CVEs published December 13, 2017
104 CVEs were published on December 13, 2017: 0 critical, 6 high.
- Published
- 104
- Critical
- 0
- High
- 6
- Medium
- 0
- Low
- 0
- Unrated
- 98
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Atlassian Bamboo
- 2
- Micro Focus Project and Portfolio Management Center
- 2
- Symantec Norton Family Android App
- 2
- TIBCO Software tibbr Community · TIBCO Software tibbr Enter…
- 2
- Adobe Flash Player 27.0.0.187 and earlier versions
- 1
- EMC Isilon OneFS 8.1.0.0, 8.0.1.0 8.0.1.1, 8.0.0.0 - 8.0.0.…
- 1
- Fortinet FortiOS
- 1
- IBM iNotes
- 1
- IBM Maximo Asset Management
- 1
- IBM Rational DOORS Next Generation
- 1
High 6
- CVE-2017-5530SAML protocol handling errors in tibbrTIBCO Software tibbr Community · TIBCO Software tibbr Enter…
- CVE-2017-5534Improper sandboxing of a third-party component in tibbrTIBCO Software tibbr Community · TIBCO Software tibbr Enter…
- CVE-2017-13098BouncyCastle JCE TLS Bleichenbacher/ROBOTLegion of the Bouncy Castle BouncyCastle TLS · org.bouncyca…
- CVE-2017-13099wolfSSL Bleichenbacher/ROBOTwolfSSL
- CVE-2017-14361MFSBGN03793 rev.1 - Project and Portfolio Management Center, Multiple vulnerabilitiesMicro Focus Project and Portfolio Management Center
- CVE-2017-14362MFSBGN03793 rev.1 - Project and Portfolio Management Center, Multiple vulnerabilitiesMicro Focus Project and Portfolio Management Center
Medium, low and unrated 98
- CVE-2017-7738An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with Fortinet FortiOS
- CVE-2017-11305A regression affecting Adobe Flash Player version 27.0.0.187 (and earlier versions) causes the unintended reset of the global settings prefeAdobe Flash Player 27.0.0.187 and earlier versions
- CVE-2017-14380In EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, and 7.1.1.x, a malicious compliance admin (coEMC Isilon OneFS 8.1.0.0, 8.0.1.0 8.0.1.1, 8.0.0.0 - 8.0.0.…
- CVE-2017-17664A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified As
- CVE-2017-17665In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments.
- CVE-2017-15529Prior to 4.4.1.10, the Norton Family Android App can be susceptible to a Denial of Service (DoS) exploit.Symantec Norton Family Android App
- CVE-2017-15530Prior to 4.4.1.10, the Norton Family Android App can be susceptible to an Information Disclosure issue.Symantec Norton Family Android App
- CVE-2017-1421IBM iNotes is vulnerable to cross-site scripting.IBM iNotes
- CVE-2017-1546IBM DOORS Next Generation (DNG/RRC) 4.07, 5.0, and 6.0 is vulnerable to cross-site scripting.IBM Rational DOORS Next Generation
- CVE-2017-1558IBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM Maximo Asset Management
- CVE-2017-1635IBM Tivoli Monitoring V6 6.2.2.x could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free error.IBM Tivoli Monitoring
- CVE-2017-1716IBM Tivoli Workload Scheduler 8.6.0, 9.1.0, and 9.2.0 could disclose sensitive information to a local attacker due to improper permission seIBM Tivoli Workload Scheduler
- CVE-2017-17382Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before b
- CVE-2017-17427Radware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vulnerable to an adaptive-chosen ciphertext attack ("Bleichenba
- CVE-2017-17537MikroTik RouterBOARD v6.39.2 and v6.40.5 allows an unauthenticated remote attacker to cause a denial of service by connecting to TCP port 53
- CVE-2017-17549Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before b
- CVE-2017-17648Entrepreneur Dating Script 2.0.1 has SQL Injection via the search_result.php marital, gender, country, or profileid parameter.
- CVE-2017-14589It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur.Atlassian Bamboo
- CVE-2017-14590Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters.Atlassian Bamboo
- CVE-2017-17538MikroTik v6.40.5 devices allow remote attackers to cause a denial of service via a flood of ICMP packets.
- CVE-2017-17567Scubez Posty Readymade Classifieds has SQL Injection via the admin/user_activate_submit.php ID parameter.
- CVE-2017-17568Scubez Posty Readymade Classifieds has Incorrect Access Control for visiting admin/user_activate_submit.php (aka the backend PHP script), wh
- CVE-2017-17569Scubez Posty Readymade Classifieds has XSS via the admin/user_activate_submit.php ID parameter.
- CVE-2017-17570FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php fl_orig or fl_dest param
- CVE-2017-17571FS Foodpanda Clone 1.0 has SQL Injection via the /food keywords parameter.
- CVE-2017-17572FS Amazon Clone 1.0 has SQL Injection via the PATH_INFO to /VerAyari.
- CVE-2017-17573FS Ebay Clone 1.0 has SQL Injection via the product.php id parameter, or the search.php category_id or sub_category_id parameter.
- CVE-2017-17574FS Care Clone 1.0 has SQL Injection via the searchJob.php jobType or jobFrequency parameter.
- CVE-2017-17575FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter.
- CVE-2017-17576FS Gigs Script 1.0 has SQL Injection via the browse-category.php cat parameter, browse-scategory.php sc parameter, or service-provider.php s
- CVE-2017-17577FS Trademe Clone 1.0 has SQL Injection via the search_item.php search parameter or the general_item_details.php id parameter.
- CVE-2017-17578FS Crowdfunding Script 1.0 has SQL Injection via the latest_news_details.php id parameter.
- CVE-2017-17579FS Freelancer Clone 1.0 has SQL Injection via the profile.php u parameter.
- CVE-2017-17580FS Linkedin Clone 1.0 has SQL Injection via the group.php grid parameter, profile.php fid parameter, or company_details.php id parameter.
- CVE-2017-17581FS Quibids Clone 1.0 has SQL Injection via the itechd.php productid parameter.
- CVE-2017-17582FS Grubhub Clone 1.0 has SQL Injection via the /food keywords parameter.
- CVE-2017-17583FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter.
- CVE-2017-17584FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php fl_orig or fl_dest parameter.
- CVE-2017-17585FS Monster Clone 1.0 has SQL Injection via the Employer_Details.php id parameter.
- CVE-2017-17586FS Olx Clone 1.0 has SQL Injection via the subpage.php scat parameter or the message.php pid parameter.
- CVE-2017-17587FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or company/index.php c p
- CVE-2017-17588FS IMDB Clone 1.0 has SQL Injection via the movie.php f parameter, tvshow.php s parameter, or show_misc_video.php id parameter.
- CVE-2017-17589FS Thumbtack Clone 1.0 has SQL Injection via the browse-category.php cat parameter or the browse-scategory.php sc parameter.
- CVE-2017-17590FS Stackoverflow Clone 1.0 has SQL Injection via the /question keywords parameter.
- CVE-2017-17591Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.
- CVE-2017-17592Website Auction Marketplace 2.0.5 has SQL Injection via the search.php cat_id parameter.
- CVE-2017-17593Simple Chatting System 1.0 allows Arbitrary File Upload via view/my_profile.php, which places files under uploads/.
- CVE-2017-17594DomainSale PHP Script 1.0 has SQL Injection via the domain.php id parameter.
- CVE-2017-17595Beauty Parlour Booking Script 1.0 has SQL Injection via the /list gender or city parameter.
- CVE-2017-17596Entrepreneur Job Portal Script 2.0.6 has SQL Injection via the jobsearch_all.php rid1 parameter.
- CVE-2017-17597Nearbuy Clone Script 3.2 has SQL Injection via the category_list.php search parameter.
- CVE-2017-17598Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter.
- CVE-2017-17599Advance Online Learning Management Script 3.1 has SQL Injection via the courselist.php subcatid or popcourseid parameter.
- CVE-2017-17600Basic B2B Script 2.0.8 has SQL Injection via the product_details.php id parameter.
- CVE-2017-17601Cab Booking Script 1.0 has SQL Injection via the /service-list city parameter.
- CVE-2017-17602Advance B2B Script 2.1.3 has SQL Injection via the tradeshow-list-detail.php show_id or view-product.php pid parameter.
- CVE-2017-17603Advanced Real Estate Script 4.0.7 has SQL Injection via the search-results.php Projectmain, proj_type, searchtext, sell_price, or maxprice p
- CVE-2017-17604Entrepreneur Bus Booking Script 3.0.4 has SQL Injection via the booker_details.php sourcebus parameter.
- CVE-2017-17605Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter.
- CVE-2017-17606Co-work Space Search Script 1.0 has SQL Injection via the /list city parameter.
- CVE-2017-17607CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.
- CVE-2017-17608Child Care Script 1.0 has SQL Injection via the /list city parameter.
- CVE-2017-17609Chartered Accountant Booking Script 1.0 has SQL Injection via the /service-list city parameter.
- CVE-2017-17610E-commerce MLM Software 1.0 has SQL Injection via the service_detail.php pid parameter, event_detail.php eventid parameter, or news_detail.p
- CVE-2017-17611Doctor Search Script 1.0 has SQL Injection via the /list city parameter.
- CVE-2017-17612Hot Scripts Clone 3.1 has SQL Injection via the /categories subctid or mctid parameter.
- CVE-2017-17613Freelance Website Script 2.0.6 has SQL Injection via the jobdetails.php pr_id parameter or the searchbycat_list.php catid parameter.
- CVE-2017-17614Food Order Script 1.0 has SQL Injection via the /list city parameter.
- CVE-2017-17615Facebook Clone Script 1.0 has SQL Injection via the friend-profile.php id parameter.
- CVE-2017-17616Event Search Script 1.0 has SQL Injection via the /event-list city parameter.
- CVE-2017-17617Foodspotting Clone Script 1.0 has SQL Injection via the quicksearch.php q parameter.
- CVE-2017-17618Kickstarter Clone Script 2.0 has SQL Injection via the investcalc.php projid parameter.
- CVE-2017-17619Laundry Booking Script 1.0 has SQL Injection via the /list city parameter.
- CVE-2017-17620Lawyer Search Script 1.1 has SQL Injection via the /lawyer-list city parameter.
- CVE-2017-17621Multivendor Penny Auction Clone Script 1.0 has SQL Injection via the PATH_INFO to the /detail URI.
- CVE-2017-17622Online Exam Test Application Script 1.6 has SQL Injection via the exams.php sort parameter.
- CVE-2017-17623Opensource Classified Ads Script 3.2 has SQL Injection via the advance_result.php keyword parameter.
- CVE-2017-17624PHP Multivendor Ecommerce 1.0 has SQL Injection via the single_detail.php sid parameter, or the category.php searchcat or chid1 parameter.
- CVE-2017-17625Professional Service Script 1.0 has SQL Injection via the service-list city parameter.
- CVE-2017-17626Readymade PHP Classified Script 3.3 has SQL Injection via the /categories subctid or mctid parameter.
- CVE-2017-17627Readymade Video Sharing Script 3.2 has SQL Injection via the single-video-detail.php report_videos array parameter.
- CVE-2017-17628Responsive Realestate Script 3.2 has SQL Injection via the property-list tbud parameter.
- CVE-2017-17629Secure E-commerce Script 2.0.1 has SQL Injection via the category.php searchmain or searchcat parameter, or the single_detail.php sid parame
- CVE-2017-17630Yoga Class Script 1.0 has SQL Injection via the /list city parameter.
- CVE-2017-17631Multireligion Responsive Matrimonial 4.7.2 has SQL Injection via the success-story.php succid parameter.
- CVE-2017-17632Responsive Events And Movie Ticket Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
- CVE-2017-17633Multiplex Movie Theater Booking Script 3.1.5 has SQL Injection via the trailer-detail.php moid parameter, show-time.php moid parameter, or e
- CVE-2017-17634Single Theater Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
- CVE-2017-17635MLM Forex Market Plan Script 2.0.4 has SQL Injection via the news_detail.php newid parameter or the event_detail.php eventid parameter.
- CVE-2017-17636MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.
- CVE-2017-17637Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.
- CVE-2017-17638Groupon Clone Script 3.01 has SQL Injection via the city_ajax.php state_id parameter.
- CVE-2017-17639Muslim Matrimonial Script 3.02 has SQL Injection via the success-story.php succid parameter.
- CVE-2017-17640Advanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or the state.php country parameter.
- CVE-2017-17641Resume Clone Script 2.0.5 has SQL Injection via the preview.php id parameter.
- CVE-2017-17642Basic Job Site Script 2.0.5 has SQL Injection via the keyword parameter to /job.
- CVE-2017-4942VMware AirWatch Console (AWC) contains a Broken Access Control vulnerability.VMware Airwatch Console
- CVE-2017-17669There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp in Exiv2 0.26.