CVEs published December 7, 2017
30 CVEs were published on December 7, 2017: 0 critical, 0 high.
- Published
- 30
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- IBM Atlas eDiscovery Process Management
- 4
- IBM MQ
- 2
- IBM Sterling B2B Integrator
- 2
- IBM Sterling File Gateway
- 2
- OpenSSL Software Foundation OpenSSL
- 2
- Dell 2335dn Firmware and Dell 2355DN Firmware
- 1
- IBM BigInsights
- 1
- IBM Connections
- 1
- IBM Insights Foundation for Energy
- 1
- IBM Security Guardium
- 1
Medium, low and unrated 30
- CVE-2017-1000410The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest,
- CVE-2017-14386The web user interface of Dell 2335dn and 2355dn Multifunction Laser Printers, firmware versions prior to V2.70.06.26 A13 and V2.70.45.34 A1Dell 2335dn Firmware and Dell 2355DN Firmware
- CVE-2017-17458In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the fmercurial
- CVE-2017-17459http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allows user-assisted remote attackers to execute arbitrary comman
- CVE-2017-11937The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1,Microsoft Malware Protection Engine
- CVE-2017-3737OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism.OpenSSL Software Foundation OpenSSL
- CVE-2017-3738There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli.OpenSSL Software Foundation OpenSSL
- CVE-2017-1271IBM Security Guardium 9.0, 9.1, and 9.5 supports interaction between multiple actors and allows those actors to negotiate which algorithm shIBM Security Guardium
- CVE-2017-1336IBM Infosphere BigInsights 4.2.0 could allow an attacker to inject code that could allow access to restricted data and files.IBM BigInsights
- CVE-2017-1341IBM WebSphere MQ 8.0 and 9.0 could allow, under special circumstances, an unauthorized user to access an object which they should have been IBM MQ
- CVE-2017-1342IBM Insights Foundation for Energy 2.0 could reveal sensitive information in error messages to authenticated users that could e used to condIBM Insights Foundation for Energy
- CVE-2017-1353IBM Atlas eDiscovery Process Management 6.0.3 could allow an authenticated attacker to obtain sensitive information when an unsuspecting useIBM Atlas eDiscovery Process Management
- CVE-2017-1354IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to cross-site scripting.IBM Atlas eDiscovery Process Management
- CVE-2017-1355IBM Atlas eDiscovery Process Management 6.0.3 stores sensitive information in URL parameters.IBM Atlas eDiscovery Process Management
- CVE-2017-1356IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to SQL injection.IBM Atlas eDiscovery Process Management
- CVE-2017-1433IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow an authenticated user to insert messages with a corrupt RFH header into the channel which wouIBM MQ
- CVE-2017-1465IBM TRIRIGA 3.2, 3.3, 3.4, and 3.5 could allow a remote attacker to hijack the clicking action of the victim.IBM TRIRIGA Application Platform
- CVE-2017-1481IBM Sterling B2B Integrator Standard Edition 5.2 allows a user to view sensitive information that belongs to another user.IBM Sterling B2B Integrator
- CVE-2017-1482IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to cross-site scripting.IBM Sterling B2B Integrator
- CVE-2017-1487IBM Sterling File Gateway 2.2 could allow an authenticated attacker to obtain sensitive information such as login ids on the system.IBM Sterling File Gateway
- CVE-2017-1497IBM Sterling File Gateway 2.2 could allow an unauthorized user to view files they should not have access to providing they know the directorIBM Sterling File Gateway
- CVE-2017-1498IBM Connections 5.5 is vulnerable to cross-site scripting.IBM Connections
- CVE-2017-17384ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.
- CVE-2017-17430Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote attackers to execute arbitrary commands via the web interface.
- CVE-2017-17435An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal.
- CVE-2017-17436An issue was discovered in the software on Vaultek Gun Safe VT20i products.
- CVE-2017-17448net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for new, get, and del op
- CVE-2017-17449The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does no
- CVE-2017-17450net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback
- CVE-2017-17451The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2