# CVEs published 2017-12-01

41 CVEs were published on December 1, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-13663](https://cve.now/CVE-2017-13663.md): Encryption key exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to decrypt log files via an exposed (no CVSS)
- [CVE-2017-13664](https://cve.now/CVE-2017-13664.md): Password file exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to execute arbitrary commands with ad (no CVSS)
- [CVE-2017-14486](https://cve.now/CVE-2017-14486.md): The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages with other apps and (no CVSS)
- [CVE-2017-14487](https://cve.now/CVE-2017-14487.md): The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses fro (no CVSS)
- [CVE-2017-14953](https://cve.now/CVE-2017-14953.md): HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically proximate attackers to trigger association with an arbitrar (no CVSS)
- [CVE-2017-15357](https://cve.now/CVE-2017-15357.md): The setpermissions function in the auto-updater in Arq before 5.9.7 for Mac allows local users to gain root privileges via a symlink attack (no CVSS)
- [CVE-2017-16611](https://cve.now/CVE-2017-16611.md): In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape r (no CVSS)
- [CVE-2017-16612](https://cve.now/CVE-2017-16612.md): libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., wit (no CVSS)
- [CVE-2017-16893](https://cve.now/CVE-2017-16893.md): The application Piwigo is affected by an SQL injection vulnerability in version 2.9.2 and possibly prior. (no CVSS)
- [CVE-2017-16895](https://cve.now/CVE-2017-16895.md): The (1) arq\_updater, (2) arqcommitter, (3) standardrestorer, (4) arqglacierrestorer, and (5) arqs3glacierrestorer helper apps in Arq 5.x bef (no CVSS)
- [CVE-2017-16953](https://cve.now/CVE-2017-16953.md): connoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, which allows remote attackers to modify the PPPoE confi (no CVSS)
- [CVE-2017-15707](https://cve.now/CVE-2017-15707.md): In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack usi (no CVSS, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2017-15701](https://cve.now/CVE-2017-15701.md): In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frame (no CVSS, Apache Software Foundation Apache Qpid Broker-J · org.apach…)
- [CVE-2017-15702](https://cve.now/CVE-2017-15702.md): In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of whi (no CVSS, Apache Software Foundation Apache Qpid Broker-J · org.apach…)
- [CVE-2017-10861](https://cve.now/CVE-2017-10861.md): Directory traversal vulnerability in QND Advance/Standard allows an attacker to read arbitrary files via a specially crafted command. (no CVSS, QualitySoft QND Advance/Standard)
- [CVE-2017-10874](https://cve.now/CVE-2017-10874.md): PWR-Q200 does not use random values for source ports of DNS query packets, which allows remote attackers to conduct DNS cache poisoning atta (no CVSS, NIPPON TELEGRAPH AND TELEPHONE EAST PWR-Q200)
- [CVE-2017-10891](https://cve.now/CVE-2017-10891.md): Untrusted search path vulnerability in Media Go version 3.2.0.191 and earlier allows an attacker to gain privileges via a Trojan horse DLL i (no CVSS, Sony Video & Sound Products Media Go)
- [CVE-2017-10892](https://cve.now/CVE-2017-10892.md): Untrusted search path vulnerability in Music Center for PC version 1.0.00 allows an attacker to gain privileges via a Trojan horse DLL in an (no CVSS, Sony Video & Sound Products Music Center for PC)
- [CVE-2017-10894](https://cve.now/CVE-2017-10894.md): StreamRelay.NET.exe ver2.14.0.7 and earlier allows remote attackers to cause a denial of service via unspecified vectors. (no CVSS, Tomoki Sanaki StreamRelay.NET.exe)
- [CVE-2017-10895](https://cve.now/CVE-2017-10895.md): sDNSProxy.exe ver1.1.0.0 and earlier allows remote attackers to cause a denial of service via unspecified vectors. (no CVSS, Tomoki Sanaki sDNSProxy.exe)
- [CVE-2017-10898](https://cve.now/CVE-2017-10898.md): SQL injection vulnerability in the A-Member and A-Member for MT cloud versions 3.8.6 and earlier allows an attacker to execute arbitrary SQL (no CVSS, Princeton A-Member)
- [CVE-2017-10899](https://cve.now/CVE-2017-10899.md): SQL injection vulnerability in the A-Reserve and A-Reserve for MT cloud versions 3.8.6 and earlier allows an attacker to execute arbitrary S (no CVSS, Princeton A-Reserve)
- [CVE-2017-10900](https://cve.now/CVE-2017-10900.md): PTW-WMS1 firmware version 2.000.012 allows remote attackers to bypass access restrictions to obtain or delete data on the disk via unspecifi (no CVSS, Princeton PTW-WMS1)
- [CVE-2017-10901](https://cve.now/CVE-2017-10901.md): Buffer overflow in PTW-WMS1 firmware version 2.000.012 allows remote attackers to conduct denial-of-service attacks via unspecified vectors. (no CVSS, Princeton PTW-WMS1)
- [CVE-2017-10902](https://cve.now/CVE-2017-10902.md): PTW-WMS1 firmware version 2.000.012 allows remote attackers to execute arbitrary OS commands via unspecified vectors. (no CVSS, Princeton PTW-WMS1)
- [CVE-2017-10903](https://cve.now/CVE-2017-10903.md): Improper authentication issue in PTW-WMS1 firmware version 2.000.012 allows remote attackers to log in to the device with root privileges an (no CVSS, Princeton PTW-WMS1)
- [CVE-2017-11281](https://cve.now/CVE-2017-11281.md): Adobe Flash Player has an exploitable memory corruption vulnerability in the text handling function. (no CVSS, Adobe Flash Player 26.0.0.151 and earlier versions)
- [CVE-2017-11282](https://cve.now/CVE-2017-11282.md): Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. (no CVSS, Adobe Flash Player 26.0.0.151 and earlier versions)
- [CVE-2017-11283](https://cve.now/CVE-2017-11283.md): Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. (no CVSS, Adobe ColdFusion Update 4 and earlier versions for ColdFusi…)
- [CVE-2017-11284](https://cve.now/CVE-2017-11284.md): Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. (no CVSS, Adobe ColdFusion Update 4 and earlier versions for ColdFusi…)
- [CVE-2017-11285](https://cve.now/CVE-2017-11285.md): Adobe ColdFusion has a cross-site scripting (XSS) vulnerability. (no CVSS, Adobe ColdFusion Update 4 and earlier versions for ColdFusi…)
- [CVE-2017-11286](https://cve.now/CVE-2017-11286.md): Adobe ColdFusion has an XML external entity (XXE) injection vulnerability. (no CVSS, Adobe ColdFusion Update 4 and earlier versions for ColdFusi…)
- [CVE-2017-15607](https://cve.now/CVE-2017-15607.md): Inedo Otter before 1.7.4 has directory traversal in filesystem-based rafts via vectors involving '/' characters or initial '.' characters, a (no CVSS)
- [CVE-2017-17083](https://cve.now/CVE-2017-17083.md): In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the NetBIOS dissector could crash. (no CVSS)
- [CVE-2017-17084](https://cve.now/CVE-2017-17084.md): In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the IWARP\_MPA dissector could crash. (no CVSS)
- [CVE-2017-17085](https://cve.now/CVE-2017-17085.md): In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. (no CVSS)
- [CVE-2017-17086](https://cve.now/CVE-2017-17086.md): Indeo Otter through 1.7.4 mishandles a "\</script\>" substring in an initial DP payload, which allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2017-17087](https://cve.now/CVE-2017-17087.md): fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the gro (no CVSS)
- [CVE-2017-3104](https://cve.now/CVE-2017-3104.md): Adobe RoboHelp has a cross-site scripting (XSS) vulnerability. (no CVSS, Adobe RoboHelp RH2017.0.1 and earlier versions)
- [CVE-2017-3105](https://cve.now/CVE-2017-3105.md): Adobe RoboHelp has an Open Redirect vulnerability. (no CVSS, Adobe RoboHelp RH2017.0.1 and earlier versions)
- [CVE-2017-6679](https://cve.now/CVE-2017-6679.md): The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel (SSH) which auto init (no CVSS, Cisco Umbrella Virtual Appliance)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-12-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.