# CVEs published 2017-11-29

16 CVEs were published on November 29, 2017: 2 critical, 1 high. Days are UTC.

- [CVE-2017-14591](https://cve.now/CVE-2017-14591.md): Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercuria (no CVSS, Atlassian Fisheye and Crucible)
- [CVE-2017-14186](https://cve.now/CVE-2017-14186.md): A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web port (no CVSS, Fortinet FortiOS)
- [CVE-2017-14189](https://cve.now/CVE-2017-14189.md): An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log (no CVSS, Fortinet FortiWebManager)
- [CVE-2017-14377](https://cve.now/CVE-2017-14377.md): EMC RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 pr (no CVSS, RSA Authentication Agent for Web for Apache Web Server RSA…)
- [CVE-2017-14378](https://cve.now/CVE-2017-14378.md): EMC RSA Authentication Agent API 8.5 for C and RSA Authentication Agent SDK 8.6 for C allow attackers to bypass authentication, aka an "Erro (no CVSS, RSA Authentication Agent SDK RSA Authentication Agent API 8…)
- [CVE-2017-8816](https://cve.now/CVE-2017-8816.md): The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer (CVSS 9.8, curl and libcurl before)
- [CVE-2017-8817](https://cve.now/CVE-2017-8817.md): The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and app (CVSS 9.8, curl and libcurl before)
- [CVE-2017-8818](https://cve.now/CVE-2017-8818.md): curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) (no CVSS, curl and libcurl before)
- [CVE-2017-13872](https://cve.now/CVE-2017-13872.md): An issue was discovered in certain Apple products. (no CVSS, macOS High Sierra)
- [CVE-2017-17059](https://cve.now/CVE-2017-17059.md): XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to (no CVSS)
- [CVE-2017-17054](https://cve.now/CVE-2017-17054.md): In aubio 0.4.6, a divide-by-zero error exists in the function new\_aubio\_source\_wavread() in source\_wavread.c, which may lead to DoS when pla (no CVSS, aubio)
- [CVE-2017-17058](https://cve.now/CVE-2017-17058.md): The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/ema (CVSS 7.5)
- [CVE-2017-17049](https://cve.now/CVE-2017-17049.md): TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified (no CVSS)
- [CVE-2017-17050](https://cve.now/CVE-2017-17050.md): TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified (no CVSS)
- [CVE-2017-17052](https://cve.now/CVE-2017-17052.md): The mm\_init function in kernel/fork.c in the Linux kernel before 4.12.10 does not clear the -\>exe\_file member of a new process's mm\_struct, (no CVSS)
- [CVE-2017-17053](https://cve.now/CVE-2017-17053.md): The init\_new\_context function in arch/x86/include/asm/mmu\_context.h in the Linux kernel before 4.12.10 does not correctly handle errors from (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-11-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.