# CVEs published 2017-12-07 30 CVEs were published on December 7, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-1000410](https://cve.now/CVE-2017-1000410.md): The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, (no CVSS) - [CVE-2017-14386](https://cve.now/CVE-2017-14386.md): The web user interface of Dell 2335dn and 2355dn Multifunction Laser Printers, firmware versions prior to V2.70.06.26 A13 and V2.70.45.34 A1 (no CVSS, Dell 2335dn Firmware and Dell 2355DN Firmware) - [CVE-2017-17458](https://cve.now/CVE-2017-17458.md): In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the f (no CVSS, mercurial) - [CVE-2017-17459](https://cve.now/CVE-2017-17459.md): http\_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allows user-assisted remote attackers to execute arbitrary comman (no CVSS) - [CVE-2017-11937](https://cve.now/CVE-2017-11937.md): The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, (no CVSS, Microsoft Malware Protection Engine) - [CVE-2017-3737](https://cve.now/CVE-2017-3737.md): OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. (no CVSS, OpenSSL Software Foundation OpenSSL) - [CVE-2017-3738](https://cve.now/CVE-2017-3738.md): There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. (no CVSS, OpenSSL Software Foundation OpenSSL) - [CVE-2017-1271](https://cve.now/CVE-2017-1271.md): IBM Security Guardium 9.0, 9.1, and 9.5 supports interaction between multiple actors and allows those actors to negotiate which algorithm sh (no CVSS, IBM Security Guardium) - [CVE-2017-1336](https://cve.now/CVE-2017-1336.md): IBM Infosphere BigInsights 4.2.0 could allow an attacker to inject code that could allow access to restricted data and files. (no CVSS, IBM BigInsights) - [CVE-2017-1341](https://cve.now/CVE-2017-1341.md): IBM WebSphere MQ 8.0 and 9.0 could allow, under special circumstances, an unauthorized user to access an object which they should have been (no CVSS, IBM MQ) - [CVE-2017-1342](https://cve.now/CVE-2017-1342.md): IBM Insights Foundation for Energy 2.0 could reveal sensitive information in error messages to authenticated users that could e used to cond (no CVSS, IBM Insights Foundation for Energy) - [CVE-2017-1353](https://cve.now/CVE-2017-1353.md): IBM Atlas eDiscovery Process Management 6.0.3 could allow an authenticated attacker to obtain sensitive information when an unsuspecting use (no CVSS, IBM Atlas eDiscovery Process Management) - [CVE-2017-1354](https://cve.now/CVE-2017-1354.md): IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to cross-site scripting. (no CVSS, IBM Atlas eDiscovery Process Management) - [CVE-2017-1355](https://cve.now/CVE-2017-1355.md): IBM Atlas eDiscovery Process Management 6.0.3 stores sensitive information in URL parameters. (no CVSS, IBM Atlas eDiscovery Process Management) - [CVE-2017-1356](https://cve.now/CVE-2017-1356.md): IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to SQL injection. (no CVSS, IBM Atlas eDiscovery Process Management) - [CVE-2017-1433](https://cve.now/CVE-2017-1433.md): IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow an authenticated user to insert messages with a corrupt RFH header into the channel which wou (no CVSS, IBM MQ) - [CVE-2017-1465](https://cve.now/CVE-2017-1465.md): IBM TRIRIGA 3.2, 3.3, 3.4, and 3.5 could allow a remote attacker to hijack the clicking action of the victim. (no CVSS, IBM TRIRIGA Application Platform) - [CVE-2017-1481](https://cve.now/CVE-2017-1481.md): IBM Sterling B2B Integrator Standard Edition 5.2 allows a user to view sensitive information that belongs to another user. (no CVSS, IBM Sterling B2B Integrator) - [CVE-2017-1482](https://cve.now/CVE-2017-1482.md): IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to cross-site scripting. (no CVSS, IBM Sterling B2B Integrator) - [CVE-2017-1487](https://cve.now/CVE-2017-1487.md): IBM Sterling File Gateway 2.2 could allow an authenticated attacker to obtain sensitive information such as login ids on the system. (no CVSS, IBM Sterling File Gateway) - [CVE-2017-1497](https://cve.now/CVE-2017-1497.md): IBM Sterling File Gateway 2.2 could allow an unauthorized user to view files they should not have access to providing they know the director (no CVSS, IBM Sterling File Gateway) - [CVE-2017-1498](https://cve.now/CVE-2017-1498.md): IBM Connections 5.5 is vulnerable to cross-site scripting. (no CVSS, IBM Connections) - [CVE-2017-17384](https://cve.now/CVE-2017-17384.md): ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job. (no CVSS) - [CVE-2017-17430](https://cve.now/CVE-2017-17430.md): Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote attackers to execute arbitrary commands via the web interface. (no CVSS) - [CVE-2017-17435](https://cve.now/CVE-2017-17435.md): An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. (no CVSS) - [CVE-2017-17436](https://cve.now/CVE-2017-17436.md): An issue was discovered in the software on Vaultek Gun Safe VT20i products. (no CVSS) - [CVE-2017-17448](https://cve.now/CVE-2017-17448.md): net/netfilter/nfnetlink\_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP\_NET\_ADMIN capability for new, get, and del op (no CVSS) - [CVE-2017-17449](https://cve.now/CVE-2017-17449.md): The \_\_netlink\_deliver\_tap\_skb function in net/netlink/af\_netlink.c in the Linux kernel through 4.14.4, when CONFIG\_NLMON is enabled, does no (no CVSS) - [CVE-2017-17450](https://cve.now/CVE-2017-17450.md): net/netfilter/xt\_osf.c in the Linux kernel through 4.14.4 does not require the CAP\_NET\_ADMIN capability for add\_callback and remove\_callback (no CVSS) - [CVE-2017-17451](https://cve.now/CVE-2017-17451.md): The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2 (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-12-07 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.