CVEs published December 26, 2017
19 CVEs were published on December 26, 2017: 0 critical, 2 high.
- Published
- 19
- Critical
- 0
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 17
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Siemens 7KT PAC1200 data manager (7KT1260) All versions <
- 1
- Siemens Development/Evaluation Kits for PROFINET IO: DK… +65
- 1
- Siemens LOGO! Soft Comfort
- 1
- Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +171
- 1
High 2
- CVE-2017-12736After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain conditions.Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +171
- CVE-2017-12741Specially crafted packets sent to port 161/udp could cause a denial of service condition.Siemens Development/Evaluation Kits for PROFINET IO: DK… +65
Medium, low and unrated 17
- CVE-2017-17924PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the id parameter to admin
- CVE-2017-17925PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title parameter.
- CVE-2017-17926PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attackers to register with
- CVE-2017-17927PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATH_INFO to se
- CVE-2017-17928PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter.
- CVE-2017-17929PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter.
- CVE-2017-17930PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a setting in the user p
- CVE-2017-17931PHP Scripts Mall Resume Clone Script has SQL Injection via the forget.php username parameter.
- CVE-2017-17912In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNComp
- CVE-2017-17913In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to an incomp
- CVE-2017-17914In ImageMagick 7.0.7-16 Q16, a vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows attackers to cause a de
- CVE-2017-17915In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadMNGImage in coders/png.c, related to accessing one
- CVE-2017-17911packages/core/contact.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?p=core/contact request, aka Open Bug Bounty
- CVE-2017-17875The JEXTN FAQ Pro extension 4.0.0 for Joomla! has SQL Injection via the id parameter in a view=category action.
- CVE-2017-17876Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request
- CVE-2017-12740Siemens LOGO! Soft Comfort (All versions before V8.2) lacks integrity verification of software packages downloaded via an unprotected communSiemens LOGO! Soft Comfort
- CVE-2017-9944A vulnerability has been identified in Siemens 7KT PAC1200 data manager (7KT1260) in all versions < V2.03.Siemens 7KT PAC1200 data manager (7KT1260) All versions <