CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In December 2017

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
151 CVE-2017-17811 119 DoS Overflow 2017-12-21 2019-03-26
4.3
 None Remote Medium Not required None None Partial
In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer overflow that will cause a remote denial of service attack, related to a strcpy in paste_tokens in asm/preproc.c, a similar issue to CVE-2017-11111.
152 CVE-2017-17810 20 DoS 2017-12-21 2019-03-26
4.3
 None Remote Medium Not required None None Partial
In Netwide Assembler (NASM) 2.14rc0, there is a "SEGV on unknown address" that will cause a remote denial of service attack, because asm/preproc.c mishandles macro calls that have the wrong number of arguments.
153 CVE-2017-17809 426 2017-12-20 2020-05-11
6.8
 None Remote Medium Not required Partial Partial Partial
In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underlying OpenVPN configuration and the arguments passed to the OpenVPN binary when executed. An attacker can abuse this vulnerability by forcing the VyprVPN application to load a malicious dynamic library every time a new connection is made.
154 CVE-2017-17807 862 2017-12-20 2019-10-03
2.1
 None Local Low Not required None Partial None
The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default request-key keyring" via the request_key() system call, allowing a local user to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.
155 CVE-2017-17806 787 Overflow 2017-12-20 2019-10-03
7.2
 None Local Low Not required Complete Complete Complete
The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.
156 CVE-2017-17805 20 DoS 2017-12-20 2018-10-31
7.2
 None Local Low Not required Complete Complete Complete
The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable.
157 CVE-2017-17804 20 DoS 2017-12-20 2018-01-03
7.2
 None Local Low Not required Complete Complete Complete
In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x83000084.
158 CVE-2017-17803 20 DoS 2017-12-20 2018-01-03
7.2
 None Local Low Not required Complete Complete Complete
In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x82736068, a different vulnerability than CVE-2017-17475.
159 CVE-2017-17802 20 DoS 2017-12-20 2018-01-03
7.2
 None Local Low Not required Complete Complete Complete
In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8273E080.
160 CVE-2017-17801 20 DoS 2017-12-20 2018-01-03
7.2
 None Local Low Not required Complete Complete Complete
In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8273E060.
161 CVE-2017-17800 20 DoS 2017-12-20 2018-01-03
7.2
 None Local Low Not required Complete Complete Complete
In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8273A0A0, a different vulnerability than CVE-2017-17798.
162 CVE-2017-17799 20 DoS 2017-12-20 2018-01-03
7.2
 None Local Low Not required Complete Complete Complete
In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x82730068.
163 CVE-2017-17798 20 DoS 2017-12-20 2018-01-08
7.2
 None Local Low Not required Complete Complete Complete
In TG Soft Vir.IT eXplorer Lite 8.5.42, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8273A0A0, a different vulnerability than CVE-2017-17800.
164 CVE-2017-17797 20 DoS 2017-12-20 2018-01-03
7.2
 None Local Low Not required Complete Complete Complete
In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x83000058.
165 CVE-2017-17796 20 DoS 2017-12-20 2018-01-03
7.2
 None Local Low Not required Complete Complete Complete
In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x827300A4.
166 CVE-2017-17795 20 DoS 2017-12-20 2018-01-03
7.2
 None Local Low Not required Complete Complete Complete
In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x83000088.
167 CVE-2017-17794 Bypass 2017-12-20 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
validate_form_preferences in admin/preferences.php in BlogoText through 3.7.6 allows attackers to bypass intended access restrictions via vectors related to an e-mail address field.
168 CVE-2017-17793 200 +Info 2017-12-20 2018-01-12
5.0
 None Remote Low Not required Partial None None
Information Disclosure vulnerability in creer_fichier_zip in admin/maintenance.php in BlogoText through 3.7.6 allows remote attackers to defeat a filename-randomization protection mechanism, and read backup archives on Windows servers, by providing the archiv~1.zip name (aka an 8.3 filename).
169 CVE-2017-17792 79 XSS 2017-12-20 2018-01-04
4.3
 None Remote Medium Not required None Partial None
Cross site scripting (XSS) vulnerability in the markup_clean_href function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment.
170 CVE-2017-17790 74 2017-12-20 2018-08-03
7.5
 None Remote Low Not required Partial Partial Partial
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
171 CVE-2017-17789 787 Overflow 2017-12-20 2022-02-07
6.8
 None Remote Medium Not required Partial Partial Partial
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c.
172 CVE-2017-17788 125 2017-12-20 2022-02-07
4.3
 None Remote Medium Not required None None Partial
In GIMP 2.8.22, there is a stack-based buffer over-read in xcf_load_stream in app/xcf/xcf.c when there is no '\0' character after the version string.
173 CVE-2017-17787 125 2017-12-20 2022-02-07
6.8
 None Remote Medium Not required Partial Partial Partial
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c.
174 CVE-2017-17786 125 2017-12-20 2022-02-07
6.8
 None Remote Medium Not required Partial Partial Partial
In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related to bgr2rgb.part.1) via an unexpected bits-per-pixel value for an RGBA image.
175 CVE-2017-17785 787 Overflow 2017-12-20 2022-02-07
6.8
 None Remote Medium Not required Partial Partial Partial
In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c.
176 CVE-2017-17784 125 2017-12-20 2022-02-07
6.8
 None Remote Medium Not required Partial Partial Partial
In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c in the gbr import parser, related to mishandling of UTF-8 data.
177 CVE-2017-17783 125 2017-12-20 2020-01-27
5.1
 None Remote High Not required Partial Partial Partial
In GraphicsMagick 1.3.27a, there is a buffer over-read in ReadPALMImage in coders/palm.c when QuantumDepth is 8.
178 CVE-2017-17782 125 2017-12-20 2020-01-27
6.8
 None Remote Medium Not required Partial Partial Partial
In GraphicsMagick 1.3.27a, there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c, related to oFFs chunk allocation.
179 CVE-2017-17781 89 Sql 2017-12-20 2018-01-12
7.5
 None Remote Low Not required Partial Partial Partial
In Horde Groupware through 5.2.22, SQL Injection exists via the group parameter to /services/prefs.php or the homePostalCode parameter to /turba/search.php.
180 CVE-2017-17780 79 XSS 2017-12-20 2021-03-11
4.3
 None Remote Medium Not required None Partial None
The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Booking Calendar - Clockwork SMS 1.0.5, Contact Form 7 - Clockwork SMS 2.3.0, Fast Secure Contact Form - Clockwork SMS 2.1.2, Formidable - Clockwork SMS 1.0.2, Gravity Forms - Clockwork SMS 2.2, and WP e-Commerce - Clockwork SMS 2.0.5.
181 CVE-2017-17779 89 Sql 2017-12-20 2018-01-03
7.5
 None Remote Low Not required Partial Partial Partial
Paid To Read Script 2.0.5 has SQL injection via the referrals.php id parameter.
182 CVE-2017-17778 79 XSS 2017-12-20 2018-01-03
3.5
 None Remote Medium ??? None Partial None
Paid To Read Script 2.0.5 has XSS via the referrals.php tier parameter or the admin/userview.php uid parameter.
183 CVE-2017-17777 287 Bypass 2017-12-20 2018-01-12
7.5
 None Remote Low Not required Partial Partial Partial
Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated by the admin/viewvisitcamp.php fn parameter and the admin/userview.php uid parameter.
184 CVE-2017-17776 200 +Info 2017-12-20 2018-01-03
5.0
 None Remote Low Not required Partial None None
Paid To Read Script 2.0.5 has full path disclosure via an invalid admin/userview.php uid parameter.
185 CVE-2017-17775 79 XSS 2017-12-20 2018-01-05
4.3
 None Remote Medium Not required None Partial None
Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request.
186 CVE-2017-17774 352 CSRF 2017-12-20 2018-01-04
6.8
 None Remote Medium Not required Partial Partial Partial
admin/configuration.php in Piwigo 2.9.2 has CSRF.
187 CVE-2017-17763 311 2017-12-19 2020-02-04
7.6
 None Remote High Not required Complete Complete Complete
SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makes it easier for remote attackers to send crafted files, as demonstrated by APK injection.
188 CVE-2017-17761 2017-12-19 2019-10-03
10.0
 None Remote Low Not required Complete Complete Complete
An issue was discovered on Ichano AtHome IP Camera devices. The device runs the "noodles" binary - a service on port 1300 that allows a remote (LAN) unauthenticated user to run arbitrary commands. This binary requires the "system" XML element for specifying the command. For example, a <system>id</system> command results in a <system_ack>ok</system_ack> response.
189 CVE-2017-17760 119 Overflow 2017-12-29 2021-12-16
4.3
 None Remote Medium Not required None None Partial
OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used.
190 CVE-2017-17759 DoS +Info 2017-12-19 2019-10-03
10.0
 None Remote Low Not required Complete Complete Complete
Conarc iChannel allows remote attackers to obtain sensitive information, modify the configuration, or cause a denial of service (by deleting the configuration) via a wc.dll?wwMaint~EditConfig request (which reaches an older version of a West Wind Web Connection HTTP service).
191 CVE-2017-17758 78 Exec Code 2017-12-19 2019-10-03
9.0
 None Remote Low ??? Complete Complete Complete
TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/dhcps command to cgi-bin/luci, related to the zone_get_iface_bydev function in /usr/lib/lua/luci/controller/admin/dhcps.lua in uhttpd.
192 CVE-2017-17757 78 Exec Code 2017-12-19 2019-10-03
9.0
 None Remote Low ??? Complete Complete Complete
TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd.
193 CVE-2017-17753 79 XSS 2017-12-19 2018-01-05
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) cie_type, (2) cie_import, (3) cie_update, or (4) cie_ignore parameter to includes/admin/views/esb-cie-import-export-page.php.
194 CVE-2017-17752 79 Exec Code XSS 2017-12-20 2018-01-08
4.3
 None Remote Medium Not required None Partial None
Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail screen (aka the /_readmail URI). This is fixed in version 4.2.4.
195 CVE-2017-17747 306 DoS 2017-12-20 2019-10-03
2.7
 None Local Network Low ??? None None Partial
Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a denial of service condition.
196 CVE-2017-17746 306 2017-12-20 2019-10-03
7.7
 None Local Network Low ??? Complete Complete Complete
Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access the device without entering user credentials. The authentication record is stored on the device; thus if an administrator authenticates from a NAT network, the authentication applies to the IP address of the NAT gateway, and any user behind that NAT gateway is also treated as authenticated.
197 CVE-2017-17745 79 XSS 2017-12-20 2018-01-05
3.5
 None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in system_name_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java script via the 'sysName' parameter.
198 CVE-2017-17744 79 XSS 2017-12-19 2018-01-08
4.3
 None Remote Medium Not required None Partial None
A cross-site scripting (XSS) vulnerability in the custom-map plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map_id parameter to view/advancedsettings.php.
199 CVE-2017-17741 125 +Info 2017-12-18 2018-04-25
2.1
 None Local Low Not required Partial None None
The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h.
200 CVE-2017-17740 119 DoS Overflow 2017-12-18 2022-04-20
5.0
 None Remote Low Not required None None Partial
contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.
Total number of vulnerabilities : 1110   Page : 1 2 3 4 (This Page)5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.