CVEs published December 28, 2017
26 CVEs were published on December 28, 2017: 0 critical, 0 high.
- Published
- 26
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 26
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Synology Chat
- 2
- Apache Software Foundation Apache Flex Blaze DS · org.ap… +1
- 1
Medium, low and unrated 26
- CVE-2017-17967pptreader.dll in Kingsoft WPS Office 10.1.0.6930 allows remote attackers to cause a denial of service via a crafted PPT file, aka CNVD-2017-
- CVE-2017-17948Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request.
- CVE-2017-17949Cells Blog 3.5 has XSS via the pub_readpost.php fmid parameter.
- CVE-2017-17950Cells Blog 3.5 has SQL Injection via the pub_readpost.php ptid parameter.
- CVE-2017-17951PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the shopping-cart.php cusid parameter.
- CVE-2017-17952PHP Scripts Mall PHP Multivendor Ecommerce has a predicable registration URL, which makes it easier for remote attackers to register with an
- CVE-2017-17953PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the category.php chid1 parameter.
- CVE-2017-17954PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the seller-view.php usid parameter.
- CVE-2017-17955PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the shopping-cart.php cusid parameter.
- CVE-2017-17956PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter.
- CVE-2017-17957PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the my_wishlist.php fid parameter.
- CVE-2017-17958PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the my_wishlist.php fid parameter.
- CVE-2017-17959PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the seller-view.php usid parameter.
- CVE-2017-17960PHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php.
- CVE-2017-15667In Flexense SysGauge Server 3.6.18, the Control Protocol suffers from a denial of service.
- CVE-2017-15886Server-side request forgery (SSRF) vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to dowSynology Chat
- CVE-2017-15892Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated uSynology Chat
- CVE-2017-5641Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by Apache Software Foundation Apache Flex Blaze DS · org.ap… +1
- CVE-2017-17932A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to
- CVE-2017-17936Vanguard Marketplace Digital Products PHP has CSRF via /search.
- CVE-2017-17937Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search.
- CVE-2017-17938PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter.
- CVE-2017-17939PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php.
- CVE-2017-17940PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.
- CVE-2017-17941PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter.
- CVE-2017-17942In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.