# CVEs published 2017-12-29

26 CVEs were published on December 29, 2017: 1 critical, 2 high. Days are UTC.

- [CVE-2013-4578](https://cve.now/CVE-2013-4578.md): jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigne (no CVSS)
- [CVE-2014-0120](https://cve.now/CVE-2014-0120.md): Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arb (no CVSS)
- [CVE-2014-0121](https://cve.now/CVE-2014-0121.md): The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k paramet (no CVSS)
- [CVE-2014-3630](https://cve.now/CVE-2014-3630.md): XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow rem (no CVSS)
- [CVE-2014-4978](https://cve.now/CVE-2014-4978.md): The rs\_filter\_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary files via a symlink atta (no CVSS)
- [CVE-2014-8119](https://cve.now/CVE-2014-8119.md): The find\_ifcfg\_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involv (no CVSS)
- [CVE-2014-9515](https://cve.now/CVE-2014-9515.md): Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a cra (CVSS 9.8)
- [CVE-2015-3302](https://cve.now/CVE-2015-3302.md): The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote (no CVSS)
- [CVE-2015-8008](https://cve.now/CVE-2015-8008.md): The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypas (no CVSS)
- [CVE-2017-17901](https://cve.now/CVE-2017-17901.md): ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (CPU consumption) via a flood of IP packets with a TTL of 1. (no CVSS)
- [CVE-2017-17973](https://cve.now/CVE-2017-17973.md): In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p\_writeproc function in tiff2pdf.c. (CVSS 8.8)
- [CVE-2017-17974](https://cve.now/CVE-2017-17974.md): BA SYSTEMS BAS Web on BAS920 devices (with Firmware 01.01.00\*, HTTPserv 00002, and Script 02.\*) and ISC2000 devices allows remote attackers (no CVSS)
- [CVE-2017-17910](https://cve.now/CVE-2017-17910.md): On Hoermann BiSecur devices before 2018, a vulnerability can be exploited by recording a single radio transmission. (no CVSS)
- [CVE-2017-17760](https://cve.now/CVE-2017-17760.md): OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt\_pxm.cpp, because an incorrect size value is used. (no CVSS, opencv-python · opencv-contrib-python)
- [CVE-2017-17933](https://cve.now/CVE-2017-17933.md): cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS via the classid, domain (no CVSS)
- [CVE-2017-17971](https://cve.now/CVE-2017-17971.md): The test\_sql\_and\_script\_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick no (no CVSS, dolibarr/dolibarr)
- [CVE-2017-17916](https://cve.now/CVE-2017-17916.md): SQL injection vulnerability in the 'find\_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2017-17917](https://cve.now/CVE-2017-17917.md): SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2017-17919](https://cve.now/CVE-2017-17919.md): SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL comman (CVSS 8.1)
- [CVE-2017-17920](https://cve.now/CVE-2017-17920.md): SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2013-7400](https://cve.now/CVE-2013-7400.md): The Direct Mail (direct\_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging imprope (no CVSS, directmailteam/direct-mail)
- [CVE-2014-3651](https://cve.now/CVE-2014-3651.md): JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size (no CVSS, org.keycloak:keycloak-core)
- [CVE-2016-3695](https://cve.now/CVE-2016-3695.md): The einj\_error\_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequent (no CVSS)
- [CVE-2017-16876](https://cve.now/CVE-2017-16876.md): Cross-site scripting (XSS) vulnerability in the \_keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arb (no CVSS, mistune)
- [CVE-2017-17968](https://cve.now/CVE-2017-17968.md): A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to ex (no CVSS)
- [CVE-2014-4914](https://cve.now/CVE-2014-4914.md): The Zend\_Db\_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to co (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-12-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.