# CVEs published 2017-12-26

19 CVEs were published on December 26, 2017: 0 critical, 2 high. Days are UTC.

- [CVE-2017-17924](https://cve.now/CVE-2017-17924.md): PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the id parameter to admin (no CVSS)
- [CVE-2017-17925](https://cve.now/CVE-2017-17925.md): PHP Scripts Mall Professional Service Script has XSS via the admin/general\_settingupd.php website\_title parameter. (no CVSS)
- [CVE-2017-17926](https://cve.now/CVE-2017-17926.md): PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attackers to register with (no CVSS)
- [CVE-2017-17927](https://cve.now/CVE-2017-17927.md): PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATH\_INFO to se (no CVSS)
- [CVE-2017-17928](https://cve.now/CVE-2017-17928.md): PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter. (no CVSS)
- [CVE-2017-17929](https://cve.now/CVE-2017-17929.md): PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter. (no CVSS)
- [CVE-2017-17930](https://cve.now/CVE-2017-17930.md): PHP Scripts Mall Professional Service Script has CSRF via admin/general\_settingupd.php, as demonstrated by modifying a setting in the user p (no CVSS)
- [CVE-2017-17931](https://cve.now/CVE-2017-17931.md): PHP Scripts Mall Resume Clone Script has SQL Injection via the forget.php username parameter. (no CVSS)
- [CVE-2017-17912](https://cve.now/CVE-2017-17912.md): In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNComp (no CVSS)
- [CVE-2017-17913](https://cve.now/CVE-2017-17913.md): In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to an incomp (no CVSS)
- [CVE-2017-17914](https://cve.now/CVE-2017-17914.md): In ImageMagick 7.0.7-16 Q16, a vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows attackers to cause a de (no CVSS)
- [CVE-2017-17915](https://cve.now/CVE-2017-17915.md): In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadMNGImage in coders/png.c, related to accessing one (no CVSS)
- [CVE-2017-17911](https://cve.now/CVE-2017-17911.md): packages/core/contact.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?p=core/contact request, aka Open Bug Bounty (no CVSS)
- [CVE-2017-17875](https://cve.now/CVE-2017-17875.md): The JEXTN FAQ Pro extension 4.0.0 for Joomla! has SQL Injection via the id parameter in a view=category action. (no CVSS)
- [CVE-2017-17876](https://cve.now/CVE-2017-17876.md): Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request (no CVSS)
- [CVE-2017-12736](https://cve.now/CVE-2017-12736.md): After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain conditions. (CVSS 8.8, Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +171)
- [CVE-2017-12740](https://cve.now/CVE-2017-12740.md): Siemens LOGO! Soft Comfort (All versions before V8.2) lacks integrity verification of software packages downloaded via an unprotected commun (no CVSS, Siemens LOGO! Soft Comfort)
- [CVE-2017-12741](https://cve.now/CVE-2017-12741.md): Specially crafted packets sent to port 161/udp could cause a denial of service condition. (CVSS 7.5, Siemens Development/Evaluation Kits for PROFINET IO: DK… +65)
- [CVE-2017-9944](https://cve.now/CVE-2017-9944.md): A vulnerability has been identified in Siemens 7KT PAC1200 data manager (7KT1260) in all versions \< V2.03. (no CVSS, Siemens 7KT PAC1200 data manager (7KT1260) All versions \<)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-12-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.