# CVEs published 2017-11-24

7 CVEs were published on November 24, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-16939](https://cve.now/CVE-2017-16939.md): The XFRM dump policy implementation in net/xfrm/xfrm\_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or caus (no CVSS)
- [CVE-2017-16934](https://cve.now/CVE-2017-16934.md): The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.ht (no CVSS)
- [CVE-2017-16935](https://cve.now/CVE-2017-16935.md): Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended acc (no CVSS)
- [CVE-2017-16936](https://cve.now/CVE-2017-16936.md): Directory Traversal vulnerability in app\_data\_center on Shenzhen Tenda Ac9 US\_AC9V1.0BR\_V15.03.05.14\_multi\_TD01, Ac9 ac9\_kf\_V15.03.05.19(631 (no CVSS)
- [CVE-2017-16938](https://cve.now/CVE-2017-16938.md): A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a mal (no CVSS)
- [CVE-2016-10700](https://cve.now/CVE-2016-10700.md): auth\_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended access restrictions by (no CVSS)
- [CVE-2017-16933](https://cve.now/CVE-2017-16933.md): etc/initsystem/prepare-dirs in Icinga 2.x through 2.8.1 has a chown call for a filename in a user-writable directory, which allows local use (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-11-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.