# CVEs published 2017-12-24 28 CVEs were published on December 24, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-17849](https://cve.now/CVE-2017-17849.md): A buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 and earlier could allow remote HTTP servers to execute arbitrary code o (no CVSS) - [CVE-2017-17891](https://cve.now/CVE-2017-17891.md): Readymade Video Sharing Script has CSRF via user-profile-edit.php. (no CVSS) - [CVE-2017-17892](https://cve.now/CVE-2017-17892.md): Readymade Video Sharing Script has SQL Injection via the viewsubs.php chnlid parameter or the search\_video.php search parameter. (no CVSS) - [CVE-2017-17893](https://cve.now/CVE-2017-17893.md): Readymade Video Sharing Script has XSS via the search\_video.php search parameter, the viewsubs.php chnlid parameter, or the user-profile-edi (no CVSS) - [CVE-2017-17894](https://cve.now/CVE-2017-17894.md): Readymade Job Site Script has CSRF via the /job URI. (no CVSS) - [CVE-2017-17895](https://cve.now/CVE-2017-17895.md): Readymade Job Site Script has SQL Injection via the location\_name array parameter to the /job URI. (no CVSS) - [CVE-2017-17896](https://cve.now/CVE-2017-17896.md): Readymade Job Site Script has XSS via the keyword parameter to the /job URI. (no CVSS) - [CVE-2017-17897](https://cve.now/CVE-2017-17897.md): SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL command (no CVSS, dolibarr/dolibarr) - [CVE-2017-17898](https://cve.now/CVE-2017-17898.md): Dolibarr ERP/CRM version 6.0.4 does not block direct requests to \*.tpl.php files, which allows remote attackers to obtain sensitive informat (no CVSS, dolibarr/dolibarr) - [CVE-2017-17899](https://cve.now/CVE-2017-17899.md): SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrar (no CVSS, dolibarr/dolibarr) - [CVE-2017-17900](https://cve.now/CVE-2017-17900.md): SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands v (no CVSS, dolibarr/dolibarr) - [CVE-2017-17888](https://cve.now/CVE-2017-17888.md): cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 --\> AWU 500, Sauter ERW100F001, (no CVSS) - [CVE-2017-17859](https://cve.now/CVE-2017-17859.md): Samsung Internet Browser 6.2.01.12 allows remote attackers to bypass the Same Origin Policy, and conduct UXSS attacks to obtain sensitive in (no CVSS) - [CVE-2017-17879](https://cve.now/CVE-2017-17879.md): In ImageMagick 7.0.7-16 Q16 x86\_64 2017-12-21, there is a heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length (no CVSS) - [CVE-2017-17880](https://cve.now/CVE-2017-17880.md): In ImageMagick 7.0.7-16 Q16 x86\_64 2017-12-21, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to a WEBP (no CVSS) - [CVE-2017-17881](https://cve.now/CVE-2017-17881.md): In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to c (no CVSS) - [CVE-2017-17882](https://cve.now/CVE-2017-17882.md): In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in coders/xpm.c, which allows attackers to c (no CVSS) - [CVE-2017-17883](https://cve.now/CVE-2017-17883.md): In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPGXImage in coders/pgx.c, which allows attackers to c (no CVSS) - [CVE-2017-17884](https://cve.now/CVE-2017-17884.md): In ImageMagick 7.0.7-16 Q16, a memory leak vulnerability was found in the function WriteOnePNGImage in coders/png.c, which allows attackers (no CVSS) - [CVE-2017-17885](https://cve.now/CVE-2017-17885.md): In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPICTImage in coders/pict.c, which allows attackers to (no CVSS) - [CVE-2017-17886](https://cve.now/CVE-2017-17886.md): In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPSDChannelZip in coders/psd.c, which allows attackers (no CVSS) - [CVE-2017-17887](https://cve.now/CVE-2017-17887.md): In ImageMagick 7.0.7-16 Q16, a memory leak vulnerability was found in the function GetImagePixelCache in magick/cache.c, which allows attack (no CVSS) - [CVE-2017-17877](https://cve.now/CVE-2017-17877.md): An issue was discovered in Valve Steam Link build 643. (no CVSS) - [CVE-2017-17878](https://cve.now/CVE-2017-17878.md): An issue was discovered in Valve Steam Link build 643. (no CVSS) - [CVE-2017-17871](https://cve.now/CVE-2017-17871.md): The "JEXTN Question And Answer" extension 3.1.0 for Joomla! has SQL Injection via the an parameter in a view=tags action, or the ques-srch p (no CVSS) - [CVE-2017-17872](https://cve.now/CVE-2017-17872.md): The JEXTN Video Gallery extension 3.0.5 for Joomla! has SQL Injection via the id parameter in a view=category action. (no CVSS) - [CVE-2017-17873](https://cve.now/CVE-2017-17873.md): Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATH\_INFO to the /p URI. (no CVSS) - [CVE-2017-17874](https://cve.now/CVE-2017-17874.md): Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, whi (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-12-24 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.