CVEs published in December 2017
1,146 vulnerabilities, 220 critical, 2 exploited.
- tor project tor, debian linux +1 moreIn Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before...7.5 High
- wordpress, debian linux +1 morewp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and...5.4 Medium
- wordpress, debian linux +1 morewp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang...5.4 Medium
- wordpress, debian linux +1 morewp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html...5.4 Medium
- wordpresswp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be...8.8 High
- libtifftools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service ...8.8 High
- digium asterisk, certified asterisk +1 moreAn issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and...7.5 High
php-phpmailerMageiaUpdated php-phpmailer packages fix security vulnerabilityNo scorefirefoxUbuntufirefox regressionsNo score- zte zxdsl 831cii firmwareconnoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, which allows...7.5 High
- arqbackup arqThe (1) arq_updater, (2) arqcommitter, (3) standardrestorer, (4) arqglacierrestorer, and (5)...7.8 High
- piwigoThe application Piwigo is affected by an SQL injection vulnerability in version 2.9.2 and...6.5 Medium
- arqbackup arqThe setpermissions function in the auto-updater in Arq before 5.9.7 for Mac allows local users to...7.4 High
- hikvision ds-2cd2432f-iw firmware** DISPUTED ** HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically...6.5 Medium
- ohmibod remoteThe OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by...9.1 Critical
- vibease chat, wireless remote vibrator +1 moreThe Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use...7.5 High
- ismartalarm cubeone firmwarePassword file exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows...9.8 Critical
- ismartalarm cubeone firmwareEncryption key exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows...7.5 High
- apache struts, netapp oncommand balance, oracle agile plm framework +9 more +11 moreModerate severity vulnerability that affects org.apache.struts:struts2-rest-plugin6.2 Medium
- apache qpid broker-jApache Qpid Broker vulnerable to authentication port spoofing9.8 Critical
- apache qpid broker-jApache Qpid Broker-J vulnerable to Denial of Service (DoS) via uncontrolled resource consumption7.5 High
- princeton ptw-wms1 firmware, princeton ltd. ptw-wms1 +1 moreImproper authentication issue in PTW-WMS1 firmware version 2.000.012 allows remote attackers to...9.8 Critical
- princeton ptw-wms1 firmware, princeton ltd. ptw-wms1 +1 morePTW-WMS1 firmware version 2.000.012 allows remote attackers to execute arbitrary OS commands via...9.8 Critical
- princeton ptw-wms1 firmware, princeton ltd. ptw-wms1 +1 moreBuffer overflow in PTW-WMS1 firmware version 2.000.012 allows remote attackers to conduct denial...7.5 High
- princeton ptw-wms1 firmware, princeton ltd. ptw-wms1 +1 morePTW-WMS1 firmware version 2.000.012 allows remote attackers to bypass access restrictions to...9.8 Critical
- ark-web a-reserve, princeton ltd. a-reserve for mt cloud +1 moreSQL injection vulnerability in the A-Reserve and A-Reserve for MT cloud versions 3.8.6 and...9.8 Critical
- ark-web a-member, princeton ltd. a-member for mt cloud +1 moreSQL injection vulnerability in the A-Member and A-Member for MT cloud versions 3.8.6 and earlier...9.8 Critical
- sdnsproxy project sdnsproxy, tomoki sanaki sdnsproxy.exe +1 moresDNSProxy.exe ver1.1.0.0 and earlier allows remote attackers to cause a denial of service via...7.5 High
- streamrelay, tomoki sanaki streamrelay.net.exe +1 moreStreamRelay.NET.exe ver2.14.0.7 and earlier allows remote attackers to cause a denial of service...7.5 High
- sony music center, sony video & sound products inc. music center for pc +1 moreUntrusted search path vulnerability in Music Center for PC version 1.0.00 allows an attacker to...7.8 High
- sony media goUntrusted search path vulnerability in Media Go version 3.2.0.191 and earlier allows an attacker...7.8 High
- nippon telegraph and telephone east corporation pwr-q200, ntt-east pwr-q200 firmware +1 morePWR-Q200 does not use random values for source ports of DNS query packets, which allows remote...7.5 High
- qualitysoft corporation qnd advance/standard, qualitysoft qnd advance\/standard +1 moreDirectory traversal vulnerability in QND Advance/Standard allows an attacker to read arbitrary...9.1 Critical
- adobe robohelpAdobe RoboHelp has an Open Redirect vulnerability. This affects versions before RH12.0.4.460 and...6.1 Medium
- adobe robohelpAdobe RoboHelp has a cross-site scripting (XSS) vulnerability. This affects versions before RH12...6.1 Medium
- vim, canonical ubuntu linux, debian linux +2 morefileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary...5.5 Medium
- inedo otterIndeo Otter through 1.7.4 mishandles a "</script>" substring in an initial DP payload, which...9.8 Critical
- wireshark, debian linux +1 moreIn Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. This was...7.5 High
- wireshark, debian linux +1 moreIn Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the IWARP_MPA dissector could crash. This was...7.5 High
- wireshark, debian linux +1 moreIn Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the NetBIOS dissector could crash. This was...7.5 High
- inedo otterInedo Otter before 1.7.4 has directory traversal in filesystem-based rafts via vectors involving ...9.8 Critical
- adobe coldfusionAdobe ColdFusion has an XML external entity (XXE) injection vulnerability. This affects Update 4...7.5 High
- adobe coldfusionAdobe ColdFusion has a cross-site scripting (XSS) vulnerability. This affects Update 4 and...6.1 Medium
- adobe coldfusionAdobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and...9.8 Critical
- adobe coldfusionAdobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and...9.8 Critical
- cisco umbrella virtual applianceThe Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted...6.4 Medium