution vulnerability in the Android media framework (libmpeg2).Google Android
- CVE-2017-0833A remote code execution vulnerability in the Android media framework (libavc).Google Android
- CVE-2017-0834A remote code execution vulnerability in the Android media framework (libmpeg2).Google Android
- CVE-2017-0835A remote code execution vulnerability in the Android media framework (libmpeg2).Google Android
- CVE-2017-0836A remote code execution vulnerability in the Android media framework (libhevc).Google Android
- CVE-2017-0838An elevation of privilege vulnerability in the Android media framework (libstagefright).Google Android
- CVE-2017-0839An information disclosure vulnerability in the Android media framework (libeffects).Google Android
- CVE-2017-0840An information disclosure vulnerability in the Android media framework (libstagefright).Google Android
- CVE-2017-0841A remote code execution vulnerability in the Android system (libutils).Google Android
- CVE-2017-0842An elevation of privilege vulnerability in the Android system (bluetooth).Google Android
- CVE-2017-0843An elevation of privilege vulnerability in the MediaTek ccci.Google Android
- CVE-2017-0845A denial of service vulnerability in the Android framework (syncstorageengine).Google Android
- CVE-2017-0847An elevation of privilege vulnerability in the Android media framework (mediaanalytics).Google Android
- CVE-2017-0848An information disclosure vulnerability in the Android media framework (libeffects).Google Android
- CVE-2017-0849An information disclosure vulnerability in the Android media framework (libavc).Google Android
- CVE-2017-0850An information disclosure vulnerability in the Android media framework (libstagefright).Google Android
- CVE-2017-0851An information disclosure vulnerability in the Android media framework (libhevc).Google Android
- CVE-2017-0852A denial of service vulnerability in the Android media framework (libhevc).Google Android
- CVE-2017-0853An information disclosure vulnerability in the Android media framework (n/a).Google Android
- CVE-2017-0854An information disclosure vulnerability in the Android media framework (n/a).Google Android
- CVE-2017-0857Another vulnerability in the Android media framework (n/a).Google Android
- CVE-2017-0858Another vulnerability in the Android media framework (n/a).Google Android
- CVE-2017-0859Another vulnerability in the Android media framework (n/a).Google Android
- CVE-2017-0860An elevation of privilege vulnerability in the Android system (inputdispatcher).Google Android
- CVE-2017-0861Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via Google Android
- CVE-2017-0862An elevation of privilege vulnerability in the Upstream kernel kernel.Google Android
- CVE-2017-0863An elevation of privilege vulnerability in the Upstream kernel video driver.Google Android
- CVE-2017-0864An elevation of privilege vulnerability in the MediaTek ioctl (flashlight).Google Android
- CVE-2017-0865An elevation of privilege vulnerability in the MediaTek soc driver.Google Android
- CVE-2017-0866An elevation of privilege vulnerability in the Direct rendering infrastructure of the NVIDIA Tegra X1 where an unchecked input from userspac
- CVE-2017-0909The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addHackerOne private_address_check ruby gem · private_address_…
- CVE-2017-11012In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when processing a specially Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11013In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, countOffset (in function UnpQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11014In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while parsing a Measurement Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11015In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, currently, the value of SIR_Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11017In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing a specially cQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11018In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, array access out of bounds mQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11022In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the probe requests originateQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11023In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possibility of ouQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11024In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in the rmneQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11025In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to a race condition in tQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11026In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing FRP partitionQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11027In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing UBI image, siQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11028In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the ISP Camera driver, thQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11029In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, camera application triggers Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11032In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a double free can occur whenQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11035In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, possible buffer overflow or Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11038In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the boot imQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11058In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a speciallyQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11073In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the qcacld pktlog allows mapQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11085In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an integer overflow leading Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11089In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observeQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11090In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observeQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11091In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the function mdss_rotatorQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11092In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the KGSL driver function Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11093In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer Over-read in Display Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-15516NetApp SnapCenter Server versions 1.1 through 2.x are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability which could be used tNetApp SnapCenter Server
- CVE-2017-8279In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, missing race condition proteQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-9690In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a qbt1000 ioctl handler, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-9696In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer over-read is possibleQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-9701In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing OEM unlock/Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-9702In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a user-space pointer is direQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-9719In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the kernel driver MDSS, aQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-9721In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the boot loader, a bufferQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-14028A Resource Exhaustion issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 VersioMoxa NPort 5110, 5130, and
- CVE-2017-16719An Injection issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPMoxa NPort 5110, 5130, and
- CVE-2017-16843Vonage VDV-23 115 3.2.11-0.9.40 devices have stored XSS via the NewKeyword or NewDomain field to /goform/RgParentalBasic.
- CVE-2017-16866dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting (XSS) in core/M_Controller.php via the DR_URI field.
- CVE-2017-16867Amazon Key through 2017-11-16 mishandles Cloud Cam 802.11 deauthentication frames during the delivery process, which makes it easier for (1)
- CVE-2017-4930VMware AirWatch Console 9.x prior to 9.2.0 contains a vulnerability that could allow an authenticated AWC user to add a malicious URL to an VMware AirWatch Console
- CVE-2017-4931VMware AirWatch Console 9.x prior to 9.2.0 contains a vulnerability that could allow an authenticated AWC user to add malicious data to an eVMware AirWatch Console
- CVE-2017-4932VMware AirWatch Launcher for Android prior to 3.2.2 contains a vulnerability that could allow an escalation of privilege from the launcher UVMware AirWatch Launcher for Android
- CVE-2017-1086In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24, not all information inFreeBSD
- CVE-2017-1087In FreeBSD 10.x before 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24 named paths are globally scoped, meaning a process located in one FreeBSD
- CVE-2017-1088In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24, the kernel does not prFreeBSD
- CVE-2017-16846Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid par
- CVE-2017-16847Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a showPla
- CVE-2017-16848Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter.
- CVE-2017-16849Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter.
- CVE-2017-16850Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getReso
- CVE-2017-16851Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter.
- CVE-2017-16852shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to prop
- CVE-2017-16853The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to pr
- CVE-2017-15864In the Agent Frontend in Open Ticket Request System (OTRS) 3.3.x through 3.3.18, with a crafted URL it is possible to gain information like
- CVE-2017-16560SanDisk Secure Access 3.01 vault decrypts and copies encrypted files to a temporary folder, where they can remain indefinitely in certain si
- CVE-2017-16777If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can crea
- CVE-2017-16844Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of ser
- CVE-2017-5738Escalation of privilege vulnerability in admin portal for Intel Unite App versions 3.1.32.12, 3.1.41.18 and 3.1.45.26 allows an attacker witIntel Unite App
- CVE-2017-12290Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticateCisco Registered Envelope Service
- CVE-2017-12291Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticateCisco Registered Envelope Service
- CVE-2017-12292Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticateCisco Registered Envelope Service
- CVE-2017-12299A vulnerability exists in the process of creating default IP blocks during device initialization for Cisco ASA Next-Generation Firewall ServCisco ASA Next-Generation Firewall Services
- CVE-2017-12300A vulnerability in the SNORT detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass aCisco Firepower System Software
- CVE-2017-12302A vulnerability in the Cisco Unified Communications Manager SQL database interface could allow an authenticated, remote attacker to impact tCisco Unified Communications Manager
- CVE-2017-12303A vulnerability in the Advanced Malware Protection (AMP) file filtering feature of Cisco AsyncOS Software for Cisco Web Security Appliance (Cisco Web Security Appliance
- CVE-2017-12304A vulnerability in the IOS daemon (IOSd) web-based management interface of Cisco IOS and IOS XE Software could allow an unauthenticated, remCisco IOS and IOS XE
- CVE-2017-12305A vulnerability in the debug interface of Cisco IP Phone 8800 series could allow an authenticated, local attacker to execute arbitrary commaCisco IP Phone 8800 Series
- CVE-2017-12306A vulnerability in the upgrade process of Cisco Spark Board could allow an authenticated, local attacker to install an unverified upgrade paCisco Spark Board
- CVE-2017-12309A vulnerability in the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to conduct a HTTP response splitCisco Email Security Appliance
- CVE-2017-12311A vulnerability in the H.264 decoder function of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a Cisco MeetiCisco Meeting Server
- CVE-2017-12312An untrusted search path (aka DLL Preloading) vulnerability in the Cisco Immunet antimalware installer could allow an authenticated, local aCisco Immunet Antimalware Installer
- CVE-2017-12313An untrusted search path (aka DLL Preload) vulnerability in the Cisco Network Academy Packet Tracer software could allow an authenticated, lCisco Network Academy Packet Tracer
- CVE-2017-12314A vulnerability in the Cisco FindIT Network Discovery Utility could allow an authenticated, local attacker to perform a DLL preloading attacCisco FindIT Discovery Utility
- CVE-2017-12315A vulnerability in system logging when replication is being configured with the Cisco HyperFlex System could allow an authenticated, local aCisco HyperFlex System
- CVE-2017-12316A vulnerability in the Guest Portal login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to peCisco Identity Services Engine
- CVE-2017-12318A vulnerability in the TCP state machine of Cisco RF Gateway 1 devices could allow an unauthenticated, remote attacker to prevent an affecteCisco RF Gateway
- CVE-2017-12320Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticateCisco Registered Envelope Service
- CVE-2017-12321Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticateCisco Registered Envelope Service
- CVE-2017-12322Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticateCisco Registered Envelope Service
- CVE-2017-12323Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticateCisco Registered Envelope Service
- CVE-2017-12337A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could aCisco Voice Operating System
- CVE-2017-12350A vulnerability in Cisco Umbrella Insights Virtual Appliances 2.1.0 and earlier could allow an authenticated, local attacker to log in to anCisco Umbrella Insights Virtual Appliance
- CVE-2017-13135A NULL Pointer Dereference exists in VideoLAN x265, as used in libbpg 0.9.7 and other products, because the CUData::initialize function in c
- CVE-2017-13136The image_alloc function in bpgenc.c in libbpg 0.9.7 has an integer overflow, with a resultant invalid malloc and NULL pointer dereference.
- CVE-2017-14034The restore_tqb_pixels function in hevc_filter.c in libavcodec, as used in libbpg 0.9.7 and other products, miscalculates a memcpy destinati
- CVE-2017-16841LanSweeper 6.0.100.75 has XSS via the description parameter to /Calendar/CalendarActions.aspx.
- CVE-2017-16842Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPre
- CVE-2017-16834PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned by an unprivileged account but root code execution depends on these files, wh
- CVE-2017-16836Arris TG1682G devices with Comcast TG1682_2.0s7_PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via the actionHandler/a
- CVE-2017-16837Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause arbitrary code execution, which allows local
- CVE-2017-8807vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to oVarnish HTTP Cache 4.1.x before 4.1.9 and 5.x before