CVEs published December 14, 2017
35 CVEs were published on December 14, 2017: 0 critical, 2 high.
- Published
- 35
- Critical
- 0
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Apache Software Foundation Apache Fineract
- 1
- ecstatic
- 1
- Fortinet FortiClientWindows
- 1
- passenger
- 1
- Rapid7 Nexpose
- 1
- rtv
- 1
High 2
- CVE-2017-17514boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allo
- CVE-2017-17520tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, whic
Medium, low and unrated 33
- CVE-2017-16355In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if passenger
- CVE-2017-5264Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrativRapid7 Nexpose
- CVE-2016-10703A regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js of the ecstatic npm package, before version 2.0.0, alecstatic
- CVE-2017-7344A privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privilege via exploiting tFortinet FortiClientWindows
- CVE-2017-17511KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow rem
- CVE-2017-17513TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might
- CVE-2017-17515etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which
- CVE-2017-17516scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by thertv
- CVE-2017-17517libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variabl
- CVE-2017-17518swt/motif/browser.c in White_dune (aka whitedune) 0.30.10 does not validate strings before launching the program specified by the BROWSER en
- CVE-2017-17519batteriesConfig.mlp in OCaml Batteries Included (aka ocaml-batteries) 2.6 does not validate strings before launching the program specified b
- CVE-2017-17521uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable,
- CVE-2017-17522Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variab
- CVE-2017-17524library/www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment varia
- CVE-2017-17525guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environmen
- CVE-2017-17526Input.cc in Bernard Parisse Giac 1.2.3.57 does not validate strings before launching the program specified by the BROWSER environment variab
- CVE-2017-17527delphi_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment
- CVE-2017-17528backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER envir
- CVE-2017-17529af/util/xp/ut_go_file.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment var
- CVE-2017-17530common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which
- CVE-2017-17531gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which mi
- CVE-2017-17532examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment
- CVE-2017-17533default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might
- CVE-2017-17534uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which mi
- CVE-2017-17535lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable,
- CVE-2017-5663In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read Apache Software Foundation Apache Fineract
- CVE-2017-17680In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in coders/xpm.c, which allows attackers to c
- CVE-2017-17681In ImageMagick 7.0.7-12 Q16, an infinite loop vulnerability was found in the function ReadPSDChannelZip in coders/psd.c, which allows attack
- CVE-2017-17682In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, which allows attackers
- CVE-2017-17683Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c44 \\.\PSMEMDriver DeviceIoControl request.
- CVE-2017-17684Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c04 \\.\PSMEMDriver DeviceIoControl request.
- CVE-2017-17671vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request
- CVE-2017-17672In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certa