# CVEs published 2017-12-18 31 CVEs were published on December 18, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-15700](https://cve.now/CVE-2017-15700.md): A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, th (no CVSS, Apache Software Foundation Apache Sling · org.apache.sling:…) - [CVE-2017-15103](https://cve.now/CVE-2017-15103.md): A security-check flaw was found in the way the Heketi 5 server API handled user requests. (no CVSS, Heketi · github.com/heketi/heketi) - [CVE-2017-15104](https://cve.now/CVE-2017-15104.md): An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. (no CVSS, Heketi · github.com/heketi/heketi) - [CVE-2017-11562](https://cve.now/CVE-2017-11562.md): A Session Fixation Vulnerability exists in the MT4 Networks SenhaSegura Web Application 2.2.23.8 via login\_if.php. (no CVSS) - [CVE-2017-15524](https://cve.now/CVE-2017-15524.md): The Application Firewall Pack (AFP, aka Web Application Firewall) component on Kemp Load Balancer devices with software before 7.2.40.1 allo (no CVSS) - [CVE-2017-15875](https://cve.now/CVE-2017-15875.md): SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the "checkema (no CVSS) - [CVE-2017-15876](https://cve.now/CVE-2017-15876.md): Unrestricted File Upload vulnerability in GPWeb 8.4.61 allows remote authenticated users to upload any type of file, including a PHP shell. (no CVSS) - [CVE-2017-15877](https://cve.now/CVE-2017-15877.md): Insecure Permissions vulnerability in db.php file in GPWeb 8.4.61 allows remote attackers to view the password and user database. (no CVSS) - [CVE-2017-16949](https://cve.now/CVE-2017-16949.md): An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. (no CVSS) - [CVE-2017-17105](https://cve.now/CVE-2017-17105.md): Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras are vulnerable to unauthenticated, blind rem (no CVSS) - [CVE-2017-17106](https://cve.now/CVE-2017-17106.md): Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin (no CVSS) - [CVE-2017-17107](https://cve.now/CVE-2017-17107.md): Zivif PR115-204-P-RS V2.3.4.2103 web cameras contain a hard-coded cat1029 password for the root user. (no CVSS) - [CVE-2017-17721](https://cve.now/CVE-2017-17721.md): CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, assignto, building, dom (no CVSS) - [CVE-2017-12630](https://cve.now/CVE-2017-12630.md): In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effe (no CVSS, Apache Software Foundation Apache Drill · org.apache.drill:…) - [CVE-2017-14583](https://cve.now/CVE-2017-14583.md): NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and 9.2P2 are susceptible to a vulnerability which allows an attacker to cause a De (no CVSS) - [CVE-2017-17643](https://cve.now/CVE-2017-17643.md): FS Lynda Clone 1.0 has SQL Injection via the keywords parameter to tutorial/. (no CVSS) - [CVE-2017-17645](https://cve.now/CVE-2017-17645.md): Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php. (no CVSS) - [CVE-2017-17649](https://cve.now/CVE-2017-17649.md): Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter. (no CVSS) - [CVE-2017-17651](https://cve.now/CVE-2017-17651.md): Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/ (no CVSS) - [CVE-2017-17741](https://cve.now/CVE-2017-17741.md): The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, a (no CVSS) - [CVE-2017-17734](https://cve.now/CVE-2017-17734.md): CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions. (no CVSS) - [CVE-2017-17735](https://cve.now/CVE-2017-17735.md): CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies. (no CVSS) - [CVE-2017-17737](https://cve.now/CVE-2017-17737.md): The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network\_diagnostics.html or /sto (no CVSS) - [CVE-2017-17738](https://cve.now/CVE-2017-17738.md): The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and modifying files via /tools.html. (no CVSS) - [CVE-2017-17739](https://cve.now/CVE-2017-17739.md): The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html rp parameter, allowi (no CVSS) - [CVE-2017-17740](https://cve.now/CVE-2017-17740.md): contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to fr (no CVSS) - [CVE-2017-17727](https://cve.now/CVE-2017-17727.md): DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templ (no CVSS) - [CVE-2017-17730](https://cve.now/CVE-2017-17730.md): DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink\_add.php. (no CVSS) - [CVE-2017-17731](https://cve.now/CVE-2017-17731.md): DedeCMS through 5.7 has SQL Injection via the $\_FILES superglobal to plus/recommend.php. (no CVSS) - [CVE-2017-17733](https://cve.now/CVE-2017-17733.md): Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request. (no CVSS) - [CVE-2017-16997](https://cve.now/CVE-2017-16997.md): elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged ( (no CVSS, glibc 2.19 through) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-12-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.