CVEs published November 27, 2017
55 CVEs were published on November 27, 2017: 0 critical, 0 high.
- Published
- 55
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 55
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- IBM Rational DOORS Next Generation
- 8
- nilsteampassnet/teampass
- 5
- IBM Rational Collaborative Lifecycle Management
- 4
- math.js · mathjs
- 2
- Atlassian Hipchat for Mac desktop client
- 1
- Atlassian Hipchat Server · Atlassian Hipchat Data Center
- 1
- Bazaar through · bzr
- 1
- cf-deployment cf-deployment
- 1
- cf-release and UAA cf-release: All versions prior to v279,…
- 1
- Credhub Credhub-release
- 1
Medium, low and unrated 55
- CVE-2015-7267Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when in sleep mode and operating in Opa
- CVE-2015-7268Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when used on Windows and operating in O
- CVE-2015-7269Seagate ST500LT015 hard disk drives, when operating in eDrive mode on Lenovo ThinkPad W541 laptops with BIOS 2.21, allow physically proximat
- CVE-2017-14746Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request.
- CVE-2017-15275Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap
- CVE-2016-6024IBM Jazz technology based products might divulge information that might be useful in helping attackers through error messages.IBM Rational Collaborative Lifecycle Management
- CVE-2017-1240IBM Rhapsody DM products could reveal sensitive information in HTTP 500 Internal Server Error responses.IBM Rational Collaborative Lifecycle Management
- CVE-2017-1251An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker.IBM Rational Collaborative Lifecycle Management
- CVE-2017-1283IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user to cause a shared memory leak by MQ applications using dynamic queues, which IBM MQ
- CVE-2017-1461IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting.IBM Rational DOORS Next Generation
- CVE-2017-1484IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 could allow an authenticated attacker to obtain informatIBM WebSphere Commerce Enterprise
- CVE-2017-1560IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting.IBM Rational DOORS Next Generation
- CVE-2017-1570IBM Jazz Foundation products could allow an authenticated user to obtain sensitive information from stack traces.IBM Rational Collaborative Lifecycle Management
- CVE-2017-1593IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting.IBM Rational DOORS Next Generation
- CVE-2017-1607IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting.IBM Rational DOORS Next Generation
- CVE-2017-1628IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect auIBM Business Process Manager
- CVE-2017-1650IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting.IBM Rational DOORS Next Generation
- CVE-2017-1678IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting.IBM Rational DOORS Next Generation
- CVE-2017-1688IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting.IBM Rational DOORS Next Generation
- CVE-2017-1689IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting.IBM Rational DOORS Next Generation
- CVE-2017-15051Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrnilsteampassnet/teampass
- CVE-2017-15052TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php.nilsteampassnet/teampass
- CVE-2017-15053TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php.nilsteampassnet/teampass
- CVE-2017-15054An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leanilsteampassnet/teampass
- CVE-2017-15055TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php.nilsteampassnet/teampass
- CVE-2017-16994The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local us
- CVE-2017-9316Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products.Dahua Technologies IPC-HDW4300S\NVR11HS\IPC-HFW4X00\IPC-HDW…
- CVE-2017-0910In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realZulip Server
- CVE-2017-14585A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators.Atlassian Hipchat Server · Atlassian Hipchat Data Center
- CVE-2017-14586The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing.Atlassian Hipchat for Mac desktop client
- CVE-2017-15114When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority
- CVE-2017-1000159Command injection in evince via filename when printing to PDF.
- CVE-2017-1000207A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary cio.swagger:swagger-parser · io.swagger:swagger-codegen
- CVE-2017-1000214GitPHP by xiphux is vulnerable to OS Command Injections
- CVE-2017-1001002math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine.math.js · mathjs
- CVE-2017-1001003math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creatinmath.js · mathjs
- CVE-2017-1001004typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine.typed-function
- CVE-2017-15100An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking onForeman Project Foreman
- CVE-2017-14176Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dBazaar through · bzr
- CVE-2017-14390In Cloud Foundry Foundation cf-deployment v0.35.0, a misconfiguration with Loggregator and syslog-drain causes logs to be drained to unintencf-deployment cf-deployment
- CVE-2017-16955SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbitrary SQL commands via
- CVE-2017-16956b3log Symphony (aka Sym) 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a second private letter wit
- CVE-2017-16957TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in t
- CVE-2017-16958TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in t
- CVE-2017-16959The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the exis
- CVE-2017-16960TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in t
- CVE-2017-16961A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated attackers to obtain inf
- CVE-2017-16962The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location o
- CVE-2017-4995An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1.Spring Security Spring Security 4.2.0.RELEASE 4.2.2.RELEASE…
- CVE-2017-8028In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using Spring-LDAP Spring-LDAP versions 1.3.0 · org.springframewor…
- CVE-2017-8031An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versicf-release and UAA cf-release: All versions prior to v279,…
- CVE-2017-8038In Cloud Foundry Foundation Credhub-release version 1.1.0, access control lists (ACLs) enforce whether an authenticated user can perform an Credhub Credhub-release
- CVE-2017-8039An issue was discovered in Pivotal Spring Web Flow through 2.4.5.Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older un…
- CVE-2017-8044In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3), certain pages allow code to be injectedSingle Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.…
- CVE-2017-8045In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized wheSpring AMQP Spring AMQP versions prior to 1.7.4, 1.6.11, an…