# CVEs published 2017-12-01

41 CVEs were published on December 1, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-13663](https://cve.now/CVE-2017-13663.md): Encryption key exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to decrypt log files via an… (no CVSS)
- [CVE-2017-13664](https://cve.now/CVE-2017-13664.md): Password file exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to execute arbitrary commands with… (no CVSS)
- [CVE-2017-14486](https://cve.now/CVE-2017-14486.md): The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages with other apps… (no CVSS)
- [CVE-2017-14487](https://cve.now/CVE-2017-14487.md): The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses… (no CVSS)
- [CVE-2017-14953](https://cve.now/CVE-2017-14953.md): HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically proximate attackers to trigger association with an… (no CVSS)
- [CVE-2017-15357](https://cve.now/CVE-2017-15357.md): The setpermissions function in the auto-updater in Arq before 5.9.7 for Mac allows local users to gain root privileges via a symlink… (no CVSS)
- [CVE-2017-16611](https://cve.now/CVE-2017-16611.md): In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape… (no CVSS)
- [CVE-2017-16612](https://cve.now/CVE-2017-16612.md): libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g… (no CVSS)
- [CVE-2017-16893](https://cve.now/CVE-2017-16893.md): The application Piwigo is affected by an SQL injection vulnerability in version 2.9.2 and possibly prior. (no CVSS)
- [CVE-2017-16895](https://cve.now/CVE-2017-16895.md): The (1) arq\_updater, (2) arqcommitter, (3) standardrestorer, (4) arqglacierrestorer, and (5) arqs3glacierrestorer helper apps in Arq 5.x… (no CVSS)
- [CVE-2017-16953](https://cve.now/CVE-2017-16953.md): connoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, which allows remote attackers to modify the PPPoE… (no CVSS)
- [CVE-2017-15707](https://cve.now/CVE-2017-15707.md): In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack… (no CVSS, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2017-15701](https://cve.now/CVE-2017-15701.md): In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0… (no CVSS, Apache Software Foundation Apache Qpid Broker-J · org.apach…)
- [CVE-2017-15702](https://cve.now/CVE-2017-15702.md): In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of… (no CVSS, Apache Software Foundation Apache Qpid Broker-J · org.apach…)
- [CVE-2017-10861](https://cve.now/CVE-2017-10861.md): Directory traversal vulnerability in QND Advance/Standard allows an attacker to read arbitrary files via a specially crafted command. (no CVSS, QualitySoft QND Advance/Standard)
- [CVE-2017-10874](https://cve.now/CVE-2017-10874.md): PWR-Q200 does not use random values for source ports of DNS query packets, which allows remote attackers to conduct DNS cache poisoning… (no CVSS, NIPPON TELEGRAPH AND TELEPHONE EAST PWR-Q200)
- [CVE-2017-10891](https://cve.now/CVE-2017-10891.md): Untrusted search path vulnerability in Media Go version 3.2.0.191 and earlier allows an attacker to gain privileges via a Trojan horse DLL… (no CVSS, Sony Video & Sound Products Media Go)
- [CVE-2017-10892](https://cve.now/CVE-2017-10892.md): Untrusted search path vulnerability in Music Center for PC version 1.0.00 allows an attacker to gain privileges via a Trojan horse DLL in… (no CVSS, Sony Video & Sound Products Music Center for PC)
- [CVE-2017-10894](https://cve.now/CVE-2017-10894.md): StreamRelay.NET.exe ver2.14.0.7 and earlier allows remote attackers to cause a denial of service via unspecified vectors. (no CVSS, Tomoki Sanaki StreamRelay.NET.exe)
- [CVE-2017-10895](https://cve.now/CVE-2017-10895.md): sDNSProxy.exe ver1.1.0.0 and earlier allows remote attackers to cause a denial of service via unspecified vectors. (no CVSS, Tomoki Sanaki sDNSProxy.exe)
- [CVE-2017-10898](https://cve.now/CVE-2017-10898.md): SQL injection vulnerability in the A-Member and A-Member for MT cloud versions 3.8.6 and earlier allows an attacker to execute arbitrary… (no CVSS, Princeton A-Member)
- [CVE-2017-10899](https://cve.now/CVE-2017-10899.md): SQL injection vulnerability in the A-Reserve and A-Reserve for MT cloud versions 3.8.6 and earlier allows an attacker to execute arbitrary… (no CVSS, Princeton A-Reserve)
- [CVE-2017-10900](https://cve.now/CVE-2017-10900.md): PTW-WMS1 firmware version 2.000.012 allows remote attackers to bypass access restrictions to obtain or delete data on the disk via… (no CVSS, Princeton PTW-WMS1)
- [CVE-2017-10901](https://cve.now/CVE-2017-10901.md): Buffer overflow in PTW-WMS1 firmware version 2.000.012 allows remote attackers to conduct denial-of-service attacks via unspecified vectors. (no CVSS, Princeton PTW-WMS1)
- [CVE-2017-10902](https://cve.now/CVE-2017-10902.md): PTW-WMS1 firmware version 2.000.012 allows remote attackers to execute arbitrary OS commands via unspecified vectors. (no CVSS, Princeton PTW-WMS1)
- [CVE-2017-10903](https://cve.now/CVE-2017-10903.md): Improper authentication issue in PTW-WMS1 firmware version 2.000.012 allows remote attackers to log in to the device with root privileges… (no CVSS, Princeton PTW-WMS1)
- [CVE-2017-11281](https://cve.now/CVE-2017-11281.md): Adobe Flash Player has an exploitable memory corruption vulnerability in the text handling function. (no CVSS, Adobe Flash Player 26.0.0.151 and earlier versions)
- [CVE-2017-11282](https://cve.now/CVE-2017-11282.md): Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. (no CVSS, Adobe Flash Player 26.0.0.151 and earlier versions)
- [CVE-2017-11283](https://cve.now/CVE-2017-11283.md): Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. (no CVSS, Adobe ColdFusion Update 4 and earlier versions for ColdFusi…)
- [CVE-2017-11284](https://cve.now/CVE-2017-11284.md): Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. (no CVSS, Adobe ColdFusion Update 4 and earlier versions for ColdFusi…)
- [CVE-2017-11285](https://cve.now/CVE-2017-11285.md): Adobe ColdFusion has a cross-site scripting (XSS) vulnerability. (no CVSS, Adobe ColdFusion Update 4 and earlier versions for ColdFusi…)
- [CVE-2017-11286](https://cve.now/CVE-2017-11286.md): Adobe ColdFusion has an XML external entity (XXE) injection vulnerability. (no CVSS, Adobe ColdFusion Update 4 and earlier versions for ColdFusi…)
- [CVE-2017-15607](https://cve.now/CVE-2017-15607.md): Inedo Otter before 1.7.4 has directory traversal in filesystem-based rafts via vectors involving '/' characters or initial '.' characters… (no CVSS)
- [CVE-2017-17083](https://cve.now/CVE-2017-17083.md): In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the NetBIOS dissector could crash. (no CVSS)
- [CVE-2017-17084](https://cve.now/CVE-2017-17084.md): In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the IWARP\_MPA dissector could crash. (no CVSS)
- [CVE-2017-17085](https://cve.now/CVE-2017-17085.md): In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. (no CVSS)
- [CVE-2017-17086](https://cve.now/CVE-2017-17086.md): Indeo Otter through 1.7.4 mishandles a "\</script\>" substring in an initial DP payload, which allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2017-17087](https://cve.now/CVE-2017-17087.md): fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the… (no CVSS)
- [CVE-2017-3104](https://cve.now/CVE-2017-3104.md): Adobe RoboHelp has a cross-site scripting (XSS) vulnerability. (no CVSS, Adobe RoboHelp RH2017.0.1 and earlier versions)
- [CVE-2017-3105](https://cve.now/CVE-2017-3105.md): Adobe RoboHelp has an Open Redirect vulnerability. (no CVSS, Adobe RoboHelp RH2017.0.1 and earlier versions)
- [CVE-2017-6679](https://cve.now/CVE-2017-6679.md): The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel (SSH) which auto… (no CVSS, Cisco Umbrella Virtual Appliance)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-12-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.