Skip to content

Browse Docs Sources Guide

Search/Get API key

Every CVE
Archive
2017
December

CVEs published in December 2017

1,146 vulnerabilities, 220 critical, 2 exploited.

Known exploitedIn KEVPublic exploitFix available

phpMyAdmin SUSESecurity update for phpMyAdminopenSUSE-SU-2017:3448-1Fix availableNo scoreDecember 29, 2017
rubyonrails ruby on rails** DISPUTED ** SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and...CVE-2017-17920Disputed8.1 HighDecember 29, 2017
rubyonrails ruby on rails** DISPUTED ** SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and...CVE-2017-17919Disputed8.1 HighDecember 29, 2017
rubyonrails rails** DISPUTED ** SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and...CVE-2017-17917Public exploitDisputed8.1 HighDecember 29, 2017
rubyonrails rails** DISPUTED ** SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and...CVE-2017-17916Disputed8.1 HighDecember 29, 2017
xi-soft nettransport download managerA buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and...CVE-2017-17968Public exploitEPSS 39.4%9.8 CriticalDecember 29, 2017
mistune project mistune, fedoraproject fedora +1 moremistune Cross-site scripting (XSS) vulnerabilityCVE-2017-16876Fix available6.1 MediumDecember 29, 2017
linux kernel, redhat enterprise linux +1 moreThe einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users...CVE-2016-3695Fix available5.5 MediumDecember 29, 2017
keycloakKeycloak vulnerable to uncontrolled resource consumptionCVE-2014-3651Fix available7.5 HighDecember 29, 2017
dkd direct mailThe Direct Mail (direct_mail) TYPO3 extension improperly discloses sensitive informationCVE-2013-7400Fix available7.5 HighDecember 29, 2017
linux kernelUse-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c in the Linux...CVE-2017-17975Fix available5.5 MediumDecember 29, 2017
ksosoft wps officepptreader.dll in Kingsoft WPS Office 10.1.0.6930 allows remote attackers to cause a denial of...CVE-2017-179675.5 MediumDecember 28, 2017
php multivendor ecommerce project multivendor ecommercePHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php.CVE-2017-179608.8 HighDecember 28, 2017
php multivendor ecommerce project multivendor ecommercePHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the seller-view.php usid parameter.CVE-2017-179599.8 CriticalDecember 28, 2017
php multivendor ecommerce project multivendor ecommercePHP Scripts Mall PHP Multivendor Ecommerce has XSS via the my_wishlist.php fid parameter.CVE-2017-179586.1 MediumDecember 28, 2017
php multivendor ecommerce project multivendor ecommercePHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the my_wishlist.php fid parameter.CVE-2017-179579.8 CriticalDecember 28, 2017
php multivendor ecommerce project multivendor ecommercePHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname...CVE-2017-179566.1 MediumDecember 28, 2017
php multivendor ecommerce project multivendor ecommercePHP Scripts Mall PHP Multivendor Ecommerce has XSS via the shopping-cart.php cusid parameter.CVE-2017-179556.1 MediumDecember 28, 2017
php multivendor ecommerce project multivendor ecommercePHP Scripts Mall PHP Multivendor Ecommerce has XSS via the seller-view.php usid parameter.CVE-2017-179546.1 MediumDecember 28, 2017
php multivendor ecommerce project multivendor ecommercePHP Scripts Mall PHP Multivendor Ecommerce has XSS via the category.php chid1 parameter.CVE-2017-179536.1 MediumDecember 28, 2017
php multivendor ecommerce project multivendor ecommercePHP Scripts Mall PHP Multivendor Ecommerce has a predicable registration URL, which makes it...CVE-2017-179528.6 HighDecember 28, 2017
php multivendor ecommerce project multivendor ecommercePHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the shopping-cart.php cusid...CVE-2017-179519.8 CriticalDecember 28, 2017
cells blogCells Blog 3.5 has SQL Injection via the pub_readpost.php ptid parameter.CVE-2017-179508.8 HighDecember 28, 2017
cells blogCells Blog 3.5 has XSS via the pub_readpost.php fmid parameter.CVE-2017-179496.1 MediumDecember 28, 2017
cells blogCells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request.CVE-2017-179486.1 MediumDecember 28, 2017
flexense sysgaugeIn Flexense SysGauge Server 3.6.18, the Control Protocol suffers from a denial of service. The...CVE-2017-15667Public exploit7.5 HighDecember 28, 2017
apache flex blazeds, apache software foundation flex blaze ds, hp xp command view advanced edition +2 moreApache Flex BlazeDS unsafe deserializationCVE-2017-5641Fix availableEPSS 20.7%9.8 CriticalDecember 28, 2017
destiny.gg chatMultiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat...CVE-2017-158925.4 MediumDecember 28, 2017
destiny.gg chatServer-side request forgery (SSRF) vulnerability in Link Preview in Synology Chat before 2.0.0...CVE-2017-158866.5 MediumDecember 28, 2017
phpmyadmin MageiaUpdated phpmyadmin packages fix security vulnerabilityMGASA-2017-0471Fix availableNo scoreDecember 28, 2017
libtiffIn LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in...CVE-2017-17942Fix available8.8 HighDecember 28, 2017
single theater booking script project theater booking scriptPHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid...CVE-2017-179417.2 HighDecember 28, 2017
single theater booking script project theater booking scriptPHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.CVE-2017-179404.8 MediumDecember 28, 2017
single theater booking script project theater booking scriptPHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php.CVE-2017-179398.8 HighDecember 28, 2017
single theater booking script project theater booking scriptPHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter.CVE-2017-179384.8 MediumDecember 28, 2017
vanguard project marketplace digital products phpVanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search.CVE-2017-179376.1 MediumDecember 28, 2017
vanguard project marketplace digital products phpVanguard Marketplace Digital Products PHP has CSRF via /search.CVE-2017-179368.8 HighDecember 28, 2017
allmediaserverA buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and...CVE-2017-17932Public exploitEPSS 54.2%9.8 CriticalDecember 28, 2017
mozilla network security servicesHeap-based buffer overflow in the __get_page function in lib/dbm/src/h_page.c in Mozilla Network...CVE-2017-116987.8 HighDecember 27, 2017
mozilla network security servicesThe __hash_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context...CVE-2017-116977.8 HighDecember 27, 2017
mozilla network security servicesHeap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network...CVE-2017-116967.8 HighDecember 27, 2017
mozilla network security servicesHeap-based buffer overflow in the alloc_segs function in lib/dbm/src/hash.c in Mozilla Network...CVE-2017-116957.8 HighDecember 27, 2017
easy2mapMultiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes...CVE-2015-76699.8 CriticalDecember 27, 2017
easy2mapCross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin...CVE-2015-76686.1 MediumDecember 27, 2017
web-mv resadsMultiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement...CVE-2015-76676.1 MediumDecember 27, 2017
codepeople payment form for paypal proMultiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2)...CVE-2015-76666.1 MediumDecember 27, 2017
stackideas komentoMultiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas...CVE-2015-73246.1 MediumDecember 27, 2017
tripwire ip360The RPC service in Tripwire (formerly nCircle) IP360 VnE Manager 7.2.2 before 7.2.6 allows remote...CVE-2015-62379.8 CriticalDecember 27, 2017
mqtt.js. mqtt.jsDenial of Service in mqttCVE-2017-10910Fix available6.5 MediumDecember 27, 2017
google androidThe SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR...CVE-2015-7889Public exploit5.5 MediumDecember 27, 2017
Show moreLoading…

Docs Sources Guide Browse Privacy Terms

esc

PagesAll vulnerabilities Browse Docs Sources Guide Get API key

MoveEnter Open