# CVEs published 2017-12-20

133 CVEs were published on December 20, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-14385](https://cve.now/CVE-2017-14385.md): An issue was discovered in EMC Data Domain DD OS 5.7 family, versions prior to 5.7.5.6; EMC Data Domain DD OS 6.0 family, versions prior to (no CVSS, EMC Data Domain DD OS EMC Data Domain DD OS 5.7 family, ver…)
- [CVE-2017-14387](https://cve.now/CVE-2017-14387.md): The NFS service in EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, and 8.0.0.0 - 8.0.0.4 maintains default NFS export settings (including the N (no CVSS, EMC Isilon OneFS EMC Isilon OneFS 8.1.0.0, EMC Isilon OneFS…)
- [CVE-2017-17805](https://cve.now/CVE-2017-17805.md): The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker a (no CVSS)
- [CVE-2017-17806](https://cve.now/CVE-2017-17806.md): The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm (no CVSS)
- [CVE-2017-17807](https://cve.now/CVE-2017-17807.md): The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default reques (no CVSS)
- [CVE-2017-17809](https://cve.now/CVE-2017-17809.md): In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers t (no CVSS)
- [CVE-2011-4955](https://cve.now/CVE-2011-4955.md): Multiple cross-site scripting (XSS) vulnerabilities in ui\_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attacke (no CVSS)
- [CVE-2017-5254](https://cve.now/CVE-2017-5254.md): In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of chang (no CVSS, Cambium Networks ePMP)
- [CVE-2017-5255](https://cve.now/CVE-2017-5255.md): In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console (no CVSS, Cambium Networks ePMP)
- [CVE-2017-5256](https://cve.now/CVE-2017-5256.md): In version 3.5 and prior of Cambium Networks ePMP firmware, all authenticated users have the ability to update the Device Name and System De (no CVSS, Cambium Networks ePMP)
- [CVE-2017-5257](https://cve.now/CVE-2017-5257.md): In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows (or guesses) the SNMP read/write (RW) community string can (no CVSS, Cambium Networks ePMP)
- [CVE-2017-5258](https://cve.now/CVE-2017-5258.md): In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows or can guess the RW community string can provide a URL for (no CVSS, Cambium Networks ePMP)
- [CVE-2017-5259](https://cve.now/CVE-2017-5259.md): In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available u (no CVSS, Cambium Networks cnPilot)
- [CVE-2017-5260](https://cve.now/CVE-2017-5260.md): In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available i (no CVSS, Cambium Networks cnPilot)
- [CVE-2017-5261](https://cve.now/CVE-2017-5261.md): In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console (no CVSS, Cambium Networks cnPilot)
- [CVE-2017-5262](https://cve.now/CVE-2017-5262.md): In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive inform (no CVSS, Cambium Networks cnPilot)
- [CVE-2017-5263](https://cve.now/CVE-2017-5263.md): Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which are (no CVSS, Cambium Networks cnPilot)
- [CVE-2012-2576](https://cve.now/CVE-2012-2576.md): SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, a (no CVSS)
- [CVE-2017-17745](https://cve.now/CVE-2017-17745.md): Cross-site scripting (XSS) vulnerability in system\_name\_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit a (no CVSS)
- [CVE-2017-17746](https://cve.now/CVE-2017-17746.md): Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access the (no CVSS)
- [CVE-2017-17747](https://cve.now/CVE-2017-17747.md): Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functional (no CVSS)
- [CVE-2017-6094](https://cve.now/CVE-2017-6094.md): CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. (no CVSS)
- [CVE-2017-16717](https://cve.now/CVE-2017-16717.md): A Heap-based Buffer Overflow issue was discovered in WECON LeviStudio HMI. (no CVSS, WECON Technology Co., Ltd. LeviStudio HMI)
- [CVE-2017-16725](https://cve.now/CVE-2017-16725.md): A Stack-based Buffer Overflow issue was discovered in Xiongmai Technology IP Cameras and DVRs using the NetSurveillance Web interface. (no CVSS, Xiongmai Technology IP Cameras and DVRs)
- [CVE-2017-16731](https://cve.now/CVE-2017-16731.md): An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 (includi (no CVSS, ABB Ellipse)
- [CVE-2017-16733](https://cve.now/CVE-2017-16733.md): A SQL Injection issue was discovered in Ecava IntegraXor v 6.1.1030.1 and prior. (no CVSS, Ecava IntegraXor)
- [CVE-2017-16735](https://cve.now/CVE-2017-16735.md): A SQL Injection issue was discovered in Ecava IntegraXor v 6.1.1030.1 and prior. (no CVSS, Ecava IntegraXor)
- [CVE-2017-12072](https://cve.now/CVE-2017-12072.md): Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated u (no CVSS, Synology Photo Station)
- [CVE-2017-1257](https://cve.now/CVE-2017-1257.md): IBM Security Guardium 10.0 discloses sensitive information to unauthorized users. (no CVSS, IBM Security Guardium)
- [CVE-2017-1261](https://cve.now/CVE-2017-1261.md): IBM Security Guardium 10.0 stores potentially sensitive information in log files that could be read by a local user. (no CVSS, IBM Security Guardium)
- [CVE-2017-1262](https://cve.now/CVE-2017-1262.md): IBM Security Guardium 10.0 is vulnerable to HTTP response splitting attacks. (no CVSS, IBM Security Guardium)
- [CVE-2017-1266](https://cve.now/CVE-2017-1266.md): IBM Security Guardium 10.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified (no CVSS, IBM Security Guardium)
- [CVE-2017-1270](https://cve.now/CVE-2017-1270.md): IBM Security Guardium 10.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijackin (no CVSS, IBM Security Guardium)
- [CVE-2017-1423](https://cve.now/CVE-2017-1423.md): IBM WebSphere Portal 8.5 and 9.0 exposes backend server URLs that are configured for usage by the Web Application Bridge component. (no CVSS, IBM WebSphere Portal)
- [CVE-2017-1494](https://cve.now/CVE-2017-1494.md): IBM Business Process Manager 8.5 is vulnerable to cross-site scripting. (no CVSS, IBM Business Process Manager Advanced)
- [CVE-2017-14962](https://cve.now/CVE-2017-14962.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Out of Bounds Write vulnerability because of not validating input va (no CVSS)
- [CVE-2017-14963](https://cve.now/CVE-2017-14963.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values (no CVSS)
- [CVE-2017-14964](https://cve.now/CVE-2017-14964.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values (no CVSS)
- [CVE-2017-14965](https://cve.now/CVE-2017-14965.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values (no CVSS)
- [CVE-2017-14966](https://cve.now/CVE-2017-14966.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values (no CVSS)
- [CVE-2017-14967](https://cve.now/CVE-2017-14967.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values (no CVSS)
- [CVE-2017-14968](https://cve.now/CVE-2017-14968.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values (no CVSS)
- [CVE-2017-14969](https://cve.now/CVE-2017-14969.md): In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values (no CVSS)
- [CVE-2017-15532](https://cve.now/CVE-2017-15532.md): Prior to 10.6.4, Symantec Messaging Gateway may be susceptible to a path traversal attack (also known as directory traversal). (no CVSS, Symantec Messaging Gateway)
- [CVE-2017-1595](https://cve.now/CVE-2017-1595.md): IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vec (no CVSS, IBM Security Guardium)
- [CVE-2017-1596](https://cve.now/CVE-2017-1596.md): IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vec (no CVSS, IBM Security Guardium)
- [CVE-2017-1598](https://cve.now/CVE-2017-1598.md): IBM Security Guardium 10.0 Database Activity Monitor uses weaker than expected cryptographic algorithms that could allow an attacker to decr (no CVSS, IBM Security Guardium)
- [CVE-2017-1600](https://cve.now/CVE-2017-1600.md): IBM Security Guardium 10.0 Database Activity Monitor is vulnerable to cross-site scripting. (no CVSS, IBM Security Guardium)
- [CVE-2017-1631](https://cve.now/CVE-2017-1631.md): IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to e (no CVSS, IBM Tivoli Components)
- [CVE-2017-1694](https://cve.now/CVE-2017-1694.md): IBM Integration Bus 9.0 and 10.0 transmits user credentials in plain in clear text which can be read by an attacker using man in the middle (no CVSS, IBM Integration Bus)
- [CVE-2017-1696](https://cve.now/CVE-2017-1696.md): IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. (no CVSS, IBM Security QRadar SIEM)
- [CVE-2017-1746](https://cve.now/CVE-2017-1746.md): IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to e (no CVSS, IBM Tivoli Components)
- [CVE-2017-1751](https://cve.now/CVE-2017-1751.md): IBM Robotic Process Automation with Automation Anywhere 10.0.0 is vulnerable to cross-site scripting. (no CVSS, IBM Robotic Process Automation with Automation Anywhere)
- [CVE-2017-1757](https://cve.now/CVE-2017-1757.md): IBM Security Guardium 10.0 is vulnerable to SQL injection. (no CVSS, IBM Security Guardium)
- [CVE-2017-16818](https://cve.now/CVE-2017-16818.md): RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and applicatio (no CVSS)
- [CVE-2017-17476](https://cve.now/CVE-2017-17476.md): Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might a (no CVSS)
- [CVE-2017-17752](https://cve.now/CVE-2017-17752.md): Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail s (no CVSS)
- [CVE-2017-4933](https://cve.now/CVE-2017-4933.md): VMware ESXi (6.5 before ESXi650-201710401-BG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) contain a vulnerability that (no CVSS, VMware ESXi · VMware Workstation +1)
- [CVE-2017-4940](https://cve.now/CVE-2017-4940.md): The ESXi Host Client in VMware ESXi (6.5 before ESXi650-201712103-SG, 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG) c (no CVSS, VMware ESXi)
- [CVE-2017-4941](https://cve.now/CVE-2017-4941.md): VMware ESXi (6.0 before ESXi600-201711101-SG, 5.5 ESXi550-201709101-SG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) con (no CVSS, VMware ESXi · VMware Workstation +1)
- [CVE-2017-4943](https://cve.now/CVE-2017-4943.md): VMware vCenter Server Appliance (vCSA) (6.5 before 6.5 U1d) contains a local privilege escalation vulnerability via the 'showlog' plugin. (no CVSS, VMware vCenter Server Appliance)
- [CVE-2017-10956](https://cve.now/CVE-2017-10956.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-10957](https://cve.now/CVE-2017-10957.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-10958](https://cve.now/CVE-2017-10958.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-10959](https://cve.now/CVE-2017-10959.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14818](https://cve.now/CVE-2017-14818.md): This vulnerability allows remote attackers to disclose sensitive on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14819](https://cve.now/CVE-2017-14819.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14820](https://cve.now/CVE-2017-14820.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14821](https://cve.now/CVE-2017-14821.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14822](https://cve.now/CVE-2017-14822.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14823](https://cve.now/CVE-2017-14823.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14824](https://cve.now/CVE-2017-14824.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14825](https://cve.now/CVE-2017-14825.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14826](https://cve.now/CVE-2017-14826.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14827](https://cve.now/CVE-2017-14827.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14828](https://cve.now/CVE-2017-14828.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14829](https://cve.now/CVE-2017-14829.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14830](https://cve.now/CVE-2017-14830.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14831](https://cve.now/CVE-2017-14831.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14832](https://cve.now/CVE-2017-14832.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14833](https://cve.now/CVE-2017-14833.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14834](https://cve.now/CVE-2017-14834.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14835](https://cve.now/CVE-2017-14835.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-14836](https://cve.now/CVE-2017-14836.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1. (no CVSS, Foxit Reader)
- [CVE-2017-14837](https://cve.now/CVE-2017-14837.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16571](https://cve.now/CVE-2017-16571.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16572](https://cve.now/CVE-2017-16572.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16573](https://cve.now/CVE-2017-16573.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16574](https://cve.now/CVE-2017-16574.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16575](https://cve.now/CVE-2017-16575.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16576](https://cve.now/CVE-2017-16576.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16577](https://cve.now/CVE-2017-16577.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16578](https://cve.now/CVE-2017-16578.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16579](https://cve.now/CVE-2017-16579.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16580](https://cve.now/CVE-2017-16580.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16581](https://cve.now/CVE-2017-16581.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16582](https://cve.now/CVE-2017-16582.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16583](https://cve.now/CVE-2017-16583.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16584](https://cve.now/CVE-2017-16584.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16585](https://cve.now/CVE-2017-16585.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16586](https://cve.now/CVE-2017-16586.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16587](https://cve.now/CVE-2017-16587.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. (no CVSS, Foxit Reader)
- [CVE-2017-16588](https://cve.now/CVE-2017-16588.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-16589](https://cve.now/CVE-2017-16589.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. (no CVSS, Foxit Reader)
- [CVE-2017-17782](https://cve.now/CVE-2017-17782.md): In GraphicsMagick 1.3.27a, there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c, related to oFFs chunk allocation. (no CVSS)
- [CVE-2017-17783](https://cve.now/CVE-2017-17783.md): In GraphicsMagick 1.3.27a, there is a buffer over-read in ReadPALMImage in coders/palm.c when QuantumDepth is 8. (no CVSS)
- [CVE-2017-17784](https://cve.now/CVE-2017-17784.md): In GIMP 2.8.22, there is a heap-based buffer over-read in load\_image in plug-ins/common/file-gbr.c in the gbr import parser, related to mish (no CVSS)
- [CVE-2017-17785](https://cve.now/CVE-2017-17785.md): In GIMP 2.8.22, there is a heap-based buffer overflow in the fli\_read\_brun function in plug-ins/file-fli/fli.c. (no CVSS)
- [CVE-2017-17786](https://cve.now/CVE-2017-17786.md): In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related to bgr2rgb.part.1) via an unexpec (no CVSS)
- [CVE-2017-17787](https://cve.now/CVE-2017-17787.md): In GIMP 2.8.22, there is a heap-based buffer over-read in read\_creator\_block in plug-ins/common/file-psp.c. (no CVSS)
- [CVE-2017-17788](https://cve.now/CVE-2017-17788.md): In GIMP 2.8.22, there is a stack-based buffer over-read in xcf\_load\_stream in app/xcf/xcf.c when there is no '\\0' character after the versio (no CVSS)
- [CVE-2017-17789](https://cve.now/CVE-2017-17789.md): In GIMP 2.8.22, there is a heap-based buffer overflow in read\_channel\_data in plug-ins/common/file-psp.c. (no CVSS)
- [CVE-2017-17790](https://cve.now/CVE-2017-17790.md): The lazy\_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demons (no CVSS)
- [CVE-2017-17792](https://cve.now/CVE-2017-17792.md): Cross site scripting (XSS) vulnerability in the markup\_clean\_href function in inc/conv.php in BlogoText through 3.7.6 allows remote attacker (no CVSS)
- [CVE-2017-17793](https://cve.now/CVE-2017-17793.md): Information Disclosure vulnerability in creer\_fichier\_zip in admin/maintenance.php in BlogoText through 3.7.6 allows remote attackers to def (no CVSS)
- [CVE-2017-17794](https://cve.now/CVE-2017-17794.md): validate\_form\_preferences in admin/preferences.php in BlogoText through 3.7.6 allows attackers to bypass intended access restrictions via ve (no CVSS)
- [CVE-2017-17795](https://cve.now/CVE-2017-17795.md): In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecif (no CVSS)
- [CVE-2017-17796](https://cve.now/CVE-2017-17796.md): In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly ha (no CVSS)
- [CVE-2017-17797](https://cve.now/CVE-2017-17797.md): In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecif (no CVSS)
- [CVE-2017-17798](https://cve.now/CVE-2017-17798.md): In TG Soft Vir.IT eXplorer Lite 8.5.42, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly ha (no CVSS)
- [CVE-2017-17799](https://cve.now/CVE-2017-17799.md): In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly ha (no CVSS)
- [CVE-2017-17800](https://cve.now/CVE-2017-17800.md): In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly ha (no CVSS)
- [CVE-2017-17801](https://cve.now/CVE-2017-17801.md): In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly ha (no CVSS)
- [CVE-2017-17802](https://cve.now/CVE-2017-17802.md): In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly ha (no CVSS)
- [CVE-2017-17803](https://cve.now/CVE-2017-17803.md): In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly ha (no CVSS)
- [CVE-2017-17804](https://cve.now/CVE-2017-17804.md): In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecif (no CVSS)
- [CVE-2017-17774](https://cve.now/CVE-2017-17774.md): admin/configuration.php in Piwigo 2.9.2 has CSRF. (no CVSS)
- [CVE-2017-17775](https://cve.now/CVE-2017-17775.md): Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request. (no CVSS)
- [CVE-2017-17776](https://cve.now/CVE-2017-17776.md): Paid To Read Script 2.0.5 has full path disclosure via an invalid admin/userview.php uid parameter. (no CVSS)
- [CVE-2017-17777](https://cve.now/CVE-2017-17777.md): Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated by the admin/viewvisitcamp.php (no CVSS)
- [CVE-2017-17778](https://cve.now/CVE-2017-17778.md): Paid To Read Script 2.0.5 has XSS via the referrals.php tier parameter or the admin/userview.php uid parameter. (no CVSS)
- [CVE-2017-17779](https://cve.now/CVE-2017-17779.md): Paid To Read Script 2.0.5 has SQL injection via the referrals.php id parameter. (no CVSS)
- [CVE-2017-17780](https://cve.now/CVE-2017-17780.md): The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/ (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.