# CVEs published 2017-11-28

16 CVEs were published on November 28, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-17044](https://cve.now/CVE-2017-17044.md): An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to cause a denial of service (infinite loop and host OS hang) by le (no CVSS)
- [CVE-2017-17045](https://cve.now/CVE-2017-17045.md): An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to gain privileges on the host OS, obtain sensitive information, or (no CVSS)
- [CVE-2017-17046](https://cve.now/CVE-2017-17046.md): An issue was discovered in Xen through 4.9.x on the ARM platform allowing guest OS users to obtain sensitive information from DRAM after a r (no CVSS)
- [CVE-2017-17043](https://cve.now/CVE-2017-17043.md): The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketp (no CVSS)
- [CVE-2017-17042](https://cve.now/CVE-2017-17042.md): lib/yard/core\_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attac (no CVSS, yard)
- [CVE-2017-9315](https://cve.now/CVE-2017-9315.md): Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua autho (no CVSS, Dahua Technologies Dahua IP Camera and IP PTZ IPC-HFW1XXX,…)
- [CVE-2017-15673](https://cve.now/CVE-2017-15673.md): The files function in the administration section in CS-Cart 4.6.2 and earlier allows attackers to execute arbitrary PHP code via vectors inv (no CVSS)
- [CVE-2017-16951](https://cve.now/CVE-2017-16951.md): Winamp Pro 5.66 Build 3512 allows remote attackers to cause a denial of service via a crafted WAV, WMV, AU, ASF, AIFF, or AIF file. (no CVSS)
- [CVE-2017-16952](https://cve.now/CVE-2017-16952.md): KMPlayer 4.2.2.4 allows remote attackers to cause a denial of service via a crafted NSV file. (no CVSS)
- [CVE-2016-10702](https://cve.now/CVE-2016-10702.md): Pebble Smartwatch devices through 4.3 mishandle UUID storage, which allows attackers to read an arbitrary application's flash storage, and a (no CVSS)
- [CVE-2017-14379](https://cve.now/CVE-2017-14379.md): EMC RSA Authentication Manager before 8.2 SP1 P6 has a cross-site scripting vulnerability that could potentially be exploited by malicious u (no CVSS, RSA Authentication Manager software)
- [CVE-2017-14389](https://cve.now/CVE-2017-14389.md): An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), an (no CVSS, Cloud Foundry capi-release: All versions prior to 1.45.0, c…)
- [CVE-2017-8001](https://cve.now/CVE-2017-8001.md): An issue was discovered in EMC ScaleIO 2.0.1.x. (no CVSS, EMC ScaleIO EMC ScaleIO 2.0.1.x)
- [CVE-2017-8019](https://cve.now/CVE-2017-8019.md): An issue was discovered in EMC ScaleIO 2.0.1.x. (no CVSS, EMC ScaleIO EMC ScaleIO 2.0.1.x)
- [CVE-2017-8020](https://cve.now/CVE-2017-8020.md): An issue was discovered in EMC ScaleIO 2.0.1.x. (no CVSS, EMC ScaleIO EMC ScaleIO 2.0.1.x)
- [CVE-2016-10701](https://cve.now/CVE-2016-10701.md): In Hitachi Vantara Pentaho BA Platform through 8.0, a CSRF issue exists in the Business Analytics application. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-11-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.