# CVEs published 2017-12-27 23 CVEs were published on December 27, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2015-6237](https://cve.now/CVE-2015-6237.md): The RPC service in Tripwire (formerly nCircle) IP360 VnE Manager 7.2.2 before 7.2.6 allows remote attackers to bypass authentication and (1) (no CVSS) - [CVE-2015-7324](https://cve.now/CVE-2015-7324.md): Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com\_komento) component before 2.0.5 fo (no CVSS) - [CVE-2015-7666](https://cve.now/CVE-2015-7666.md): Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp\_updateMessageItem and (2) cp\_deleteMessageItem functions in cp\_ppp\_admin\_i (no CVSS) - [CVE-2015-7667](https://cve.now/CVE-2015-7667.md): Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in th (no CVSS) - [CVE-2015-7668](https://cve.now/CVE-2015-7668.md): Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote att (no CVSS) - [CVE-2015-7669](https://cve.now/CVE-2015-7669.md): Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin befo (no CVSS) - [CVE-2017-11695](https://cve.now/CVE-2017-11695.md): Heap-based buffer overflow in the alloc\_segs function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-depend (no CVSS) - [CVE-2017-11696](https://cve.now/CVE-2017-11696.md): Heap-based buffer overflow in the \_\_hash\_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-depen (no CVSS) - [CVE-2017-11697](https://cve.now/CVE-2017-11697.md): The \_\_hash\_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context-dependent attackers to cause a denial of se (no CVSS) - [CVE-2017-11698](https://cve.now/CVE-2017-11698.md): Heap-based buffer overflow in the \_\_get\_page function in lib/dbm/src/h\_page.c in Mozilla Network Security Services (NSS) allows context-depe (no CVSS) - [CVE-2017-9608](https://cve.now/CVE-2017-9608.md): The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer derefere (no CVSS) - [CVE-2014-8389](https://cve.now/CVE-2014-8389.md): cgi-bin/mft/wireless\_mft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive BU-3026 with firmware 1.43 21.08.2014, AirLive MD- (no CVSS) - [CVE-2015-3637](https://cve.now/CVE-2015-3637.md): SQL injection vulnerability in phpMyBackupPro when run in multi-user mode before 2.5 allows remote attackers to execute arbitrary SQL comman (no CVSS) - [CVE-2015-7889](https://cve.now/CVE-2015-7889.md): The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.a (no CVSS) - [CVE-2017-10910](https://cve.now/CVE-2017-10910.md): MQTT.js 2.x.x prior to 2.15.0 issue in handling PUBLISH tickets may lead to an attacker causing a denial-of-service condition. (no CVSS, MQTT.js. MQTT.js ยท mqtt) - [CVE-2016-6914](https://cve.now/CVE-2016-6914.md): Ubiquiti UniFi Video before 3.8.0 for Windows uses weak permissions for the installation directory, which allows local users to gain SYSTEM (no CVSS) - [CVE-2017-13056](https://cve.now/CVE-2017-13056.md): The launchURL function in PDF-XChange Viewer 2.5 (Build 314.0) might allow remote attackers to execute arbitrary code via a crafted PDF file (no CVSS) - [CVE-2017-16768](https://cve.now/CVE-2017-16768.md): Cross-site scripting (XSS) vulnerability in User Policy editor in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated use (no CVSS) - [CVE-2017-1191](https://cve.now/CVE-2017-1191.md): An undisclosed vulnerability in CLM applications (including IBM Rational Collaborative Lifecycle Management 4.0, 5.0, and 6.0) with potentia (no CVSS, IBM Rational Collaborative Lifecycle Management) - [CVE-2017-1365](https://cve.now/CVE-2017-1365.md): IBM Team Concert (RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0) is vulnerable to cross-site scripting. (no CVSS, IBM Rational Collaborative Lifecycle Management) - [CVE-2017-1698](https://cve.now/CVE-2017-1698.md): IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could reveal sensitive information from an error message that could lead to further attacks agai (no CVSS, IBM WebSphere Portal) - [CVE-2017-17934](https://cve.now/CVE-2017-17934.md): ImageMagick 7.0.7-17 Q16 x86\_64 has memory leaks in coders/msl.c, related to MSLPopImage and ProcessMSLScript, and associated with mishandli (no CVSS) - [CVE-2017-17935](https://cve.now/CVE-2017-17935.md): The File\_read\_line function in epan/wslua/wslua\_file.c in Wireshark through 2.2.11 does not properly strip '\\n' characters, which allows rem (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-12-27 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.