Skip to content
OpenAdvisories

Archive

November 2017

Vulnerabilities first published in this month (UTC), newest first.

← October 2017 2017 / November December 2017 →
  1. 133
  2. 223
  3. 333
  4. 417
  5. 54
  6. 629
  7. 744
  8. 821
  9. 933
  10. 1013
  11. 111
  12. 126
  13. 1397
  14. 1422
  15. 1591
  16. 16124
  17. 17100
  18. 184
  19. 191
  20. 2026
  21. 2119
  22. 22162
  23. 237
  24. 247
  25. 255
  26. 261
  27. 2755
  28. 2816
  29. 2916
  30. 3058
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.5
    CVE-2017-17058 Public exploit EPSS 24%

    The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooc…

  • High 7.5
    CVE-2017-1000170 Public exploit EPSS 59%

    jqueryFileTree vulnerable to Directory Traversal

    jqueryFileTree 2.1.5 and older Directory Traversal

    jqueryfiletree npm
  • High 8.1
    CVE-2017-15806 Public exploit EPSS 11%

    Zeta Components Mail Arbitrary code execution via a crafted email address

    The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email …

    zetacomponents/mail Packagist
  • High 7.8
    CVE-2017-11882 Exploited · Ransomware Public exploit EPSS 100%

    Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and M…

    Microsoft Microsoft Office
    KEV Nov 3, 2021
  • High 7.5
    CVE-2017-11870 Public exploit EPSS 60%

    Chakra Core vulnerable to privilege escalation when writing to JavaScript null scope objects

    ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vu…

    Microsoft ChakraCore, Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  • High 7.8
    CVE-2017-16651 Exploited Public exploit EPSS 46%

    Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary fil…

    roundcube roundcube roundcubemail Debian Ubuntu Alpine
    KEV Nov 3, 2021
  • High 8.8
    CVE-2017-9096 Public exploit

    Improper Restriction of XML External Entity Reference in iText

    The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.

    com.itextpdf:itextpdf com.lowagie:itext Maven
  • High 8.8
    CVE-2017-16570 Public exploit

    Cross-Site Request Forgery (CSRF) in keystone

    KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header.

    keystone npm
  • High 8.8
    CVE-2017-16244 Public exploit

    October CMS CSRF

    Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving …

    october/october Packagist