# CVEs published 2017-11-27

55 CVEs were published on November 27, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2015-7267](https://cve.now/CVE-2015-7267.md): Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when in sleep mode and operating in Opa (no CVSS)
- [CVE-2015-7268](https://cve.now/CVE-2015-7268.md): Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when used on Windows and operating in O (no CVSS)
- [CVE-2015-7269](https://cve.now/CVE-2015-7269.md): Seagate ST500LT015 hard disk drives, when operating in eDrive mode on Lenovo ThinkPad W541 laptops with BIOS 2.21, allow physically proximat (no CVSS)
- [CVE-2017-14746](https://cve.now/CVE-2017-14746.md): Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request. (no CVSS)
- [CVE-2017-15275](https://cve.now/CVE-2017-15275.md): Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap (no CVSS)
- [CVE-2016-6024](https://cve.now/CVE-2016-6024.md): IBM Jazz technology based products might divulge information that might be useful in helping attackers through error messages. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2017-1240](https://cve.now/CVE-2017-1240.md): IBM Rhapsody DM products could reveal sensitive information in HTTP 500 Internal Server Error responses. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2017-1251](https://cve.now/CVE-2017-1251.md): An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2017-1283](https://cve.now/CVE-2017-1283.md): IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user to cause a shared memory leak by MQ applications using dynamic queues, which (no CVSS, IBM MQ)
- [CVE-2017-1461](https://cve.now/CVE-2017-1461.md): IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS Next Generation)
- [CVE-2017-1484](https://cve.now/CVE-2017-1484.md): IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 could allow an authenticated attacker to obtain informat (no CVSS, IBM WebSphere Commerce Enterprise)
- [CVE-2017-1560](https://cve.now/CVE-2017-1560.md): IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS Next Generation)
- [CVE-2017-1570](https://cve.now/CVE-2017-1570.md): IBM Jazz Foundation products could allow an authenticated user to obtain sensitive information from stack traces. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2017-1593](https://cve.now/CVE-2017-1593.md): IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS Next Generation)
- [CVE-2017-1607](https://cve.now/CVE-2017-1607.md): IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS Next Generation)
- [CVE-2017-1628](https://cve.now/CVE-2017-1628.md): IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect au (no CVSS, IBM Business Process Manager)
- [CVE-2017-1650](https://cve.now/CVE-2017-1650.md): IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS Next Generation)
- [CVE-2017-1678](https://cve.now/CVE-2017-1678.md): IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS Next Generation)
- [CVE-2017-1688](https://cve.now/CVE-2017-1688.md): IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS Next Generation)
- [CVE-2017-1689](https://cve.now/CVE-2017-1689.md): IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS Next Generation)
- [CVE-2017-15051](https://cve.now/CVE-2017-15051.md): Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitr (no CVSS, nilsteampassnet/teampass)
- [CVE-2017-15052](https://cve.now/CVE-2017-15052.md): TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. (no CVSS, nilsteampassnet/teampass)
- [CVE-2017-15053](https://cve.now/CVE-2017-15053.md): TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. (no CVSS, nilsteampassnet/teampass)
- [CVE-2017-15054](https://cve.now/CVE-2017-15054.md): An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files lea (no CVSS, nilsteampassnet/teampass)
- [CVE-2017-15055](https://cve.now/CVE-2017-15055.md): TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. (no CVSS, nilsteampassnet/teampass)
- [CVE-2017-16994](https://cve.now/CVE-2017-16994.md): The walk\_hugetlb\_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local us (no CVSS)
- [CVE-2017-9316](https://cve.now/CVE-2017-9316.md): Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. (no CVSS, Dahua Technologies IPC-HDW4300S\\NVR11HS\\IPC-HFW4X00\\IPC-HDW…)
- [CVE-2017-0910](https://cve.now/CVE-2017-0910.md): In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one real (no CVSS, Zulip Server)
- [CVE-2017-14585](https://cve.now/CVE-2017-14585.md): A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. (no CVSS, Atlassian Hipchat Server · Atlassian Hipchat Data Center)
- [CVE-2017-14586](https://cve.now/CVE-2017-14586.md): The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. (no CVSS, Atlassian Hipchat for Mac desktop client)
- [CVE-2017-15114](https://cve.now/CVE-2017-15114.md): When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority (no CVSS)
- [CVE-2017-1000159](https://cve.now/CVE-2017-1000159.md): Command injection in evince via filename when printing to PDF. (no CVSS)
- [CVE-2017-1000207](https://cve.now/CVE-2017-1000207.md): A vulnerability in Swagger-Parser's version \<= 1.0.30 and Swagger codegen version \<= 2.2.2 yaml parsing functionality results in arbitrary c (no CVSS, io.swagger:swagger-parser · io.swagger:swagger-codegen)
- [CVE-2017-1000214](https://cve.now/CVE-2017-1000214.md): GitPHP by xiphux is vulnerable to OS Command Injections (no CVSS)
- [CVE-2017-1001002](https://cve.now/CVE-2017-1001002.md): math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. (no CVSS, math.js · mathjs)
- [CVE-2017-1001003](https://cve.now/CVE-2017-1001003.md): math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creatin (no CVSS, math.js · mathjs)
- [CVE-2017-1001004](https://cve.now/CVE-2017-1001004.md): typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. (no CVSS, typed-function)
- [CVE-2017-15100](https://cve.now/CVE-2017-15100.md): An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on (no CVSS, Foreman Project Foreman)
- [CVE-2017-14176](https://cve.now/CVE-2017-14176.md): Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial d (no CVSS, Bazaar through · bzr)
- [CVE-2017-14390](https://cve.now/CVE-2017-14390.md): In Cloud Foundry Foundation cf-deployment v0.35.0, a misconfiguration with Loggregator and syslog-drain causes logs to be drained to uninten (no CVSS, cf-deployment cf-deployment)
- [CVE-2017-16955](https://cve.now/CVE-2017-16955.md): SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbitrary SQL commands via (no CVSS)
- [CVE-2017-16956](https://cve.now/CVE-2017-16956.md): b3log Symphony (aka Sym) 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a second private letter wit (no CVSS)
- [CVE-2017-16957](https://cve.now/CVE-2017-16957.md): TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in t (no CVSS)
- [CVE-2017-16958](https://cve.now/CVE-2017-16958.md): TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in t (no CVSS)
- [CVE-2017-16959](https://cve.now/CVE-2017-16959.md): The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the exis (no CVSS)
- [CVE-2017-16960](https://cve.now/CVE-2017-16960.md): TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in t (no CVSS)
- [CVE-2017-16961](https://cve.now/CVE-2017-16961.md): A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated attackers to obtain inf (no CVSS)
- [CVE-2017-16962](https://cve.now/CVE-2017-16962.md): The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location o (no CVSS)
- [CVE-2017-4995](https://cve.now/CVE-2017-4995.md): An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. (no CVSS, Spring Security Spring Security 4.2.0.RELEASE 4.2.2.RELEASE…)
- [CVE-2017-8028](https://cve.now/CVE-2017-8028.md): In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using (no CVSS, Spring-LDAP Spring-LDAP versions 1.3.0 · org.springframewor…)
- [CVE-2017-8031](https://cve.now/CVE-2017-8031.md): An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versi (no CVSS, cf-release and UAA cf-release: All versions prior to v279,…)
- [CVE-2017-8038](https://cve.now/CVE-2017-8038.md): In Cloud Foundry Foundation Credhub-release version 1.1.0, access control lists (ACLs) enforce whether an authenticated user can perform an (no CVSS, Credhub Credhub-release)
- [CVE-2017-8039](https://cve.now/CVE-2017-8039.md): An issue was discovered in Pivotal Spring Web Flow through 2.4.5. (no CVSS, Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older un…)
- [CVE-2017-8044](https://cve.now/CVE-2017-8044.md): In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3), certain pages allow code to be injected (no CVSS, Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.…)
- [CVE-2017-8045](https://cve.now/CVE-2017-8045.md): In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized whe (no CVSS, Spring AMQP Spring AMQP versions prior to 1.7.4, 1.6.11, an…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-11-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.