CVEs published December 18, 2017
31 CVEs were published on December 18, 2017: 0 critical, 0 high.
- Published
- 31
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Heketi · github.com/heketi/heketi
- 2
- Apache Software Foundation Apache Drill · org.apache.drill:…
- 1
- Apache Software Foundation Apache Sling · org.apache.sling:…
- 1
- glibc 2.19 through
- 1
Medium, low and unrated 31
- CVE-2017-15700A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, thApache Software Foundation Apache Sling · org.apache.sling:…
- CVE-2017-15103A security-check flaw was found in the way the Heketi 5 server API handled user requests.Heketi · github.com/heketi/heketi
- CVE-2017-15104An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable.Heketi · github.com/heketi/heketi
- CVE-2017-11562A Session Fixation Vulnerability exists in the MT4 Networks SenhaSegura Web Application 2.2.23.8 via login_if.php.
- CVE-2017-15524The Application Firewall Pack (AFP, aka Web Application Firewall) component on Kemp Load Balancer devices with software before 7.2.40.1 allo
- CVE-2017-15875SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the "checkema
- CVE-2017-15876Unrestricted File Upload vulnerability in GPWeb 8.4.61 allows remote authenticated users to upload any type of file, including a PHP shell.
- CVE-2017-15877Insecure Permissions vulnerability in db.php file in GPWeb 8.4.61 allows remote attackers to view the password and user database.
- CVE-2017-16949An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress.
- CVE-2017-17105Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras are vulnerable to unauthenticated, blind rem
- CVE-2017-17106Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin
- CVE-2017-17107Zivif PR115-204-P-RS V2.3.4.2103 web cameras contain a hard-coded cat1029 password for the root user.
- CVE-2017-17721CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, assignto, building, dom
- CVE-2017-12630In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effeApache Software Foundation Apache Drill · org.apache.drill:…
- CVE-2017-14583NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and 9.2P2 are susceptible to a vulnerability which allows an attacker to cause a De
- CVE-2017-17643FS Lynda Clone 1.0 has SQL Injection via the keywords parameter to tutorial/.
- CVE-2017-17645Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php.
- CVE-2017-17649Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter.
- CVE-2017-17651Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/
- CVE-2017-17741The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, a
- CVE-2017-17734CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.
- CVE-2017-17735CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.
- CVE-2017-17737The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network_diagnostics.html or /sto
- CVE-2017-17738The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and modifying files via /tools.html.
- CVE-2017-17739The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html rp parameter, allowi
- CVE-2017-17740contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to fr
- CVE-2017-17727DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templ
- CVE-2017-17730DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php.
- CVE-2017-17731DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.
- CVE-2017-17733Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.
- CVE-2017-16997elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (glibc 2.19 through