CVEs published December 1, 2017
41 CVEs were published on December 1, 2017: 0 critical, 0 high.
- Published
- 41
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 41
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Adobe ColdFusion Update 4 and earlier versions for ColdFusi…
- 4
- Princeton PTW-WMS1
- 4
- Adobe Flash Player 26.0.0.151 and earlier versions
- 2
- Adobe RoboHelp RH2017.0.1 and earlier versions
- 2
- Apache Software Foundation Apache Qpid Broker-J · org.apach…
- 2
- Apache Software Foundation Apache Struts · org.apache.strut…
- 1
- Cisco Umbrella Virtual Appliance
- 1
- NIPPON TELEGRAPH AND TELEPHONE EAST PWR-Q200
- 1
- Princeton A-Member
- 1
- Princeton A-Reserve
- 1
Medium, low and unrated 41
- CVE-2017-13663Encryption key exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to decrypt log files via an exposed
- CVE-2017-13664Password file exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to execute arbitrary commands with ad
- CVE-2017-14486The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages with other apps and
- CVE-2017-14487The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses fro
- CVE-2017-14953HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically proximate attackers to trigger association with an arbitrar
- CVE-2017-15357The setpermissions function in the auto-updater in Arq before 5.9.7 for Mac allows local users to gain root privileges via a symlink attack
- CVE-2017-16611In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape r
- CVE-2017-16612libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., wit
- CVE-2017-16893The application Piwigo is affected by an SQL injection vulnerability in version 2.9.2 and possibly prior.
- CVE-2017-16895The (1) arq_updater, (2) arqcommitter, (3) standardrestorer, (4) arqglacierrestorer, and (5) arqs3glacierrestorer helper apps in Arq 5.x bef
- CVE-2017-16953connoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, which allows remote attackers to modify the PPPoE confi
- CVE-2017-15707In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack usiApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2017-15701In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frameApache Software Foundation Apache Qpid Broker-J · org.apach…
- CVE-2017-15702In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of whiApache Software Foundation Apache Qpid Broker-J · org.apach…
- CVE-2017-10861Directory traversal vulnerability in QND Advance/Standard allows an attacker to read arbitrary files via a specially crafted command.QualitySoft QND Advance/Standard
- CVE-2017-10874PWR-Q200 does not use random values for source ports of DNS query packets, which allows remote attackers to conduct DNS cache poisoning attaNIPPON TELEGRAPH AND TELEPHONE EAST PWR-Q200
- CVE-2017-10891Untrusted search path vulnerability in Media Go version 3.2.0.191 and earlier allows an attacker to gain privileges via a Trojan horse DLL iSony Video & Sound Products Media Go
- CVE-2017-10892Untrusted search path vulnerability in Music Center for PC version 1.0.00 allows an attacker to gain privileges via a Trojan horse DLL in anSony Video & Sound Products Music Center for PC
- CVE-2017-10894StreamRelay.NET.exe ver2.14.0.7 and earlier allows remote attackers to cause a denial of service via unspecified vectors.Tomoki Sanaki StreamRelay.NET.exe
- CVE-2017-10895sDNSProxy.exe ver1.1.0.0 and earlier allows remote attackers to cause a denial of service via unspecified vectors.Tomoki Sanaki sDNSProxy.exe
- CVE-2017-10898SQL injection vulnerability in the A-Member and A-Member for MT cloud versions 3.8.6 and earlier allows an attacker to execute arbitrary SQLPrinceton A-Member
- CVE-2017-10899SQL injection vulnerability in the A-Reserve and A-Reserve for MT cloud versions 3.8.6 and earlier allows an attacker to execute arbitrary SPrinceton A-Reserve
- CVE-2017-10900PTW-WMS1 firmware version 2.000.012 allows remote attackers to bypass access restrictions to obtain or delete data on the disk via unspecifiPrinceton PTW-WMS1
- CVE-2017-10901Buffer overflow in PTW-WMS1 firmware version 2.000.012 allows remote attackers to conduct denial-of-service attacks via unspecified vectors.Princeton PTW-WMS1
- CVE-2017-10902PTW-WMS1 firmware version 2.000.012 allows remote attackers to execute arbitrary OS commands via unspecified vectors.Princeton PTW-WMS1
- CVE-2017-10903Improper authentication issue in PTW-WMS1 firmware version 2.000.012 allows remote attackers to log in to the device with root privileges anPrinceton PTW-WMS1
- CVE-2017-11281Adobe Flash Player has an exploitable memory corruption vulnerability in the text handling function.Adobe Flash Player 26.0.0.151 and earlier versions
- CVE-2017-11282Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser.Adobe Flash Player 26.0.0.151 and earlier versions
- CVE-2017-11283Adobe ColdFusion has an Untrusted Data Deserialization vulnerability.Adobe ColdFusion Update 4 and earlier versions for ColdFusi…
- CVE-2017-11284Adobe ColdFusion has an Untrusted Data Deserialization vulnerability.Adobe ColdFusion Update 4 and earlier versions for ColdFusi…
- CVE-2017-11285Adobe ColdFusion has a cross-site scripting (XSS) vulnerability.Adobe ColdFusion Update 4 and earlier versions for ColdFusi…
- CVE-2017-11286Adobe ColdFusion has an XML external entity (XXE) injection vulnerability.Adobe ColdFusion Update 4 and earlier versions for ColdFusi…
- CVE-2017-15607Inedo Otter before 1.7.4 has directory traversal in filesystem-based rafts via vectors involving '/' characters or initial '.' characters, a
- CVE-2017-17083In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the NetBIOS dissector could crash.
- CVE-2017-17084In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the IWARP_MPA dissector could crash.
- CVE-2017-17085In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash.
- CVE-2017-17086Indeo Otter through 1.7.4 mishandles a "</script>" substring in an initial DP payload, which allows remote attackers to cause a denial of se
- CVE-2017-17087fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the gro
- CVE-2017-3104Adobe RoboHelp has a cross-site scripting (XSS) vulnerability.Adobe RoboHelp RH2017.0.1 and earlier versions
- CVE-2017-3105Adobe RoboHelp has an Open Redirect vulnerability.Adobe RoboHelp RH2017.0.1 and earlier versions
- CVE-2017-6679The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel (SSH) which auto initCisco Umbrella Virtual Appliance