CVEs published December 29, 2017
26 CVEs were published on December 29, 2017: 1 critical, 2 high.
- Published
- 26
- Critical
- 1
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 23
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- directmailteam/direct-mail
- 1
- dolibarr/dolibarr
- 1
- mistune
- 1
- opencv-python · opencv-contrib-python
- 1
- org.keycloak:keycloak-core
- 1
Critical 1
High 2
Medium, low and unrated 23
- CVE-2013-4578jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigne
- CVE-2014-0120Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arb
- CVE-2014-0121The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k paramet
- CVE-2014-3630XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow rem
- CVE-2014-4978The rs_filter_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary files via a symlink atta
- CVE-2014-8119The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involv
- CVE-2015-3302The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote
- CVE-2015-8008The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypas
- CVE-2017-17901ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (CPU consumption) via a flood of IP packets with a TTL of 1.
- CVE-2017-17974BA SYSTEMS BAS Web on BAS920 devices (with Firmware 01.01.00*, HTTPserv 00002, and Script 02.*) and ISC2000 devices allows remote attackers
- CVE-2017-17910On Hoermann BiSecur devices before 2018, a vulnerability can be exploited by recording a single radio transmission.
- CVE-2017-17760OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used.opencv-python · opencv-contrib-python
- CVE-2017-17933cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS via the classid, domain
- CVE-2017-17971The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nodolibarr/dolibarr
- CVE-2017-17916SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL comm
- CVE-2017-17917SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL comman
- CVE-2017-17920SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL comm
- CVE-2013-7400The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging impropedirectmailteam/direct-mail
- CVE-2014-3651JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size org.keycloak:keycloak-core
- CVE-2016-3695The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequent
- CVE-2017-16876Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbmistune
- CVE-2017-17968A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to ex
- CVE-2014-4914The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to co