# CVEs published 2017-12-28

26 CVEs were published on December 28, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-17967](https://cve.now/CVE-2017-17967.md): pptreader.dll in Kingsoft WPS Office 10.1.0.6930 allows remote attackers to cause a denial of service via a crafted PPT file, aka CNVD-2017- (no CVSS)
- [CVE-2017-17948](https://cve.now/CVE-2017-17948.md): Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request. (no CVSS)
- [CVE-2017-17949](https://cve.now/CVE-2017-17949.md): Cells Blog 3.5 has XSS via the pub\_readpost.php fmid parameter. (no CVSS)
- [CVE-2017-17950](https://cve.now/CVE-2017-17950.md): Cells Blog 3.5 has SQL Injection via the pub\_readpost.php ptid parameter. (no CVSS)
- [CVE-2017-17951](https://cve.now/CVE-2017-17951.md): PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the shopping-cart.php cusid parameter. (no CVSS)
- [CVE-2017-17952](https://cve.now/CVE-2017-17952.md): PHP Scripts Mall PHP Multivendor Ecommerce has a predicable registration URL, which makes it easier for remote attackers to register with an (no CVSS)
- [CVE-2017-17953](https://cve.now/CVE-2017-17953.md): PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the category.php chid1 parameter. (no CVSS)
- [CVE-2017-17954](https://cve.now/CVE-2017-17954.md): PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the seller-view.php usid parameter. (no CVSS)
- [CVE-2017-17955](https://cve.now/CVE-2017-17955.md): PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the shopping-cart.php cusid parameter. (no CVSS)
- [CVE-2017-17956](https://cve.now/CVE-2017-17956.md): PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter. (no CVSS)
- [CVE-2017-17957](https://cve.now/CVE-2017-17957.md): PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the my\_wishlist.php fid parameter. (no CVSS)
- [CVE-2017-17958](https://cve.now/CVE-2017-17958.md): PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the my\_wishlist.php fid parameter. (no CVSS)
- [CVE-2017-17959](https://cve.now/CVE-2017-17959.md): PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the seller-view.php usid parameter. (no CVSS)
- [CVE-2017-17960](https://cve.now/CVE-2017-17960.md): PHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php. (no CVSS)
- [CVE-2017-15667](https://cve.now/CVE-2017-15667.md): In Flexense SysGauge Server 3.6.18, the Control Protocol suffers from a denial of service. (no CVSS)
- [CVE-2017-15886](https://cve.now/CVE-2017-15886.md): Server-side request forgery (SSRF) vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to dow (no CVSS, Synology Chat)
- [CVE-2017-15892](https://cve.now/CVE-2017-15892.md): Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated u (no CVSS, Synology Chat)
- [CVE-2017-5641](https://cve.now/CVE-2017-5641.md): Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by (no CVSS, Apache Software Foundation Apache Flex Blaze DS · org.ap… +1)
- [CVE-2017-17932](https://cve.now/CVE-2017-17932.md): A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to (no CVSS)
- [CVE-2017-17936](https://cve.now/CVE-2017-17936.md): Vanguard Marketplace Digital Products PHP has CSRF via /search. (no CVSS)
- [CVE-2017-17937](https://cve.now/CVE-2017-17937.md): Vanguard Marketplace Digital Products PHP has XSS via the phps\_query parameter to /search. (no CVSS)
- [CVE-2017-17938](https://cve.now/CVE-2017-17938.md): PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter. (no CVSS)
- [CVE-2017-17939](https://cve.now/CVE-2017-17939.md): PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php. (no CVSS)
- [CVE-2017-17940](https://cve.now/CVE-2017-17940.md): PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php. (no CVSS)
- [CVE-2017-17941](https://cve.now/CVE-2017-17941.md): PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter. (no CVSS)
- [CVE-2017-17942](https://cve.now/CVE-2017-17942.md): In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif\_packbits.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-12-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.