CVEs published December 15, 2017
36 CVEs were published on December 15, 2017: 0 critical, 0 high.
- Published
- 36
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- ACTi D, B, I, and E series cameras
- 3
- Trend Micro ScanMail for Exchange
- 3
- D-Link DIR-130 · D-Link DIR-330
- 2
- The Qt Company Qt for Android
- 2
- Cisco legacy ASA 5500 products TLS protocol implementation
- 1
- Commvault Service Pack
- 1
- D-Link DIR-850L and potentially others
- 1
- Flash Seats Mobile App
- 1
- Fortinet FortiClient for Windows · Fortinet FortiClient… +1
- 1
- Pandora Media Pandora iOS App
- 1
Medium, low and unrated 36
- CVE-2017-14184An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and beloFortinet FortiClient for Windows · Fortinet FortiClient… +1
- CVE-2017-12373A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550) devices could alloCisco legacy ASA 5500 products TLS protocol implementation
- CVE-2017-17699K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025ac DeviceIoControl request.
- CVE-2017-17700K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025a4 DeviceIoControl request.
- CVE-2017-17701K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025c8 DeviceIoControl request.
- CVE-2017-17556A debug tool in Synaptics TouchPad drivers allows local users with administrative access to obtain sensitive information about keyboard scan
- CVE-2017-17698Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec.
- CVE-2017-14101A security researcher found an XML External Entity (XXE) vulnerability on the Conserus Image Repository archive solution version 2.1.1.105 b
- CVE-2017-16776Security researchers discovered an authentication bypass vulnerability in version 2.0.2 of the Conserus Workflow Intelligence application by
- CVE-2017-16787The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by l
- CVE-2017-16788Directory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration Utility in Meinberg LANTIME devices with f
- CVE-2017-15890Cross-site scripting (XSS) vulnerability in Disclaimer in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inSynology MailPlus Server
- CVE-2017-10904Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.The Qt Company Qt for Android
- CVE-2017-10905A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified The Qt Company Qt for Android
- CVE-2017-11397A service DLL preloading vulnerability in Trend Micro Encryption for Email versions 5.6 and below could allow an unauthenticated remote attaTrend Micro Encryption for Email
- CVE-2017-14090A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted.Trend Micro ScanMail for Exchange
- CVE-2017-14091A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific installations that utilize a uncommon feature - OTrend Micro ScanMail for Exchange
- CVE-2017-14092The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticate
- CVE-2017-14093The Log Query and Quarantine Query pages in Trend Micro ScanMail for Exchange 12.0 are vulnerable to cross site scripting (XSS) attacks.Trend Micro ScanMail for Exchange
- CVE-2017-3184ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC fail to properly restrict access to the factory ACTi D, B, I, and E series cameras
- CVE-2017-3185ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method ACTi D, B, I, and E series cameras
- CVE-2017-3186ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all deACTi D, B, I, and E series cameras
- CVE-2017-3190Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificaFlash Seats Mobile App
- CVE-2017-3191D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page.D-Link DIR-130 · D-Link DIR-330
- CVE-2017-3192D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials.D-Link DIR-130 · D-Link DIR-330
- CVE-2017-3193Multiple D-Link devices including the DIR-850L firmware versions 1.14B07 and 2.07.B05 contain a stack-based buffer overflow vulnerability inD-Link DIR-850L and potentially others
- CVE-2017-3194Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attackPandora Media Pandora iOS App
- CVE-2017-3195Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflCommvault Service Pack
- CVE-2017-3196PCAUSA Rawether framework does not properly validate BPF data, allowing a crafted malicious BPF program to perform operations on memory outsPrinting Communications Assoc., Inc. (PCAUSA) ASUS PCE-AC56…
- CVE-2017-17405Ruby before 2.4.3 allows Net::FTP command injection.
- CVE-2017-17670In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module l
- CVE-2017-17693Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remo
- CVE-2017-17694Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.
- CVE-2017-17695Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter.
- CVE-2017-17696Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php.
- CVE-2017-17697The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping.