# CVEs published 2017-12-15

36 CVEs were published on December 15, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-14184](https://cve.now/CVE-2017-14184.md): An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and belo (no CVSS, Fortinet FortiClient for Windows · Fortinet FortiClient… +1)
- [CVE-2017-12373](https://cve.now/CVE-2017-12373.md): A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550) devices could allo (no CVSS, Cisco legacy ASA 5500 products TLS protocol implementation)
- [CVE-2017-17699](https://cve.now/CVE-2017-17699.md): K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025ac DeviceIoControl request. (no CVSS)
- [CVE-2017-17700](https://cve.now/CVE-2017-17700.md): K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025a4 DeviceIoControl request. (no CVSS)
- [CVE-2017-17701](https://cve.now/CVE-2017-17701.md): K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025c8 DeviceIoControl request. (no CVSS)
- [CVE-2017-17556](https://cve.now/CVE-2017-17556.md): A debug tool in Synaptics TouchPad drivers allows local users with administrative access to obtain sensitive information about keyboard scan (no CVSS)
- [CVE-2017-17698](https://cve.now/CVE-2017-17698.md): Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec. (no CVSS)
- [CVE-2017-14101](https://cve.now/CVE-2017-14101.md): A security researcher found an XML External Entity (XXE) vulnerability on the Conserus Image Repository archive solution version 2.1.1.105 b (no CVSS)
- [CVE-2017-16776](https://cve.now/CVE-2017-16776.md): Security researchers discovered an authentication bypass vulnerability in version 2.0.2 of the Conserus Workflow Intelligence application by (no CVSS)
- [CVE-2017-16787](https://cve.now/CVE-2017-16787.md): The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by l (no CVSS)
- [CVE-2017-16788](https://cve.now/CVE-2017-16788.md): Directory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration Utility in Meinberg LANTIME devices with f (no CVSS)
- [CVE-2017-15890](https://cve.now/CVE-2017-15890.md): Cross-site scripting (XSS) vulnerability in Disclaimer in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to in (no CVSS, Synology MailPlus Server)
- [CVE-2017-10904](https://cve.now/CVE-2017-10904.md): Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. (no CVSS, The Qt Company Qt for Android)
- [CVE-2017-10905](https://cve.now/CVE-2017-10905.md): A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified (no CVSS, The Qt Company Qt for Android)
- [CVE-2017-11397](https://cve.now/CVE-2017-11397.md): A service DLL preloading vulnerability in Trend Micro Encryption for Email versions 5.6 and below could allow an unauthenticated remote atta (no CVSS, Trend Micro Encryption for Email)
- [CVE-2017-14090](https://cve.now/CVE-2017-14090.md): A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted. (no CVSS, Trend Micro ScanMail for Exchange)
- [CVE-2017-14091](https://cve.now/CVE-2017-14091.md): A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific installations that utilize a uncommon feature - O (no CVSS, Trend Micro ScanMail for Exchange)
- [CVE-2017-14092](https://cve.now/CVE-2017-14092.md): The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticate (no CVSS)
- [CVE-2017-14093](https://cve.now/CVE-2017-14093.md): The Log Query and Quarantine Query pages in Trend Micro ScanMail for Exchange 12.0 are vulnerable to cross site scripting (XSS) attacks. (no CVSS, Trend Micro ScanMail for Exchange)
- [CVE-2017-3184](https://cve.now/CVE-2017-3184.md): ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC fail to properly restrict access to the factory (no CVSS, ACTi D, B, I, and E series cameras)
- [CVE-2017-3185](https://cve.now/CVE-2017-3185.md): ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method (no CVSS, ACTi D, B, I, and E series cameras)
- [CVE-2017-3186](https://cve.now/CVE-2017-3186.md): ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all de (no CVSS, ACTi D, B, I, and E series cameras)
- [CVE-2017-3190](https://cve.now/CVE-2017-3190.md): Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certifica (no CVSS, Flash Seats Mobile App)
- [CVE-2017-3191](https://cve.now/CVE-2017-3191.md): D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. (no CVSS, D-Link DIR-130 · D-Link DIR-330)
- [CVE-2017-3192](https://cve.now/CVE-2017-3192.md): D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. (no CVSS, D-Link DIR-130 · D-Link DIR-330)
- [CVE-2017-3193](https://cve.now/CVE-2017-3193.md): Multiple D-Link devices including the DIR-850L firmware versions 1.14B07 and 2.07.B05 contain a stack-based buffer overflow vulnerability in (no CVSS, D-Link DIR-850L and potentially others)
- [CVE-2017-3194](https://cve.now/CVE-2017-3194.md): Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attack (no CVSS, Pandora Media Pandora iOS App)
- [CVE-2017-3195](https://cve.now/CVE-2017-3195.md): Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overfl (no CVSS, Commvault Service Pack)
- [CVE-2017-3196](https://cve.now/CVE-2017-3196.md): PCAUSA Rawether framework does not properly validate BPF data, allowing a crafted malicious BPF program to perform operations on memory outs (no CVSS, Printing Communications Assoc., Inc. (PCAUSA) ASUS PCE-AC56…)
- [CVE-2017-17405](https://cve.now/CVE-2017-17405.md): Ruby before 2.4.3 allows Net::FTP command injection. (no CVSS)
- [CVE-2017-17670](https://cve.now/CVE-2017-17670.md): In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module l (no CVSS)
- [CVE-2017-17693](https://cve.now/CVE-2017-17693.md): Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remo (no CVSS)
- [CVE-2017-17694](https://cve.now/CVE-2017-17694.md): Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter. (no CVSS)
- [CVE-2017-17695](https://cve.now/CVE-2017-17695.md): Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter. (no CVSS)
- [CVE-2017-17696](https://cve.now/CVE-2017-17696.md): Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php. (no CVSS)
- [CVE-2017-17697](https://cve.now/CVE-2017-17697.md): The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-12-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.