CVEs published December 20, 2017
133 CVEs were published on December 20, 2017: 0 critical, 0 high.
- Published
- 133
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 133
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- Foxit Reader
- 43
- IBM Security Guardium
- 10
- Cambium Networks cnPilot
- 5
- Cambium Networks ePMP
- 5
- Ecava IntegraXor
- 2
- IBM Tivoli Components
- 2
- VMware ESXi · VMware Workstation +1
- 2
- ABB Ellipse
- 1
- EMC Data Domain DD OS EMC Data Domain DD OS 5.7 family, ver…
- 1
- EMC Isilon OneFS EMC Isilon OneFS 8.1.0.0, EMC Isilon OneFS…
- 1
Medium, low and unrated 133
- CVE-2017-14385An issue was discovered in EMC Data Domain DD OS 5.7 family, versions prior to 5.7.5.6; EMC Data Domain DD OS 6.0 family, versions prior to EMC Data Domain DD OS EMC Data Domain DD OS 5.7 family, ver…
- CVE-2017-14387The NFS service in EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, and 8.0.0.0 - 8.0.0.4 maintains default NFS export settings (including the NEMC Isilon OneFS EMC Isilon OneFS 8.1.0.0, EMC Isilon OneFS…
- CVE-2017-17805The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker a
- CVE-2017-17806The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm
- CVE-2017-17807The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default reques
- CVE-2017-17809In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers t
- CVE-2011-4955Multiple cross-site scripting (XSS) vulnerabilities in ui_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attacke
- CVE-2017-5254In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changCambium Networks ePMP
- CVE-2017-5255In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console Cambium Networks ePMP
- CVE-2017-5256In version 3.5 and prior of Cambium Networks ePMP firmware, all authenticated users have the ability to update the Device Name and System DeCambium Networks ePMP
- CVE-2017-5257In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows (or guesses) the SNMP read/write (RW) community string canCambium Networks ePMP
- CVE-2017-5258In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows or can guess the RW community string can provide a URL forCambium Networks ePMP
- CVE-2017-5259In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available uCambium Networks cnPilot
- CVE-2017-5260In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available iCambium Networks cnPilot
- CVE-2017-5261In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative consoleCambium Networks cnPilot
- CVE-2017-5262In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive informCambium Networks cnPilot
- CVE-2017-5263Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which areCambium Networks cnPilot
- CVE-2012-2576SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, a
- CVE-2017-17745Cross-site scripting (XSS) vulnerability in system_name_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit a
- CVE-2017-17746Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access the
- CVE-2017-17747Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functional
- CVE-2017-6094CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance.
- CVE-2017-16717A Heap-based Buffer Overflow issue was discovered in WECON LeviStudio HMI.WECON Technology Co., Ltd. LeviStudio HMI
- CVE-2017-16725A Stack-based Buffer Overflow issue was discovered in Xiongmai Technology IP Cameras and DVRs using the NetSurveillance Web interface.Xiongmai Technology IP Cameras and DVRs
- CVE-2017-16731An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 (includiABB Ellipse
- CVE-2017-16733A SQL Injection issue was discovered in Ecava IntegraXor v 6.1.1030.1 and prior.Ecava IntegraXor
- CVE-2017-16735A SQL Injection issue was discovered in Ecava IntegraXor v 6.1.1030.1 and prior.Ecava IntegraXor
- CVE-2017-12072Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated uSynology Photo Station
- CVE-2017-1257IBM Security Guardium 10.0 discloses sensitive information to unauthorized users.IBM Security Guardium
- CVE-2017-1261IBM Security Guardium 10.0 stores potentially sensitive information in log files that could be read by a local user.IBM Security Guardium
- CVE-2017-1262IBM Security Guardium 10.0 is vulnerable to HTTP response splitting attacks.IBM Security Guardium
- CVE-2017-1266IBM Security Guardium 10.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified IBM Security Guardium
- CVE-2017-1270IBM Security Guardium 10.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijackinIBM Security Guardium
- CVE-2017-1423IBM WebSphere Portal 8.5 and 9.0 exposes backend server URLs that are configured for usage by the Web Application Bridge component.IBM WebSphere Portal
- CVE-2017-1494IBM Business Process Manager 8.5 is vulnerable to cross-site scripting.IBM Business Process Manager Advanced
- CVE-2017-14962In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Out of Bounds Write vulnerability because of not validating input va
- CVE-2017-14963In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values
- CVE-2017-14964In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values
- CVE-2017-14965In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values
- CVE-2017-14966In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values
- CVE-2017-14967In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values
- CVE-2017-14968In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values
- CVE-2017-14969In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values
- CVE-2017-15532Prior to 10.6.4, Symantec Messaging Gateway may be susceptible to a path traversal attack (also known as directory traversal).Symantec Messaging Gateway
- CVE-2017-1595IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vecIBM Security Guardium
- CVE-2017-1596IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vecIBM Security Guardium
- CVE-2017-1598IBM Security Guardium 10.0 Database Activity Monitor uses weaker than expected cryptographic algorithms that could allow an attacker to decrIBM Security Guardium
- CVE-2017-1600IBM Security Guardium 10.0 Database Activity Monitor is vulnerable to cross-site scripting.IBM Security Guardium
- CVE-2017-1631IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to eIBM Tivoli Components
- CVE-2017-1694IBM Integration Bus 9.0 and 10.0 transmits user credentials in plain in clear text which can be read by an attacker using man in the middle IBM Integration Bus
- CVE-2017-1696IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system.IBM Security QRadar SIEM
- CVE-2017-1746IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to eIBM Tivoli Components
- CVE-2017-1751IBM Robotic Process Automation with Automation Anywhere 10.0.0 is vulnerable to cross-site scripting.IBM Robotic Process Automation with Automation Anywhere
- CVE-2017-1757IBM Security Guardium 10.0 is vulnerable to SQL injection.IBM Security Guardium
- CVE-2017-16818RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and applicatio
- CVE-2017-17476Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might a
- CVE-2017-17752Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail s
- CVE-2017-4933VMware ESXi (6.5 before ESXi650-201710401-BG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) contain a vulnerability that VMware ESXi · VMware Workstation +1
- CVE-2017-4940The ESXi Host Client in VMware ESXi (6.5 before ESXi650-201712103-SG, 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG) cVMware ESXi
- CVE-2017-4941VMware ESXi (6.0 before ESXi600-201711101-SG, 5.5 ESXi550-201709101-SG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) conVMware ESXi · VMware Workstation +1
- CVE-2017-4943VMware vCenter Server Appliance (vCSA) (6.5 before 6.5 U1d) contains a local privilege escalation vulnerability via the 'showlog' plugin.VMware vCenter Server Appliance
- CVE-2017-10956This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-10957This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-10958This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-10959This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14818This vulnerability allows remote attackers to disclose sensitive on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14819This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14820This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14821This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14822This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14823This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14824This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14825This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14826This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14827This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14828This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14829This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14830This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14831This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14832This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14833This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14834This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14835This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-14836This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.Foxit Reader
- CVE-2017-14837This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-16571This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-16572This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-16573This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-16574This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-16575This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-16576This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-16577This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-16578This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013.Foxit Reader
- CVE-2017-16579This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013.Foxit Reader
- CVE-2017-16580This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013.Foxit Reader
- CVE-2017-16581This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013.Foxit Reader
- CVE-2017-16582This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013.Foxit Reader
- CVE-2017-16583This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013.Foxit Reader
- CVE-2017-16584This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013.Foxit Reader
- CVE-2017-16585This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013.Foxit Reader
- CVE-2017-16586This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013.Foxit Reader
- CVE-2017-16587This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013.Foxit Reader
- CVE-2017-16588This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-16589This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155.Foxit Reader
- CVE-2017-17782In GraphicsMagick 1.3.27a, there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c, related to oFFs chunk allocation.
- CVE-2017-17783In GraphicsMagick 1.3.27a, there is a buffer over-read in ReadPALMImage in coders/palm.c when QuantumDepth is 8.
- CVE-2017-17784In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c in the gbr import parser, related to mish
- CVE-2017-17785In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c.
- CVE-2017-17786In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related to bgr2rgb.part.1) via an unexpec
- CVE-2017-17787In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c.
- CVE-2017-17788In GIMP 2.8.22, there is a stack-based buffer over-read in xcf_load_stream in app/xcf/xcf.c when there is no '\0' character after the versio
- CVE-2017-17789In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c.
- CVE-2017-17790The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demons
- CVE-2017-17792Cross site scripting (XSS) vulnerability in the markup_clean_href function in inc/conv.php in BlogoText through 3.7.6 allows remote attacker
- CVE-2017-17793Information Disclosure vulnerability in creer_fichier_zip in admin/maintenance.php in BlogoText through 3.7.6 allows remote attackers to def
- CVE-2017-17794validate_form_preferences in admin/preferences.php in BlogoText through 3.7.6 allows attackers to bypass intended access restrictions via ve
- CVE-2017-17795In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecif
- CVE-2017-17796In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly ha
- CVE-2017-17797In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecif
- CVE-2017-17798In TG Soft Vir.IT eXplorer Lite 8.5.42, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly ha
- CVE-2017-17799In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly ha
- CVE-2017-17800In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly ha
- CVE-2017-17801In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly ha
- CVE-2017-17802In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly ha
- CVE-2017-17803In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly ha
- CVE-2017-17804In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecif
- CVE-2017-17774admin/configuration.php in Piwigo 2.9.2 has CSRF.
- CVE-2017-17775Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request.
- CVE-2017-17776Paid To Read Script 2.0.5 has full path disclosure via an invalid admin/userview.php uid parameter.
- CVE-2017-17777Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated by the admin/viewvisitcamp.php
- CVE-2017-17778Paid To Read Script 2.0.5 has XSS via the referrals.php tier parameter or the admin/userview.php uid parameter.
- CVE-2017-17779Paid To Read Script 2.0.5 has SQL injection via the referrals.php id parameter.
- CVE-2017-17780The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/