Skip to content
OpenAdvisories

Archive

November 2017

Vulnerabilities first published in this month (UTC), newest first.

← October 2017 2017 / November December 2017 →
  1. 133
  2. 223
  3. 333
  4. 417
  5. 54
  6. 629
  7. 744
  8. 821
  9. 933
  10. 1013
  11. 111
  12. 126
  13. 1397
  14. 1422
  15. 1591
  16. 16124
  17. 17100
  18. 184
  19. 191
  20. 2026
  21. 2119
  22. 22162
  23. 237
  24. 247
  25. 255
  26. 261
  27. 2755
  28. 2816
  29. 2916
  30. 3058
All Critical High Medium Low Exploited only Public exploit

58 results · Clear filters · Feed

  • High 8.8
    CVE-2017-9096 Public exploit

    Improper Restriction of XML External Entity Reference in iText

    The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.

    com.itextpdf:itextpdf com.lowagie:itext Maven
  • High 7.4
    CVE-2017-12094

    An exploitable vulnerability exists in the WiFi Channel parsing of Circle with Disney running firmware 2.0.1. A special…

    Circle Media Circle
  • High 8.0
    CVE-2017-12084

    A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specifi…

    Circle Media Circle
  • High 8.1
    CVE-2017-2921

    An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.…

    Cesanta Software mongoose smplayer Debian
  • High 7.5
    CVE-2017-2889

    An exploitable Denial of Service vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A…

    Circle Media Circle
  • High 7.5
    CVE-2017-2884

    An exploitable vulnerability exists in the user photo update functionality of Circle with Disney running firmware 2.0.1…

    Circle Media Circle
  • High 8.1
    CVE-2017-2864

    An exploitable vulnerability exists in the generation of authentication token functionality of Circle with Disney. Spec…

    Circle Media Circle
  • High 7.5
    CVE-2017-2893 EPSS 25%

    An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoo…

    Cesanta Software mongoose smplayer Debian
  • High 8.1
    CVE-2017-2913

    An exploitable vulnerability exists in the filtering functionality of Circle with Disney. SSL certificates for specific…

    Circle Media Circle
  • High 8.2
    CVE-2017-2895

    An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose …

    Cesanta Software mongoose smplayer Debian
  • High 7.4
    CVE-2017-2912

    An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. S…

    Circle Media Circle
  • High 7.5
    CVE-2017-2909

    An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially …

    Cesanta Software mongoose smplayer Debian
  • High 7.8
    CVE-2015-7529

    SoSReport Predictable Tmp File Names

    sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$dat…

    sosreport sosreport sosreport Debian Ubuntu PyPI
  • High 7.6
    CVE-2017-7425

    Multiple Reflected XSS in iManager

    Multiple potential reflected XSS issues exist in NetIQ iManager versions before 2.7.7 Patch 10 HF2 and 3.0.3.2.

    NetIQ NetIQ iManager
  • High 8.8
    CVE-2017-16570 Public exploit

    Cross-Site Request Forgery (CSRF) in keystone

    KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header.

    keystone npm
  • High 7.5
    CVE-2017-16516

    yajl-ruby gem Denial of Service vulnerability

    In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and pote…

    r-cran-jsonlite yajl yajl ruby-yajl Debian Ubuntu RubyGems
  • High 8.8
    CVE-2017-1000244

    Jenkins Favorite Plugin vulnerable to Cross-Site Request Forgery

    Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification

    org.jvnet.hudson.plugins:favorite Maven
  • High 8.8
    CVE-2017-16244 Public exploit

    October CMS CSRF

    Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving …

    october/october Packagist