CVEs published November 20, 2017
26 CVEs were published on November 20, 2017: 0 critical, 6 high.
- Published
- 26
- Critical
- 0
- High
- 6
- Medium
- 0
- Low
- 0
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Apache Software Foundation Apache OpenOffice
- 5
- libxls
- 5
- Moodle 3.x · moodle/moodle
- 1
- Symantec Management Console
- 1
High 6
- CVE-2017-12110An exploitable integer overflow vulnerability exists in the xls_appendSST function of libxls 1.4.A specially crafted XLS file can cause memolibxls
- CVE-2017-12111An exploitable out-of-bounds vulnerability exists in the xls_addCell function of libxls 1.4.libxls
- CVE-2017-2896An exploitable out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls 1.4.libxls
- CVE-2017-2897An exploitable out-of-bounds write vulnerability exists in the read_MSAT function of libxls 1.4.libxls
- CVE-2017-2919An exploitable stack based buffer overflow vulnerability exists in the xls_getfcell function of libxls 1.3.4.libxls
- CVE-2017-16544In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of fi
Medium, low and unrated 20
- CVE-2017-12608A vulnerability in Apache OpenOffice Writer DOC file parser before 4.1.4, and specifically in ImportOldFormatStyles, allows attackers to craApache Software Foundation Apache OpenOffice
- CVE-2017-16906In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar -> New Event" action.
- CVE-2017-16907In Horde Groupware 5.2.19 and 5.2.21, there is XSS via the Color field in a Create Task List action.
- CVE-2017-16908In Horde Groupware 5.2.19, there is XSS via the Name field during creation of a new Resource.
- CVE-2017-3157By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a fApache Software Foundation Apache OpenOffice
- CVE-2017-12607A vulnerability in OpenOffice's PPT file parser before 4.1.4, and specifically in PPTStyleSheet, allows attackers to craft malicious documenApache Software Foundation Apache OpenOffice
- CVE-2017-15527Prior to ITMS 8.1 RU4, the Symantec Management Console can be susceptible to a directory traversal exploit, which is a type of attack that cSymantec Management Console
- CVE-2017-16903LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal sequences in the dir parameter,
- CVE-2017-16904The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is mishandled during later log viewing
- CVE-2017-16899An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclo
- CVE-2017-16902On the Vonage VDV-23 115 3.2.11-0.9.40 home router, sending a long string of characters in the loginPassword and/or loginUsername field to g
- CVE-2017-16898The printMP3Headers function in util/listmp3.c in libming v0.4.8 or earlier is vulnerable to a global buffer overflow, which may allow attac
- CVE-2017-9806A vulnerability in the OpenOffice Writer DOC file parser before 4.1.4, and specifically in the WW8Fonts Constructor, allows attackers to craApache Software Foundation Apache OpenOffice
- CVE-2017-16896A SQL injection in classes/handler/public.php in the forgotpass component of Tiny Tiny RSS 17.4 exists via the login parameter.
- CVE-2016-6804The Apache OpenOffice installer (versions prior to 4.1.3, including some branded as OpenOffice.org) for Windows contains a defective operatiApache Software Foundation Apache OpenOffice
- CVE-2017-11400An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00.
- CVE-2017-11401An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00.
- CVE-2017-11402An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00.
- CVE-2017-15110In Moodle 3.x, students can find out email addresses of other students in the same course.Moodle 3.x · moodle/moodle
- CVE-2017-16894In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct re