# CVEs published 2017-12-13

104 CVEs were published on December 13, 2017: 0 critical, 6 high. Days are UTC.

- [CVE-2017-7738](https://cve.now/CVE-2017-7738.md): An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with (no CVSS, Fortinet FortiOS)
- [CVE-2017-11305](https://cve.now/CVE-2017-11305.md): A regression affecting Adobe Flash Player version 27.0.0.187 (and earlier versions) causes the unintended reset of the global settings prefe (no CVSS, Adobe Flash Player 27.0.0.187 and earlier versions)
- [CVE-2017-14380](https://cve.now/CVE-2017-14380.md): In EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, and 7.1.1.x, a malicious compliance admin (co (no CVSS, EMC Isilon OneFS 8.1.0.0, 8.0.1.0 8.0.1.1, 8.0.0.0 - 8.0.0.…)
- [CVE-2017-17664](https://cve.now/CVE-2017-17664.md): A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified As (no CVSS)
- [CVE-2017-17665](https://cve.now/CVE-2017-17665.md): In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. (no CVSS)
- [CVE-2017-15529](https://cve.now/CVE-2017-15529.md): Prior to 4.4.1.10, the Norton Family Android App can be susceptible to a Denial of Service (DoS) exploit. (no CVSS, Symantec Norton Family Android App)
- [CVE-2017-15530](https://cve.now/CVE-2017-15530.md): Prior to 4.4.1.10, the Norton Family Android App can be susceptible to an Information Disclosure issue. (no CVSS, Symantec Norton Family Android App)
- [CVE-2017-1421](https://cve.now/CVE-2017-1421.md): IBM iNotes is vulnerable to cross-site scripting. (no CVSS, IBM iNotes)
- [CVE-2017-1546](https://cve.now/CVE-2017-1546.md): IBM DOORS Next Generation (DNG/RRC) 4.07, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS Next Generation)
- [CVE-2017-1558](https://cve.now/CVE-2017-1558.md): IBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (no CVSS, IBM Maximo Asset Management)
- [CVE-2017-1635](https://cve.now/CVE-2017-1635.md): IBM Tivoli Monitoring V6 6.2.2.x could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free error. (no CVSS, IBM Tivoli Monitoring)
- [CVE-2017-1716](https://cve.now/CVE-2017-1716.md): IBM Tivoli Workload Scheduler 8.6.0, 9.1.0, and 9.2.0 could disclose sensitive information to a local attacker due to improper permission se (no CVSS, IBM Tivoli Workload Scheduler)
- [CVE-2017-17382](https://cve.now/CVE-2017-17382.md): Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before b (no CVSS)
- [CVE-2017-17427](https://cve.now/CVE-2017-17427.md): Radware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vulnerable to an adaptive-chosen ciphertext attack ("Bleichenba (no CVSS)
- [CVE-2017-17537](https://cve.now/CVE-2017-17537.md): MikroTik RouterBOARD v6.39.2 and v6.40.5 allows an unauthenticated remote attacker to cause a denial of service by connecting to TCP port 53 (no CVSS)
- [CVE-2017-17549](https://cve.now/CVE-2017-17549.md): Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before b (no CVSS)
- [CVE-2017-17648](https://cve.now/CVE-2017-17648.md): Entrepreneur Dating Script 2.0.1 has SQL Injection via the search\_result.php marital, gender, country, or profileid parameter. (no CVSS)
- [CVE-2017-14589](https://cve.now/CVE-2017-14589.md): It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. (no CVSS, Atlassian Bamboo)
- [CVE-2017-14590](https://cve.now/CVE-2017-14590.md): Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. (no CVSS, Atlassian Bamboo)
- [CVE-2017-17538](https://cve.now/CVE-2017-17538.md): MikroTik v6.40.5 devices allow remote attackers to cause a denial of service via a flood of ICMP packets. (no CVSS)
- [CVE-2017-17567](https://cve.now/CVE-2017-17567.md): Scubez Posty Readymade Classifieds has SQL Injection via the admin/user\_activate\_submit.php ID parameter. (no CVSS)
- [CVE-2017-17568](https://cve.now/CVE-2017-17568.md): Scubez Posty Readymade Classifieds has Incorrect Access Control for visiting admin/user\_activate\_submit.php (aka the backend PHP script), wh (no CVSS)
- [CVE-2017-17569](https://cve.now/CVE-2017-17569.md): Scubez Posty Readymade Classifieds has XSS via the admin/user\_activate\_submit.php ID parameter. (no CVSS)
- [CVE-2017-17570](https://cve.now/CVE-2017-17570.md): FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php fl\_orig or fl\_dest param (no CVSS)
- [CVE-2017-17571](https://cve.now/CVE-2017-17571.md): FS Foodpanda Clone 1.0 has SQL Injection via the /food keywords parameter. (no CVSS)
- [CVE-2017-17572](https://cve.now/CVE-2017-17572.md): FS Amazon Clone 1.0 has SQL Injection via the PATH\_INFO to /VerAyari. (no CVSS)
- [CVE-2017-17573](https://cve.now/CVE-2017-17573.md): FS Ebay Clone 1.0 has SQL Injection via the product.php id parameter, or the search.php category\_id or sub\_category\_id parameter. (no CVSS)
- [CVE-2017-17574](https://cve.now/CVE-2017-17574.md): FS Care Clone 1.0 has SQL Injection via the searchJob.php jobType or jobFrequency parameter. (no CVSS)
- [CVE-2017-17575](https://cve.now/CVE-2017-17575.md): FS Groupon Clone 1.0 has SQL Injection via the item\_details.php id parameter or the vendor\_details.php id parameter. (no CVSS)
- [CVE-2017-17576](https://cve.now/CVE-2017-17576.md): FS Gigs Script 1.0 has SQL Injection via the browse-category.php cat parameter, browse-scategory.php sc parameter, or service-provider.php s (no CVSS)
- [CVE-2017-17577](https://cve.now/CVE-2017-17577.md): FS Trademe Clone 1.0 has SQL Injection via the search\_item.php search parameter or the general\_item\_details.php id parameter. (no CVSS)
- [CVE-2017-17578](https://cve.now/CVE-2017-17578.md): FS Crowdfunding Script 1.0 has SQL Injection via the latest\_news\_details.php id parameter. (no CVSS)
- [CVE-2017-17579](https://cve.now/CVE-2017-17579.md): FS Freelancer Clone 1.0 has SQL Injection via the profile.php u parameter. (no CVSS)
- [CVE-2017-17580](https://cve.now/CVE-2017-17580.md): FS Linkedin Clone 1.0 has SQL Injection via the group.php grid parameter, profile.php fid parameter, or company\_details.php id parameter. (no CVSS)
- [CVE-2017-17581](https://cve.now/CVE-2017-17581.md): FS Quibids Clone 1.0 has SQL Injection via the itechd.php productid parameter. (no CVSS)
- [CVE-2017-17582](https://cve.now/CVE-2017-17582.md): FS Grubhub Clone 1.0 has SQL Injection via the /food keywords parameter. (no CVSS)
- [CVE-2017-17583](https://cve.now/CVE-2017-17583.md): FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter. (no CVSS)
- [CVE-2017-17584](https://cve.now/CVE-2017-17584.md): FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php fl\_orig or fl\_dest parameter. (no CVSS)
- [CVE-2017-17585](https://cve.now/CVE-2017-17585.md): FS Monster Clone 1.0 has SQL Injection via the Employer\_Details.php id parameter. (no CVSS)
- [CVE-2017-17586](https://cve.now/CVE-2017-17586.md): FS Olx Clone 1.0 has SQL Injection via the subpage.php scat parameter or the message.php pid parameter. (no CVSS)
- [CVE-2017-17587](https://cve.now/CVE-2017-17587.md): FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or company/index.php c p (no CVSS)
- [CVE-2017-17588](https://cve.now/CVE-2017-17588.md): FS IMDB Clone 1.0 has SQL Injection via the movie.php f parameter, tvshow.php s parameter, or show\_misc\_video.php id parameter. (no CVSS)
- [CVE-2017-17589](https://cve.now/CVE-2017-17589.md): FS Thumbtack Clone 1.0 has SQL Injection via the browse-category.php cat parameter or the browse-scategory.php sc parameter. (no CVSS)
- [CVE-2017-17590](https://cve.now/CVE-2017-17590.md): FS Stackoverflow Clone 1.0 has SQL Injection via the /question keywords parameter. (no CVSS)
- [CVE-2017-17591](https://cve.now/CVE-2017-17591.md): Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter. (no CVSS)
- [CVE-2017-17592](https://cve.now/CVE-2017-17592.md): Website Auction Marketplace 2.0.5 has SQL Injection via the search.php cat\_id parameter. (no CVSS)
- [CVE-2017-17593](https://cve.now/CVE-2017-17593.md): Simple Chatting System 1.0 allows Arbitrary File Upload via view/my\_profile.php, which places files under uploads/. (no CVSS)
- [CVE-2017-17594](https://cve.now/CVE-2017-17594.md): DomainSale PHP Script 1.0 has SQL Injection via the domain.php id parameter. (no CVSS)
- [CVE-2017-17595](https://cve.now/CVE-2017-17595.md): Beauty Parlour Booking Script 1.0 has SQL Injection via the /list gender or city parameter. (no CVSS)
- [CVE-2017-17596](https://cve.now/CVE-2017-17596.md): Entrepreneur Job Portal Script 2.0.6 has SQL Injection via the jobsearch\_all.php rid1 parameter. (no CVSS)
- [CVE-2017-17597](https://cve.now/CVE-2017-17597.md): Nearbuy Clone Script 3.2 has SQL Injection via the category\_list.php search parameter. (no CVSS)
- [CVE-2017-17598](https://cve.now/CVE-2017-17598.md): Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter. (no CVSS)
- [CVE-2017-17599](https://cve.now/CVE-2017-17599.md): Advance Online Learning Management Script 3.1 has SQL Injection via the courselist.php subcatid or popcourseid parameter. (no CVSS)
- [CVE-2017-17600](https://cve.now/CVE-2017-17600.md): Basic B2B Script 2.0.8 has SQL Injection via the product\_details.php id parameter. (no CVSS)
- [CVE-2017-17601](https://cve.now/CVE-2017-17601.md): Cab Booking Script 1.0 has SQL Injection via the /service-list city parameter. (no CVSS)
- [CVE-2017-17602](https://cve.now/CVE-2017-17602.md): Advance B2B Script 2.1.3 has SQL Injection via the tradeshow-list-detail.php show\_id or view-product.php pid parameter. (no CVSS)
- [CVE-2017-17603](https://cve.now/CVE-2017-17603.md): Advanced Real Estate Script 4.0.7 has SQL Injection via the search-results.php Projectmain, proj\_type, searchtext, sell\_price, or maxprice p (no CVSS)
- [CVE-2017-17604](https://cve.now/CVE-2017-17604.md): Entrepreneur Bus Booking Script 3.0.4 has SQL Injection via the booker\_details.php sourcebus parameter. (no CVSS)
- [CVE-2017-17605](https://cve.now/CVE-2017-17605.md): Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter. (no CVSS)
- [CVE-2017-17606](https://cve.now/CVE-2017-17606.md): Co-work Space Search Script 1.0 has SQL Injection via the /list city parameter. (no CVSS)
- [CVE-2017-17607](https://cve.now/CVE-2017-17607.md): CMS Auditor Website 1.0 has SQL Injection via the PATH\_INFO to /news-detail. (no CVSS)
- [CVE-2017-17608](https://cve.now/CVE-2017-17608.md): Child Care Script 1.0 has SQL Injection via the /list city parameter. (no CVSS)
- [CVE-2017-17609](https://cve.now/CVE-2017-17609.md): Chartered Accountant Booking Script 1.0 has SQL Injection via the /service-list city parameter. (no CVSS)
- [CVE-2017-17610](https://cve.now/CVE-2017-17610.md): E-commerce MLM Software 1.0 has SQL Injection via the service\_detail.php pid parameter, event\_detail.php eventid parameter, or news\_detail.p (no CVSS)
- [CVE-2017-17611](https://cve.now/CVE-2017-17611.md): Doctor Search Script 1.0 has SQL Injection via the /list city parameter. (no CVSS)
- [CVE-2017-17612](https://cve.now/CVE-2017-17612.md): Hot Scripts Clone 3.1 has SQL Injection via the /categories subctid or mctid parameter. (no CVSS)
- [CVE-2017-17613](https://cve.now/CVE-2017-17613.md): Freelance Website Script 2.0.6 has SQL Injection via the jobdetails.php pr\_id parameter or the searchbycat\_list.php catid parameter. (no CVSS)
- [CVE-2017-17614](https://cve.now/CVE-2017-17614.md): Food Order Script 1.0 has SQL Injection via the /list city parameter. (no CVSS)
- [CVE-2017-17615](https://cve.now/CVE-2017-17615.md): Facebook Clone Script 1.0 has SQL Injection via the friend-profile.php id parameter. (no CVSS)
- [CVE-2017-17616](https://cve.now/CVE-2017-17616.md): Event Search Script 1.0 has SQL Injection via the /event-list city parameter. (no CVSS)
- [CVE-2017-17617](https://cve.now/CVE-2017-17617.md): Foodspotting Clone Script 1.0 has SQL Injection via the quicksearch.php q parameter. (no CVSS)
- [CVE-2017-17618](https://cve.now/CVE-2017-17618.md): Kickstarter Clone Script 2.0 has SQL Injection via the investcalc.php projid parameter. (no CVSS)
- [CVE-2017-17619](https://cve.now/CVE-2017-17619.md): Laundry Booking Script 1.0 has SQL Injection via the /list city parameter. (no CVSS)
- [CVE-2017-17620](https://cve.now/CVE-2017-17620.md): Lawyer Search Script 1.1 has SQL Injection via the /lawyer-list city parameter. (no CVSS)
- [CVE-2017-17621](https://cve.now/CVE-2017-17621.md): Multivendor Penny Auction Clone Script 1.0 has SQL Injection via the PATH\_INFO to the /detail URI. (no CVSS)
- [CVE-2017-17622](https://cve.now/CVE-2017-17622.md): Online Exam Test Application Script 1.6 has SQL Injection via the exams.php sort parameter. (no CVSS)
- [CVE-2017-17623](https://cve.now/CVE-2017-17623.md): Opensource Classified Ads Script 3.2 has SQL Injection via the advance\_result.php keyword parameter. (no CVSS)
- [CVE-2017-17624](https://cve.now/CVE-2017-17624.md): PHP Multivendor Ecommerce 1.0 has SQL Injection via the single\_detail.php sid parameter, or the category.php searchcat or chid1 parameter. (no CVSS)
- [CVE-2017-17625](https://cve.now/CVE-2017-17625.md): Professional Service Script 1.0 has SQL Injection via the service-list city parameter. (no CVSS)
- [CVE-2017-17626](https://cve.now/CVE-2017-17626.md): Readymade PHP Classified Script 3.3 has SQL Injection via the /categories subctid or mctid parameter. (no CVSS)
- [CVE-2017-17627](https://cve.now/CVE-2017-17627.md): Readymade Video Sharing Script 3.2 has SQL Injection via the single-video-detail.php report\_videos array parameter. (no CVSS)
- [CVE-2017-17628](https://cve.now/CVE-2017-17628.md): Responsive Realestate Script 3.2 has SQL Injection via the property-list tbud parameter. (no CVSS)
- [CVE-2017-17629](https://cve.now/CVE-2017-17629.md): Secure E-commerce Script 2.0.1 has SQL Injection via the category.php searchmain or searchcat parameter, or the single\_detail.php sid parame (no CVSS)
- [CVE-2017-17630](https://cve.now/CVE-2017-17630.md): Yoga Class Script 1.0 has SQL Injection via the /list city parameter. (no CVSS)
- [CVE-2017-17631](https://cve.now/CVE-2017-17631.md): Multireligion Responsive Matrimonial 4.7.2 has SQL Injection via the success-story.php succid parameter. (no CVSS)
- [CVE-2017-17632](https://cve.now/CVE-2017-17632.md): Responsive Events And Movie Ticket Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter. (no CVSS)
- [CVE-2017-17633](https://cve.now/CVE-2017-17633.md): Multiplex Movie Theater Booking Script 3.1.5 has SQL Injection via the trailer-detail.php moid parameter, show-time.php moid parameter, or e (no CVSS)
- [CVE-2017-17634](https://cve.now/CVE-2017-17634.md): Single Theater Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter. (no CVSS)
- [CVE-2017-17635](https://cve.now/CVE-2017-17635.md): MLM Forex Market Plan Script 2.0.4 has SQL Injection via the news\_detail.php newid parameter or the event\_detail.php eventid parameter. (no CVSS)
- [CVE-2017-17636](https://cve.now/CVE-2017-17636.md): MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter. (no CVSS)
- [CVE-2017-17637](https://cve.now/CVE-2017-17637.md): Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter. (no CVSS)
- [CVE-2017-17638](https://cve.now/CVE-2017-17638.md): Groupon Clone Script 3.01 has SQL Injection via the city\_ajax.php state\_id parameter. (no CVSS)
- [CVE-2017-17639](https://cve.now/CVE-2017-17639.md): Muslim Matrimonial Script 3.02 has SQL Injection via the success-story.php succid parameter. (no CVSS)
- [CVE-2017-17640](https://cve.now/CVE-2017-17640.md): Advanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or the state.php country parameter. (no CVSS)
- [CVE-2017-17641](https://cve.now/CVE-2017-17641.md): Resume Clone Script 2.0.5 has SQL Injection via the preview.php id parameter. (no CVSS)
- [CVE-2017-17642](https://cve.now/CVE-2017-17642.md): Basic Job Site Script 2.0.5 has SQL Injection via the keyword parameter to /job. (no CVSS)
- [CVE-2017-4942](https://cve.now/CVE-2017-4942.md): VMware AirWatch Console (AWC) contains a Broken Access Control vulnerability. (no CVSS, VMware Airwatch Console)
- [CVE-2017-5530](https://cve.now/CVE-2017-5530.md): SAML protocol handling errors in tibbr (CVSS 8.1, TIBCO Software tibbr Community · TIBCO Software tibbr Enter…)
- [CVE-2017-5534](https://cve.now/CVE-2017-5534.md): Improper sandboxing of a third-party component in tibbr (CVSS 8.8, TIBCO Software tibbr Community · TIBCO Software tibbr Enter…)
- [CVE-2017-13098](https://cve.now/CVE-2017-13098.md): BouncyCastle JCE TLS Bleichenbacher/ROBOT (CVSS 7.5, Legion of the Bouncy Castle BouncyCastle TLS · org.bouncyca…)
- [CVE-2017-13099](https://cve.now/CVE-2017-13099.md): wolfSSL Bleichenbacher/ROBOT (CVSS 7.5, wolfSSL)
- [CVE-2017-14361](https://cve.now/CVE-2017-14361.md): MFSBGN03793 rev.1 - Project and Portfolio Management Center, Multiple vulnerabilities (CVSS 7.4, Micro Focus Project and Portfolio Management Center)
- [CVE-2017-14362](https://cve.now/CVE-2017-14362.md): MFSBGN03793 rev.1 - Project and Portfolio Management Center, Multiple vulnerabilities (CVSS 7.3, Micro Focus Project and Portfolio Management Center)
- [CVE-2017-17669](https://cve.now/CVE-2017-17669.md): There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk\_int.cpp in Exiv2 0.26. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-12-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.