# CVEs published 2017-12-21

51 CVEs were published on December 21, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-14363](https://cve.now/CVE-2017-14363.md): MFSBGN03795 rev.1 - Micro Focus Operations Manager i - Remote Cross-Site Scripting (XSS) (CVSS 5.9, Micro Focus Operations Manager i)
- [CVE-2017-17692](https://cve.now/CVE-2017-17692.md): Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted Java (no CVSS)
- [CVE-2017-0301](https://cve.now/CVE-2017-0301.md): In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM port (no CVSS, F5 Networks BIG-IP APM)
- [CVE-2017-0304](https://cve.now/CVE-2017-0304.md): A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12.0.0, 12.1.0, 12.1.1, 12.1.2 and 13.0.0 that may allow a (no CVSS, F5 Networks BIG-IP AFM)
- [CVE-2017-6129](https://cve.now/CVE-2017-6129.md): In F5 BIG-IP APM software version 13.0.0 and 12.1.2, in some circumstances, APM tunneled VPN flows can cause a VPN/PPP connflow to be premat (no CVSS, F5 Networks BIG-IP APM)
- [CVE-2017-6132](https://cve.now/CVE-2017-6132.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2, 11.6. (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…)
- [CVE-2017-6133](https://cve.now/CVE-2017-6133.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, undisclo (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…)
- [CVE-2017-6134](https://cve.now/CVE-2017-6134.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, 12.1.0 - 12.1.2 and 11. (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…)
- [CVE-2017-6135](https://cve.now/CVE-2017-6135.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, a slow memory leak as a (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…)
- [CVE-2017-6136](https://cve.now/CVE-2017-6136.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, und (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…)
- [CVE-2017-6138](https://cve.now/CVE-2017-6138.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, mal (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…)
- [CVE-2017-6139](https://cve.now/CVE-2017-6139.md): In F5 BIG-IP APM software version 13.0.0 and 12.1.2, under rare conditions, the BIG-IP APM system appends log details when responding to cli (no CVSS, F5 Networks BIG-IP APM)
- [CVE-2017-6140](https://cve.now/CVE-2017-6140.md): On the BIG-IP 2000s, 2200s, 4000s, 4200v, i5600, i5800, i7600, i7800, i10600,i10800, and VIPRION 4450 blades, running version 11.5.0, 11.5.1 (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, Analytics, ASM, DNS, GTM,…)
- [CVE-2017-6151](https://cve.now/CVE-2017-6151.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 1 (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…)
- [CVE-2017-6164](https://cve.now/CVE-2017-6164.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 1 (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…)
- [CVE-2017-6167](https://cve.now/CVE-2017-6167.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, race con (no CVSS, F5 Networks BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS,…)
- [CVE-2015-4100](https://cve.now/CVE-2015-4100.md): Puppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates for arbitrary nodes by leveraging a client c (no CVSS)
- [CVE-2015-7224](https://cve.now/CVE-2015-7224.md): puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a (no CVSS)
- [CVE-2017-17027](https://cve.now/CVE-2017-17027.md): A buffer overflow vulnerability in FTP service in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) buil (no CVSS, QNAP QTS FTP service)
- [CVE-2017-17028](https://cve.now/CVE-2017-17028.md): A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (no CVSS, QNAP QTS External Device function)
- [CVE-2017-17029](https://cve.now/CVE-2017-17029.md): A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) b (no CVSS, QNAP QTS Login function)
- [CVE-2017-17030](https://cve.now/CVE-2017-17030.md): A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) b (no CVSS, QNAP QTS Login function)
- [CVE-2017-17031](https://cve.now/CVE-2017-17031.md): A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2 (no CVSS, QNAP QTS Password function)
- [CVE-2017-17032](https://cve.now/CVE-2017-17032.md): A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2 (no CVSS, QNAP QTS Password function)
- [CVE-2017-17033](https://cve.now/CVE-2017-17033.md): A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2 (no CVSS, QNAP QTS Notification function)
- [CVE-2017-17408](https://cve.now/CVE-2017-17408.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. (no CVSS, Bitdefender Internet Security)
- [CVE-2017-17409](https://cve.now/CVE-2017-17409.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. (no CVSS, Bitdefender Internet Security)
- [CVE-2017-17410](https://cve.now/CVE-2017-17410.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. (no CVSS, Bitdefender Internet Security)
- [CVE-2017-17411](https://cve.now/CVE-2017-17411.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. (no CVSS, Linksys WVBR0)
- [CVE-2017-17831](https://cve.now/CVE-2017-17831.md): GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostn (no CVSS, github.com/git-lfs/git-lfs)
- [CVE-2017-17828](https://cve.now/CVE-2017-17828.md): Bus Booking Script has XSS via the results.php datepicker parameter or the admin/new\_master.php spemail parameter. (no CVSS)
- [CVE-2017-17829](https://cve.now/CVE-2017-17829.md): Bus Booking Script has SQL Injection via the admin/view\_seatseller.php sp\_id parameter or the admin/view\_member.php memid parameter. (no CVSS)
- [CVE-2017-17830](https://cve.now/CVE-2017-17830.md): Bus Booking Script has CSRF via admin/new\_master.php. (no CVSS)
- [CVE-2017-17822](https://cve.now/CVE-2017-17822.md): The List Users API of Piwigo 2.9.2 is vulnerable to SQL Injection via the /admin/user\_list\_backend.php sSortDir\_0 parameter. (no CVSS)
- [CVE-2017-17823](https://cve.now/CVE-2017-17823.md): The Configuration component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/configuration.php order\_by array parameter. (no CVSS)
- [CVE-2017-17824](https://cve.now/CVE-2017-17824.md): The Batch Manager component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/batch\_manager\_unit.php element\_ids parameter in uni (no CVSS)
- [CVE-2017-17825](https://cve.now/CVE-2017-17825.md): The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags-\* array parameters in an admin.php?pag (no CVSS)
- [CVE-2017-17826](https://cve.now/CVE-2017-17826.md): The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallery\_title parameter in an admin.php (no CVSS)
- [CVE-2017-17827](https://cve.now/CVE-2017-17827.md): Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration&section=main or /admin.php?page=batch\_manager&mod (no CVSS)
- [CVE-2017-17810](https://cve.now/CVE-2017-17810.md): In Netwide Assembler (NASM) 2.14rc0, there is a "SEGV on unknown address" that will cause a remote denial of service attack, because asm/pre (no CVSS)
- [CVE-2017-17811](https://cve.now/CVE-2017-17811.md): In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer overflow that will cause a remote denial of service attack, related to a s (no CVSS)
- [CVE-2017-17812](https://cve.now/CVE-2017-17812.md): In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read in the function detoken() in asm/preproc.c that will cause a rem (no CVSS)
- [CVE-2017-17813](https://cve.now/CVE-2017-17813.md): In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in the pp\_list\_one\_macro function in asm/preproc.c that will cause a remote d (no CVSS)
- [CVE-2017-17814](https://cve.now/CVE-2017-17814.md): In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in do\_directive in asm/preproc.c that will cause a remote denial of service a (no CVSS)
- [CVE-2017-17815](https://cve.now/CVE-2017-17815.md): In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in is\_mmacro() in asm/preproc.c that will cause a remote denial of s (no CVSS)
- [CVE-2017-17816](https://cve.now/CVE-2017-17816.md): In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp\_getline in asm/preproc.c that will cause a remote denial of service att (no CVSS)
- [CVE-2017-17817](https://cve.now/CVE-2017-17817.md): In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp\_verror in asm/preproc.c that will cause a remote denial of service atta (no CVSS)
- [CVE-2017-17818](https://cve.now/CVE-2017-17818.md): In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read that will cause a remote denial of service attack, related to a (no CVSS)
- [CVE-2017-17819](https://cve.now/CVE-2017-17819.md): In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function find\_cc() in asm/preproc.c that will cause a remote (no CVSS)
- [CVE-2017-17820](https://cve.now/CVE-2017-17820.md): In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp\_list\_one\_macro in asm/preproc.c that will lead to a remote denial of se (no CVSS)
- [CVE-2017-17821](https://cve.now/CVE-2017-17821.md): WTF/wtf/FastBitVector.h in WebKit, as distributed in Safari Technology Preview Release 46, allows remote attackers to cause a denial of serv (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-12-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.