# CVEs published 2017-12-20

133 CVEs were published on December 20, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-14385](https://cve.now/CVE-2017-14385.md): An issue was discovered in EMC Data Domain DD OS 5.7 family, versions prior to 5.7.5.6; EMC Data Domain DD OS 6.0 family, versions prior… (no CVSS, EMC Data Domain DD OS EMC Data Domain DD OS 5.7 family, ver…)
- [CVE-2017-14387](https://cve.now/CVE-2017-14387.md): The NFS service in EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, and 8.0.0.0 - 8.0.0.4 maintains default NFS export settings (including the… (no CVSS, EMC Isilon OneFS EMC Isilon OneFS 8.1.0.0, EMC Isilon OneFS…)
- [CVE-2017-17805](https://cve.now/CVE-2017-17805.md): The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker… (no CVSS)
- [CVE-2017-17806](https://cve.now/CVE-2017-17806.md): The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash… (no CVSS)
- [CVE-2017-17807](https://cve.now/CVE-2017-17807.md): The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default… (no CVSS)
- [CVE-2017-17809](https://cve.now/CVE-2017-17809.md): In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers… (no CVSS)
- [CVE-2011-4955](https://cve.now/CVE-2011-4955.md): Multiple cross-site scripting (XSS) vulnerabilities in ui\_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote… (no CVSS)
- [CVE-2017-5254](https://cve.now/CVE-2017-5254.md): In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of… (no CVSS, Cambium Networks ePMP)
- [CVE-2017-5255](https://cve.now/CVE-2017-5255.md): In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management… (no CVSS, Cambium Networks ePMP)
- [CVE-2017-5256](https://cve.now/CVE-2017-5256.md): In version 3.5 and prior of Cambium Networks ePMP firmware, all authenticated users have the ability to update the Device Name and System… (no CVSS, Cambium Networks ePMP)
- [CVE-2017-5257](https://cve.now/CVE-2017-5257.md): In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows (or guesses) the SNMP read/write (RW) community string… (no CVSS, Cambium Networks ePMP)
- [CVE-2017-5258](https://cve.now/CVE-2017-5258.md): In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows or can guess the RW community string can provide a URL… (no CVSS, Cambium Networks ePMP)
- [CVE-2017-5259](https://cve.now/CVE-2017-5259.md): In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available… (no CVSS, Cambium Networks cnPilot)
- [CVE-2017-5260](https://cve.now/CVE-2017-5260.md): In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available… (no CVSS, Cambium Networks cnPilot)
- [CVE-2017-5261](https://cve.now/CVE-2017-5261.md): In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative… (no CVSS, Cambium Networks cnPilot)
- [CVE-2017-5262](https://cve.now/CVE-2017-5262.md): In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive… (no CVSS, Cambium Networks cnPilot)
- [CVE-2017-5263](https://cve.now/CVE-2017-5263.md): Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which… (no CVSS, Cambium Networks cnPilot)
- [CVE-2012-2576](https://cve.now/CVE-2012-2576.md): SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2… (no CVSS)
- [CVE-2017-17745](https://cve.now/CVE-2017-17745.md): Cross-site scripting (XSS) vulnerability in system\_name\_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit… (no CVSS)
- [CVE-2017-17746](https://cve.now/CVE-2017-17746.md): Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access… (no CVSS)
- [CVE-2017-17747](https://cve.now/CVE-2017-17747.md): Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout… (no CVSS)
- [CVE-2017-6094](https://cve.now/CVE-2017-6094.md): CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. (no CVSS)
- [CVE-2017-16717](https://cve.now/CVE-2017-16717.md): A Heap-based Buffer Overflow issue was discovered in WECON LeviStudio HMI. (no CVSS, WECON Technology Co., Ltd. LeviStudio HMI)
- [CVE-2017-16725](https://cve.now/CVE-2017-16725.md): A Stack-based Buffer Overflow issue was discovered in Xiongmai Technology IP Cameras and DVRs using the NetSurveillance Web interface. (no CVSS, Xiongmai Technology IP Cameras and DVRs)
- [CVE-2017-16731](https://cve.now/CVE-2017-16731.md): An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017… (no CVSS, ABB Ellipse)
- [CVE-2017-16733](https://cve.now/CVE-2017-16733.md): A SQL Injection issue was discovered in Ecava IntegraXor v 6.1.1030.1 and prior. (no CVSS, Ecava IntegraXor)
- [CVE-2017-16735](https://cve.now/CVE-2017-16735.md): A SQL Injection issue was discovered in Ecava IntegraXor v 6.1.1030.1 and prior. (no CVSS, Ecava IntegraXor)
- [CVE-2017-12072](https://cve.now/CVE-2017-12072.md): Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated… (no CVSS, Synology Photo Station)
- [CVE-2017-1257](https://cve.now/CVE-2017-1257.md): IBM Security Guardium 10.0 discloses sensitive information to unauthorized users. (no CVSS, IBM Security Guardium)
- [CVE-2017-1261](https://cve.now/CVE-2017-1261.md): IBM Security Guardium 10.0 stores potentially sensitive information in log files that could be read by a local user. (no CVSS, IBM Security Guardium)
- [CVE-2017-1262](https://cve.now/CVE-2017-1262.md): IBM Security Guardium 10.0 is vulnerable to HTTP response splitting attacks. (no CVSS, IBM Security Guardium)
- [CVE-2017-1266](https://cve.now/CVE-2017-1266.md): IBM Security Guardium 10.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or… (no CVSS, IBM Security Guardium)
- [CVE-2017-1270](https://cve.now/CVE-2017-1270.md): IBM Security Guardium 10.0 does not renew a session variable after a successful authentication which could lead to session… (no CVSS, IBM Security Guardium)
- [CVE-2017-1423](https://cve.now/CVE-2017-1423.md): IBM WebSphere Portal 8.5 and 9.0 exposes backend server URLs that are configured for usage by the Web Application Bridge component. (no CVSS, IBM WebSphere Portal)
- [CVE-2017-1494](https://cve.now/CVE-2017-1494.md): IBM Business Process Manager 8.5 is vulnerable to cross-site scripting. (no CVSS, IBM Business Process Manager Advanced)
- [CVE-2017-14962](https://cve.now/CVE-2017-14962.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Out of Bounds Write vulnerability because of not validating input… (no CVSS)
- [CVE-2017-14963](https://cve.now/CVE-2017-14963.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input… (no CVSS)
- [CVE-2017-14964](https://cve.now/CVE-2017-14964.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input… (no CVSS)
- [CVE-2017-14965](https://cve.now/CVE-2017-14965.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input… (no CVSS)
- [CVE-2017-14966](https://cve.now/CVE-2017-14966.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input… (no CVSS)
- [CVE-2017-14967](https://cve.now/CVE-2017-14967.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input… (no CVSS)
- [CVE-2017-14968](https://cve.now/CVE-2017-14968.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input… (no CVSS)
- [CVE-2017-14969](https://cve.now/CVE-2017-14969.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input… (no CVSS)
- [CVE-2017-15532](https://cve.now/CVE-2017-15532.md): Prior to 10.6.4, Symantec Messaging Gateway may be susceptible to a path traversal attack (also known as directory traversal). (no CVSS, Symantec Messaging Gateway)
- [CVE-2017-1595](https://cve.now/CVE-2017-1595.md): IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified… (no CVSS, IBM Security Guardium)
- [CVE-2017-1596](https://cve.now/CVE-2017-1596.md): IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified… (no CVSS, IBM Security Guardium)
- [CVE-2017-1598](https://cve.now/CVE-2017-1598.md): IBM Security Guardium 10.0 Database Activity Monitor uses weaker than expected cryptographic algorithms that could allow an attacker to… (no CVSS, IBM Security Guardium)
- [CVE-2017-1600](https://cve.now/CVE-2017-1600.md): IBM Security Guardium 10.0 Database Activity Monitor is vulnerable to cross-site scripting. (no CVSS, IBM Security Guardium)
- [CVE-2017-1631](https://cve.now/CVE-2017-1631.md): IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to… (no CVSS, IBM Tivoli Components)
- [CVE-2017-1694](https://cve.now/CVE-2017-1694.md): IBM Integration Bus 9.0 and 10.0 transmits user credentials in plain in clear text which can be read by an attacker using man in the… (no CVSS, IBM Integration Bus)
- [CVE-2017-1696](https://cve.now/CVE-2017-1696.md): IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. (no CVSS, IBM Security QRadar SIEM)
- [CVE-2017-1746](https://cve.now/CVE-2017-1746.md): IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to… (no CVSS, IBM Tivoli Components)
- [CVE-2017-1751](https://cve.now/CVE-2017-1751.md): IBM Robotic Process Automation with Automation Anywhere 10.0.0 is vulnerable to cross-site scripting. (no CVSS, IBM Robotic Process Automation with Automation Anywhere)
- [CVE-2017-1757](https://cve.now/CVE-2017-1757.md): IBM Security Guardium 10.0 is vulnerable to SQL injection. (no CVSS, IBM Security Guardium)
- [CVE-2017-16818](https://cve.now/CVE-2017-16818.md): RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and… (no CVSS)
- [CVE-2017-17476](https://cve.now/CVE-2017-17476.md): Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might… (no CVSS)
- [CVE-2017-17752](https://cve.now/CVE-2017-17752.md): Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail… (no CVSS)
- [CVE-2017-4933](https://cve.now/CVE-2017-4933.md): VMware ESXi (6.5 before ESXi650-201710401-BG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) contain a vulnerability… (no CVSS, VMware ESXi · VMware Workstation +1)
- [CVE-2017-4940](https://cve.now/CVE-2017-4940.md): The ESXi Host Client in VMware ESXi (6.5 before ESXi650-201712103-SG, 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG)… (no CVSS, VMware ESXi)
- [CVE-2017-4941](https://cve.now/CVE-2017-4941.md): VMware ESXi (6.0 before ESXi600-201711101-SG, 5.5 ESXi550-201709101-SG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9)… (no CVSS, VMware ESXi · VMware Workstation +1)
- [CVE-2017-4943](https://cve.now/CVE-2017-4943.md): VMware vCenter Server Appliance (vCSA) (6.5 before 6.5 U1d) contains a local privilege escalation vulnerability via the 'showlog' plugin. (no CVSS, VMware vCenter Server Appliance)
- [CVE-2017-10956](https://cve.now/CVE-2017-10956.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-10957](https://cve.now/CVE-2017-10957.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-10958](https://cve.now/CVE-2017-10958.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-10959](https://cve.now/CVE-2017-10959.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14818](https://cve.now/CVE-2017-14818.md): This vulnerability allows remote attackers to disclose sensitive on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14819](https://cve.now/CVE-2017-14819.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14820](https://cve.now/CVE-2017-14820.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14821](https://cve.now/CVE-2017-14821.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14822](https://cve.now/CVE-2017-14822.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14823](https://cve.now/CVE-2017-14823.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14824](https://cve.now/CVE-2017-14824.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14825](https://cve.now/CVE-2017-14825.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14826](https://cve.now/CVE-2017-14826.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14827](https://cve.now/CVE-2017-14827.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14828](https://cve.now/CVE-2017-14828.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14829](https://cve.now/CVE-2017-14829.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14830](https://cve.now/CVE-2017-14830.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14831](https://cve.now/CVE-2017-14831.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14832](https://cve.now/CVE-2017-14832.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14833](https://cve.now/CVE-2017-14833.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14834](https://cve.now/CVE-2017-14834.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14835](https://cve.now/CVE-2017-14835.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14836](https://cve.now/CVE-2017-14836.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1. (no CVSS, Foxit Reader)
- [CVE-2017-14837](https://cve.now/CVE-2017-14837.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16571](https://cve.now/CVE-2017-16571.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16572](https://cve.now/CVE-2017-16572.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16573](https://cve.now/CVE-2017-16573.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16574](https://cve.now/CVE-2017-16574.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16575](https://cve.now/CVE-2017-16575.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16576](https://cve.now/CVE-2017-16576.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16577](https://cve.now/CVE-2017-16577.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16578](https://cve.now/CVE-2017-16578.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16579](https://cve.now/CVE-2017-16579.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16580](https://cve.now/CVE-2017-16580.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16581](https://cve.now/CVE-2017-16581.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16582](https://cve.now/CVE-2017-16582.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16583](https://cve.now/CVE-2017-16583.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16584](https://cve.now/CVE-2017-16584.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16585](https://cve.now/CVE-2017-16585.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16586](https://cve.now/CVE-2017-16586.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16587](https://cve.now/CVE-2017-16587.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16588](https://cve.now/CVE-2017-16588.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16589](https://cve.now/CVE-2017-16589.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-17782](https://cve.now/CVE-2017-17782.md): In GraphicsMagick 1.3.27a, there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c, related to oFFs chunk allocation. (no CVSS)
- [CVE-2017-17783](https://cve.now/CVE-2017-17783.md): In GraphicsMagick 1.3.27a, there is a buffer over-read in ReadPALMImage in coders/palm.c when QuantumDepth is 8. (no CVSS)
- [CVE-2017-17784](https://cve.now/CVE-2017-17784.md): In GIMP 2.8.22, there is a heap-based buffer over-read in load\_image in plug-ins/common/file-gbr.c in the gbr import parser, related to… (no CVSS)
- [CVE-2017-17785](https://cve.now/CVE-2017-17785.md): In GIMP 2.8.22, there is a heap-based buffer overflow in the fli\_read\_brun function in plug-ins/file-fli/fli.c. (no CVSS)
- [CVE-2017-17786](https://cve.now/CVE-2017-17786.md): In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related to bgr2rgb.part.1) via an… (no CVSS)
- [CVE-2017-17787](https://cve.now/CVE-2017-17787.md): In GIMP 2.8.22, there is a heap-based buffer over-read in read\_creator\_block in plug-ins/common/file-psp.c. (no CVSS)
- [CVE-2017-17788](https://cve.now/CVE-2017-17788.md): In GIMP 2.8.22, there is a stack-based buffer over-read in xcf\_load\_stream in app/xcf/xcf.c when there is no '\\0' character after the… (no CVSS)
- [CVE-2017-17789](https://cve.now/CVE-2017-17789.md): In GIMP 2.8.22, there is a heap-based buffer overflow in read\_channel\_data in plug-ins/common/file-psp.c. (no CVSS)
- [CVE-2017-17790](https://cve.now/CVE-2017-17790.md): The lazy\_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as… (no CVSS)
- [CVE-2017-17792](https://cve.now/CVE-2017-17792.md): Cross site scripting (XSS) vulnerability in the markup\_clean\_href function in inc/conv.php in BlogoText through 3.7.6 allows remote… (no CVSS)
- [CVE-2017-17793](https://cve.now/CVE-2017-17793.md): Information Disclosure vulnerability in creer\_fichier\_zip in admin/maintenance.php in BlogoText through 3.7.6 allows remote attackers to… (no CVSS)
- [CVE-2017-17794](https://cve.now/CVE-2017-17794.md): validate\_form\_preferences in admin/preferences.php in BlogoText through 3.7.6 allows attackers to bypass intended access restrictions via… (no CVSS)
- [CVE-2017-17795](https://cve.now/CVE-2017-17795.md): In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have… (no CVSS)
- [CVE-2017-17796](https://cve.now/CVE-2017-17796.md): In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly… (no CVSS)
- [CVE-2017-17797](https://cve.now/CVE-2017-17797.md): In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have… (no CVSS)
- [CVE-2017-17798](https://cve.now/CVE-2017-17798.md): In TG Soft Vir.IT eXplorer Lite 8.5.42, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly… (no CVSS)
- [CVE-2017-17799](https://cve.now/CVE-2017-17799.md): In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly… (no CVSS)
- [CVE-2017-17800](https://cve.now/CVE-2017-17800.md): In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly… (no CVSS)
- [CVE-2017-17801](https://cve.now/CVE-2017-17801.md): In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly… (no CVSS)
- [CVE-2017-17802](https://cve.now/CVE-2017-17802.md): In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly… (no CVSS)
- [CVE-2017-17803](https://cve.now/CVE-2017-17803.md): In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly… (no CVSS)
- [CVE-2017-17804](https://cve.now/CVE-2017-17804.md): In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have… (no CVSS)
- [CVE-2017-17774](https://cve.now/CVE-2017-17774.md): admin/configuration.php in Piwigo 2.9.2 has CSRF. (no CVSS)
- [CVE-2017-17775](https://cve.now/CVE-2017-17775.md): Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request. (no CVSS)
- [CVE-2017-17776](https://cve.now/CVE-2017-17776.md): Paid To Read Script 2.0.5 has full path disclosure via an invalid admin/userview.php uid parameter. (no CVSS)
- [CVE-2017-17777](https://cve.now/CVE-2017-17777.md): Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated by the… (no CVSS)
- [CVE-2017-17778](https://cve.now/CVE-2017-17778.md): Paid To Read Script 2.0.5 has XSS via the referrals.php tier parameter or the admin/userview.php uid parameter. (no CVSS)
- [CVE-2017-17779](https://cve.now/CVE-2017-17779.md): Paid To Read Script 2.0.5 has SQL injection via the referrals.php id parameter. (no CVSS)
- [CVE-2017-17780](https://cve.now/CVE-2017-17780.md): The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.