# CVEs published 2017-12-18

31 CVEs were published on December 18, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-15700](https://cve.now/CVE-2017-15700.md): A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker… (no CVSS, Apache Software Foundation Apache Sling · org.apache.sling:…)
- [CVE-2017-15103](https://cve.now/CVE-2017-15103.md): A security-check flaw was found in the way the Heketi 5 server API handled user requests. (no CVSS, Heketi · github.com/heketi/heketi)
- [CVE-2017-15104](https://cve.now/CVE-2017-15104.md): An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. (no CVSS, Heketi · github.com/heketi/heketi)
- [CVE-2017-11562](https://cve.now/CVE-2017-11562.md): A Session Fixation Vulnerability exists in the MT4 Networks SenhaSegura Web Application 2.2.23.8 via login\_if.php. (no CVSS)
- [CVE-2017-15524](https://cve.now/CVE-2017-15524.md): The Application Firewall Pack (AFP, aka Web Application Firewall) component on Kemp Load Balancer devices with software before 7.2.40.1… (no CVSS)
- [CVE-2017-15875](https://cve.now/CVE-2017-15875.md): SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the… (no CVSS)
- [CVE-2017-15876](https://cve.now/CVE-2017-15876.md): Unrestricted File Upload vulnerability in GPWeb 8.4.61 allows remote authenticated users to upload any type of file, including a PHP shell. (no CVSS)
- [CVE-2017-15877](https://cve.now/CVE-2017-15877.md): Insecure Permissions vulnerability in db.php file in GPWeb 8.4.61 allows remote attackers to view the password and user database. (no CVSS)
- [CVE-2017-16949](https://cve.now/CVE-2017-16949.md): An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. (no CVSS)
- [CVE-2017-17105](https://cve.now/CVE-2017-17105.md): Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras are vulnerable to unauthenticated, blind… (no CVSS)
- [CVE-2017-17106](https://cve.now/CVE-2017-17106.md): Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web… (no CVSS)
- [CVE-2017-17107](https://cve.now/CVE-2017-17107.md): Zivif PR115-204-P-RS V2.3.4.2103 web cameras contain a hard-coded cat1029 password for the root user. (no CVSS)
- [CVE-2017-17721](https://cve.now/CVE-2017-17721.md): CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, assignto, building… (no CVSS)
- [CVE-2017-12630](https://cve.now/CVE-2017-12630.md): In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take… (no CVSS, Apache Software Foundation Apache Drill · org.apache.drill:…)
- [CVE-2017-14583](https://cve.now/CVE-2017-14583.md): NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and 9.2P2 are susceptible to a vulnerability which allows an attacker to cause a… (no CVSS)
- [CVE-2017-17643](https://cve.now/CVE-2017-17643.md): FS Lynda Clone 1.0 has SQL Injection via the keywords parameter to tutorial/. (no CVSS)
- [CVE-2017-17645](https://cve.now/CVE-2017-17645.md): Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php. (no CVSS)
- [CVE-2017-17649](https://cve.now/CVE-2017-17649.md): Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter. (no CVSS)
- [CVE-2017-17651](https://cve.now/CVE-2017-17651.md): Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the… (no CVSS)
- [CVE-2017-17741](https://cve.now/CVE-2017-17741.md): The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory… (no CVSS)
- [CVE-2017-17734](https://cve.now/CVE-2017-17734.md): CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions. (no CVSS)
- [CVE-2017-17735](https://cve.now/CVE-2017-17735.md): CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies. (no CVSS)
- [CVE-2017-17737](https://cve.now/CVE-2017-17737.md): The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network\_diagnostics.html or… (no CVSS)
- [CVE-2017-17738](https://cve.now/CVE-2017-17738.md): The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and modifying files via /tools.html. (no CVSS)
- [CVE-2017-17739](https://cve.now/CVE-2017-17739.md): The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html rp parameter… (no CVSS)
- [CVE-2017-17740](https://cve.now/CVE-2017-17740.md): contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to… (no CVSS)
- [CVE-2017-17727](https://cve.now/CVE-2017-17727.md): DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the… (no CVSS)
- [CVE-2017-17730](https://cve.now/CVE-2017-17730.md): DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink\_add.php. (no CVSS)
- [CVE-2017-17731](https://cve.now/CVE-2017-17731.md): DedeCMS through 5.7 has SQL Injection via the $\_FILES superglobal to plus/recommend.php. (no CVSS)
- [CVE-2017-17733](https://cve.now/CVE-2017-17733.md): Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request. (no CVSS)
- [CVE-2017-16997](https://cve.now/CVE-2017-16997.md): elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged… (no CVSS, glibc 2.19 through)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-12-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.