# CVEs published 2017-12-11

52 CVEs were published on December 11, 2017: 1 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-2886](https://cve.now/CVE-2017-2886.md): A memory corruption vulnerability exists in the .PSD parsing functionality of ACDSee Ultimate 10.0.0.292. (CVSS 8.8, ACDSee Ultimate)
- [CVE-2014-8358](https://cve.now/CVE-2014-8358.md): Huawei EC156, EC176, and EC177 USB Modem products with software before UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014) and before V200R003 (no CVSS)
- [CVE-2017-1000407](https://cve.now/CVE-2017-1000407.md): The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered le (no CVSS)
- [CVE-2017-1507](https://cve.now/CVE-2017-1507.md): IBM Jazz Foundation Products could disclose sensitive information during a scan that could lead to further attacks against the system. (no CVSS)
- [CVE-2017-1536](https://cve.now/CVE-2017-1536.md): IBM Support Tools for Lotus WCM (IBM WebSphere Portal 7.0, 8.0, 8.5 and 9.0) is vulnerable to cross-site scripting. (no CVSS, IBM WebSphere Portal)
- [CVE-2017-1548](https://cve.now/CVE-2017-1548.md): IBM Sterling File Gateway 2.2 could allow a remote attacker to traverse directories on the system. (no CVSS, IBM Sterling File Gateway)
- [CVE-2017-1549](https://cve.now/CVE-2017-1549.md): IBM Sterling File Gateway 2.2 is vulnerable to cross-site scripting. (no CVSS, IBM Sterling File Gateway)
- [CVE-2017-1550](https://cve.now/CVE-2017-1550.md): IBM Sterling File Gateway 2.2 could allow an authenticated user to change other user's passwords. (no CVSS, IBM Sterling File Gateway)
- [CVE-2017-15896](https://cve.now/CVE-2017-15896.md): Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL\_read() due to TLS handshake failure. (no CVSS, The Node.js Project Node.js)
- [CVE-2017-15897](https://cve.now/CVE-2017-15897.md): Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the (no CVSS, The Node.js Project Node.js)
- [CVE-2017-1606](https://cve.now/CVE-2017-1606.md): IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) 3.0.0.0 through 3.0.0.7 is vulnerable to SQL injection. (no CVSS, IBM Financial Transaction Manager)
- [CVE-2017-1613](https://cve.now/CVE-2017-1613.md): IBM Connections 6.0 could allow an unauthenticated remote attacker to gain unauthenticated or unauthorized access to non-sensitive Engagemen (no CVSS, IBM Connections)
- [CVE-2017-1632](https://cve.now/CVE-2017-1632.md): IBM Sterling File Gateway 2.2 is vulnerable to cross-site scripting. (no CVSS, IBM Sterling File Gateway)
- [CVE-2017-1683](https://cve.now/CVE-2017-1683.md): IBM Connections Engagement Center 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Connections)
- [CVE-2017-1760](https://cve.now/CVE-2017-1760.md): IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow a local user to crash the queue manager agent thread and expose some sensitive information. (no CVSS, IBM MQ)
- [CVE-2017-8865](https://cve.now/CVE-2017-8865.md): Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 do not provide sufficient protections against capture-replay att (no CVSS)
- [CVE-2017-8866](https://cve.now/CVE-2017-8866.md): Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 share a fixed small pool of hardcoded keys, allowing a remote at (no CVSS)
- [CVE-2017-8867](https://cve.now/CVE-2017-8867.md): Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 use AES-128 with ECB mode to encrypt voice traffic between the d (no CVSS)
- [CVE-2017-17551](https://cve.now/CVE-2017-17551.md): The Backup and Restore feature in Mobotap Dolphin Browser for Android 12.0.2 suffers from an arbitrary file write vulnerability when attempt (no CVSS)
- [CVE-2014-3250](https://cve.now/CVE-2014-3250.md): The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote at (no CVSS)
- [CVE-2015-6502](https://cve.now/CVE-2015-6502.md): Cross-site scripting (XSS) vulnerability in the console in Puppet Enterprise before 2015.2.1 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2015-8470](https://cve.now/CVE-2015-8470.md): The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the JSESSIONID cookie in an HTTPS session, whic (no CVSS)
- [CVE-2017-11319](https://cve.now/CVE-2017-11319.md): Perspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and consequently gain pri (no CVSS)
- [CVE-2017-15870](https://cve.now/CVE-2017-15870.md): Palo Alto Networks GlobalProtect Agent before 4.0.3 allows attackers with administration rights on the local station to gain SYSTEM privileg (no CVSS)
- [CVE-2017-15940](https://cve.now/CVE-2017-15940.md): The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, (no CVSS)
- [CVE-2017-15942](https://cve.now/CVE-2017-15942.md): Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.13, and 8.0.x before 8.0.6 allows remote attackers to cause a (no CVSS)
- [CVE-2017-15943](https://cve.now/CVE-2017-15943.md): The configuration file import for applications, spyware and vulnerability objects functionality in the web interface in Palo Alto Networks P (no CVSS)
- [CVE-2017-15944](https://cve.now/CVE-2017-15944.md): Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute (CVSS 9.8, KEV)
- [CVE-2017-17110](https://cve.now/CVE-2017-17110.md): Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request. (no CVSS)
- [CVE-2017-17111](https://cve.now/CVE-2017-17111.md): Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-details.php?ID= request. (no CVSS)
- [CVE-2017-11507](https://cve.now/CVE-2017-11507.md): A cross site scripting (XSS) vulnerability exists in Check\_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an una (no CVSS, Tenable Check\_MK)
- [CVE-2017-13070](https://cve.now/CVE-2017-13070.md): A DLL Hijacking vulnerability in QNAP Qsync for Windows (exe) version 4.2.2.0724 and earlier could allow remote attackers to execute arbitra (no CVSS, QNAP Qsync for Windows)
- [CVE-2017-16723](https://cve.now/CVE-2017-16723.md): A Cross-site Scripting issue was discovered in PHOENIX CONTACT FL COMSERVER BASIC 232/422/485, FL COMSERVER UNI 232/422/485, FL COMSERVER BA (no CVSS, PHOENIX CONTACT FL COMSERVER, FL COM SERVER, and PSI-MODEM/…)
- [CVE-2016-6904](https://cve.now/CVE-2016-6904.md): Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. (no CVSS, NetApp VASA Provider for Clustered Data ONTAP)
- [CVE-2017-15708](https://cve.now/CVE-2017-15708.md): In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). (no CVSS, Apache Software Foundation Apache Synapse · org.apache.syna…)
- [CVE-2017-17536](https://cve.now/CVE-2017-17536.md): Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to (no CVSS)
- [CVE-2017-11463](https://cve.now/CVE-2017-11463.md): In Ivanti Service Desk (formerly LANDESK Management Suite) versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads (no CVSS)
- [CVE-2017-17512](https://cve.now/CVE-2017-17512.md): sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment (no CVSS)
- [CVE-2017-17523](https://cve.now/CVE-2017-17523.md): lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment varia (no CVSS)
- [CVE-2017-17505](https://cve.now/CVE-2017-17505.md): In HDF5 1.10.1, there is a NULL pointer dereference in the function H5O\_pline\_decode in the H5Opline.c file in libhdf5.a. (no CVSS)
- [CVE-2017-17506](https://cve.now/CVE-2017-17506.md): In HDF5 1.10.1, there is an out of bounds read vulnerability in the function H5Opline\_pline\_decode in H5Opline.c in libhdf5.a. (no CVSS)
- [CVE-2017-17507](https://cve.now/CVE-2017-17507.md): In HDF5 1.10.1, there is an out of bounds read vulnerability in the function H5T\_conv\_struct\_opt in H5Tconv.c in libhdf5.a. (no CVSS)
- [CVE-2017-17508](https://cve.now/CVE-2017-17508.md): In HDF5 1.10.1, there is a divide-by-zero vulnerability in the function H5T\_set\_loc in the H5T.c file in libhdf5.a. (no CVSS)
- [CVE-2017-17509](https://cve.now/CVE-2017-17509.md): In HDF5 1.10.1, there is an out of bounds write vulnerability in the function H5G\_\_ent\_decode\_vec in H5Gcache.c in libhdf5.a. (no CVSS)
- [CVE-2017-16789](https://cve.now/CVE-2017-16789.md): Cross-site scripting (XSS) vulnerability in Integration Matters nJAMS 3 before 3.2.0 Hotfix 7, as used in TIBCO BusinessWorks Process Monito (no CVSS)
- [CVE-2017-17498](https://cve.now/CVE-2017-17498.md): WritePNMImage in coders/pnm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (bit\_stream.c MagickBitStreamMSB (no CVSS)
- [CVE-2017-17499](https://cve.now/CVE-2017-17499.md): ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in Magick::Image::read in Magick++/lib/Image.cpp. (no CVSS)
- [CVE-2017-17500](https://cve.now/CVE-2017-17500.md): ReadRGBImage in coders/rgb.c in GraphicsMagick 1.3.26 has a magick/import.c ImportRGBQuantumType heap-based buffer over-read via a crafted f (no CVSS)
- [CVE-2017-17501](https://cve.now/CVE-2017-17501.md): WriteOnePNGImage in coders/png.c in GraphicsMagick 1.3.26 has a heap-based buffer over-read via a crafted file. (no CVSS)
- [CVE-2017-17502](https://cve.now/CVE-2017-17502.md): ReadCMYKImage in coders/cmyk.c in GraphicsMagick 1.3.26 has a magick/import.c ImportCMYKQuantumType heap-based buffer over-read via a crafte (no CVSS)
- [CVE-2017-17503](https://cve.now/CVE-2017-17503.md): ReadGRAYImage in coders/gray.c in GraphicsMagick 1.3.26 has a magick/import.c ImportGrayQuantumType heap-based buffer over-read via a crafte (no CVSS)
- [CVE-2017-17504](https://cve.now/CVE-2017-17504.md): ImageMagick before 7.0.7-12 has a coders/png.c Magick\_png\_read\_raw\_profile heap-based buffer over-read via a crafted file, related to ReadOn (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-12-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.