CVEs published December 11, 2017
52 CVEs were published on December 11, 2017: 1 critical, 1 high. 1 is now in CISA KEV.
- Published
- 52
- Critical
- 1
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 50
- Now in CISA KEV
- 1
- Fix available
- 1
Most affected products
- IBM Sterling File Gateway
- 4
- IBM Connections
- 2
- The Node.js Project Node.js
- 2
- ACDSee Ultimate
- 1
- Apache Software Foundation Apache Synapse · org.apache.syna…
- 1
- IBM Financial Transaction Manager
- 1
- IBM MQ
- 1
- IBM WebSphere Portal
- 1
- NetApp VASA Provider for Clustered Data ONTAP
- 1
- PHOENIX CONTACT FL COMSERVER, FL COM SERVER, and PSI-MODEM/…
- 1
Critical 1
High 1
Medium, low and unrated 50
- CVE-2014-8358Huawei EC156, EC176, and EC177 USB Modem products with software before UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014) and before V200R003
- CVE-2017-1000407The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered le
- CVE-2017-1507IBM Jazz Foundation Products could disclose sensitive information during a scan that could lead to further attacks against the system.
- CVE-2017-1536IBM Support Tools for Lotus WCM (IBM WebSphere Portal 7.0, 8.0, 8.5 and 9.0) is vulnerable to cross-site scripting.IBM WebSphere Portal
- CVE-2017-1548IBM Sterling File Gateway 2.2 could allow a remote attacker to traverse directories on the system.IBM Sterling File Gateway
- CVE-2017-1549IBM Sterling File Gateway 2.2 is vulnerable to cross-site scripting.IBM Sterling File Gateway
- CVE-2017-1550IBM Sterling File Gateway 2.2 could allow an authenticated user to change other user's passwords.IBM Sterling File Gateway
- CVE-2017-15896Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure.The Node.js Project Node.js
- CVE-2017-15897Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the The Node.js Project Node.js
- CVE-2017-1606IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) 3.0.0.0 through 3.0.0.7 is vulnerable to SQL injection.IBM Financial Transaction Manager
- CVE-2017-1613IBM Connections 6.0 could allow an unauthenticated remote attacker to gain unauthenticated or unauthorized access to non-sensitive EngagemenIBM Connections
- CVE-2017-1632IBM Sterling File Gateway 2.2 is vulnerable to cross-site scripting.IBM Sterling File Gateway
- CVE-2017-1683IBM Connections Engagement Center 6.0 is vulnerable to cross-site scripting.IBM Connections
- CVE-2017-1760IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow a local user to crash the queue manager agent thread and expose some sensitive information.IBM MQ
- CVE-2017-8865Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 do not provide sufficient protections against capture-replay att
- CVE-2017-8866Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 share a fixed small pool of hardcoded keys, allowing a remote at
- CVE-2017-8867Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 use AES-128 with ECB mode to encrypt voice traffic between the d
- CVE-2017-17551The Backup and Restore feature in Mobotap Dolphin Browser for Android 12.0.2 suffers from an arbitrary file write vulnerability when attempt
- CVE-2014-3250The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote at
- CVE-2015-6502Cross-site scripting (XSS) vulnerability in the console in Puppet Enterprise before 2015.2.1 allows remote attackers to inject arbitrary web
- CVE-2015-8470The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the JSESSIONID cookie in an HTTPS session, whic
- CVE-2017-11319Perspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and consequently gain pri
- CVE-2017-15870Palo Alto Networks GlobalProtect Agent before 4.0.3 allows attackers with administration rights on the local station to gain SYSTEM privileg
- CVE-2017-15940The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14,
- CVE-2017-15942Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.13, and 8.0.x before 8.0.6 allows remote attackers to cause a
- CVE-2017-15943The configuration file import for applications, spyware and vulnerability objects functionality in the web interface in Palo Alto Networks P
- CVE-2017-17110Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.
- CVE-2017-17111Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-details.php?ID= request.
- CVE-2017-11507A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unaTenable Check_MK
- CVE-2017-13070A DLL Hijacking vulnerability in QNAP Qsync for Windows (exe) version 4.2.2.0724 and earlier could allow remote attackers to execute arbitraQNAP Qsync for Windows
- CVE-2017-16723A Cross-site Scripting issue was discovered in PHOENIX CONTACT FL COMSERVER BASIC 232/422/485, FL COMSERVER UNI 232/422/485, FL COMSERVER BAPHOENIX CONTACT FL COMSERVER, FL COM SERVER, and PSI-MODEM/…
- CVE-2016-6904Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication.NetApp VASA Provider for Clustered Data ONTAP
- CVE-2017-15708In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI).Apache Software Foundation Apache Synapse · org.apache.syna…
- CVE-2017-17536Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to
- CVE-2017-11463In Ivanti Service Desk (formerly LANDESK Management Suite) versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads
- CVE-2017-17512sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment
- CVE-2017-17523lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment varia
- CVE-2017-17505In HDF5 1.10.1, there is a NULL pointer dereference in the function H5O_pline_decode in the H5Opline.c file in libhdf5.a.
- CVE-2017-17506In HDF5 1.10.1, there is an out of bounds read vulnerability in the function H5Opline_pline_decode in H5Opline.c in libhdf5.a.
- CVE-2017-17507In HDF5 1.10.1, there is an out of bounds read vulnerability in the function H5T_conv_struct_opt in H5Tconv.c in libhdf5.a.
- CVE-2017-17508In HDF5 1.10.1, there is a divide-by-zero vulnerability in the function H5T_set_loc in the H5T.c file in libhdf5.a.
- CVE-2017-17509In HDF5 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in libhdf5.a.
- CVE-2017-16789Cross-site scripting (XSS) vulnerability in Integration Matters nJAMS 3 before 3.2.0 Hotfix 7, as used in TIBCO BusinessWorks Process Monito
- CVE-2017-17498WritePNMImage in coders/pnm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (bit_stream.c MagickBitStreamMSB
- CVE-2017-17499ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in Magick::Image::read in Magick++/lib/Image.cpp.
- CVE-2017-17500ReadRGBImage in coders/rgb.c in GraphicsMagick 1.3.26 has a magick/import.c ImportRGBQuantumType heap-based buffer over-read via a crafted f
- CVE-2017-17501WriteOnePNGImage in coders/png.c in GraphicsMagick 1.3.26 has a heap-based buffer over-read via a crafted file.
- CVE-2017-17502ReadCMYKImage in coders/cmyk.c in GraphicsMagick 1.3.26 has a magick/import.c ImportCMYKQuantumType heap-based buffer over-read via a crafte
- CVE-2017-17503ReadGRAYImage in coders/gray.c in GraphicsMagick 1.3.26 has a magick/import.c ImportGrayQuantumType heap-based buffer over-read via a crafte
- CVE-2017-17504ImageMagick before 7.0.7-12 has a coders/png.c Magick_png_read_raw_profile heap-based buffer over-read via a crafted file, related to ReadOn