CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In December 2017 (CVSS score >= 5)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
201 CVE-2017-17592 89 Sql 2017-12-13 2017-12-21
7.5
None Remote Low Not required Partial Partial Partial
Website Auction Marketplace 2.0.5 has SQL Injection via the search.php cat_id parameter.
202 CVE-2017-17591 89 Sql 2017-12-13 2017-12-21
7.5
None Remote Low Not required Partial Partial Partial
Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.
203 CVE-2017-17590 89 Overflow Sql 2017-12-13 2017-12-20
7.5
None Remote Low Not required Partial Partial Partial
FS Stackoverflow Clone 1.0 has SQL Injection via the /question keywords parameter.
204 CVE-2017-17589 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Thumbtack Clone 1.0 has SQL Injection via the browse-category.php cat parameter or the browse-scategory.php sc parameter.
205 CVE-2017-17588 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS IMDB Clone 1.0 has SQL Injection via the movie.php f parameter, tvshow.php s parameter, or show_misc_video.php id parameter.
206 CVE-2017-17587 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or company/index.php c parameter.
207 CVE-2017-17586 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Olx Clone 1.0 has SQL Injection via the subpage.php scat parameter or the message.php pid parameter.
208 CVE-2017-17585 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Monster Clone 1.0 has SQL Injection via the Employer_Details.php id parameter.
209 CVE-2017-17584 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php fl_orig or fl_dest parameter.
210 CVE-2017-17583 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter.
211 CVE-2017-17582 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Grubhub Clone 1.0 has SQL Injection via the /food keywords parameter.
212 CVE-2017-17581 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Quibids Clone 1.0 has SQL Injection via the itechd.php productid parameter.
213 CVE-2017-17580 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Linkedin Clone 1.0 has SQL Injection via the group.php grid parameter, profile.php fid parameter, or company_details.php id parameter.
214 CVE-2017-17579 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Freelancer Clone 1.0 has SQL Injection via the profile.php u parameter.
215 CVE-2017-17578 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Crowdfunding Script 1.0 has SQL Injection via the latest_news_details.php id parameter.
216 CVE-2017-17577 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Trademe Clone 1.0 has SQL Injection via the search_item.php search parameter or the general_item_details.php id parameter.
217 CVE-2017-17576 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Gigs Script 1.0 has SQL Injection via the browse-category.php cat parameter, browse-scategory.php sc parameter, or service-provider.php ser parameter.
218 CVE-2017-17575 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter.
219 CVE-2017-17574 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Care Clone 1.0 has SQL Injection via the searchJob.php jobType or jobFrequency parameter.
220 CVE-2017-17573 89 Sql 2017-12-13 2017-12-20
7.5
None Remote Low Not required Partial Partial Partial
FS Ebay Clone 1.0 has SQL Injection via the product.php id parameter, or the search.php category_id or sub_category_id parameter.
221 CVE-2017-17572 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Amazon Clone 1.0 has SQL Injection via the PATH_INFO to /VerAyari.
222 CVE-2017-17571 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Foodpanda Clone 1.0 has SQL Injection via the /food keywords parameter.
223 CVE-2017-17570 89 Sql 2017-12-13 2020-09-29
7.5
None Remote Low Not required Partial Partial Partial
FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php fl_orig or fl_dest parameter.
224 CVE-2017-17568 732 +Info 2017-12-13 2019-10-03
5.0
None Remote Low Not required Partial None None
Scubez Posty Readymade Classifieds has Incorrect Access Control for visiting admin/user_activate_submit.php (aka the backend PHP script), which might allow remote attackers to obtain sensitive information via a direct request.
225 CVE-2017-17567 89 Sql 2017-12-13 2017-12-22
5.0
None Remote Low Not required Partial None None
Scubez Posty Readymade Classifieds has SQL Injection via the admin/user_activate_submit.php ID parameter.
226 CVE-2017-17566 DoS +Priv 2017-12-12 2019-10-03
6.9
None Local Medium Not required Complete Complete Complete
An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page.
227 CVE-2017-17564 388 DoS +Priv 2017-12-12 2018-10-19
6.9
None Local Medium Not required Complete Complete Complete
An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode.
228 CVE-2017-17563 119 DoS Overflow +Priv 2017-12-12 2018-10-19
6.9
None Local Medium Not required Complete Complete Complete
An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode.
229 CVE-2017-17562 20 Exec Code 2017-12-12 2018-04-20
6.8
None Remote Medium Not required Partial Partial Partial
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.
230 CVE-2017-17561 Exec Code 2017-12-12 2019-10-03
6.5
None Remote Low ??? Partial Partial Partial
SeaCMS 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/admin_ping.php, which interacts with data/admin/ping.php.
231 CVE-2017-17560 287 Exec Code 2017-12-12 2019-05-28
10.0
None Remote Low Not required Complete Complete Complete
An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php, provides multipart upload functionality that is accessible without authentication and can be used to place a file anywhere on the device's file system. This allows an attacker the ability to upload a PHP shell onto the device and obtain arbitrary code execution as root.
232 CVE-2017-17558 787 DoS 2017-12-12 2019-05-14
7.2
None Local Low Not required Complete Complete Complete
The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device.
233 CVE-2017-17553 2017-12-12 2019-10-03
5.0
None Remote Low Not required Partial None None
The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. This vulnerability could allow attackers to abuse this implementation through a malicious Intent URI, in order to invoke private Activities within the Dolphin Browser.
234 CVE-2017-17551 20 2017-12-11 2018-01-04
6.8
None Remote Medium Not required Partial Partial Partial
The Backup and Restore feature in Mobotap Dolphin Browser for Android 12.0.2 suffers from an arbitrary file write vulnerability when attempting to restore browser settings from a malicious Dolphin Browser backup file. This arbitrary file write vulnerability allows an attacker to overwrite a specific executable in the Dolphin Browser's data directory with a crafted malicious executable. Every time the Dolphin Browser is launched, it will attempt to run the malicious executable from disk, thus executing the attacker's code.
235 CVE-2017-17538 DoS 2017-12-13 2019-10-03
7.8
None Remote Low Not required None None Complete
MikroTik v6.40.5 devices allow remote attackers to cause a denial of service via a flood of ICMP packets.
236 CVE-2017-17537 20 DoS 2017-12-13 2018-01-12
5.0
None Remote Low Not required None None Partial
MikroTik RouterBOARD v6.39.2 and v6.40.5 allows an unauthenticated remote attacker to cause a denial of service by connecting to TCP port 53 and sending data that begins with many '\0' characters, possibly related to DNS.
237 CVE-2017-17536 Exec Code 2017-12-11 2019-10-03
6.8
None Remote Medium Not required Partial Partial Partial
Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary code by using the web UI to browse a branch whose name begins with a --config= or --debugger= substring.
238 CVE-2017-17535 74 2017-12-14 2017-12-29
6.8
None Remote Medium Not required Partial Partial Partial
lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
239 CVE-2017-17534 74 2017-12-14 2017-12-29
6.8
None Remote Medium Not required Partial Partial Partial
uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17521.
240 CVE-2017-17533 74 2017-12-14 2018-01-03
6.8
None Remote Medium Not required Partial Partial Partial
** DISPUTED ** default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has indicated that the attack cannot occur because of the argument-parsing behavior of the Tcl exec function.
241 CVE-2017-17532 74 2017-12-14 2017-12-29
6.8
None Remote Medium Not required Partial Partial Partial
examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
242 CVE-2017-17531 74 2017-12-14 2020-08-08
6.8
None Remote Medium Not required Partial Partial Partial
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
243 CVE-2017-17530 74 2017-12-14 2017-12-29
6.8
None Remote Medium Not required Partial Partial Partial
common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
244 CVE-2017-17529 74 2017-12-14 2017-12-29
6.8
None Remote Medium Not required Partial Partial Partial
af/util/xp/ut_go_file.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
245 CVE-2017-17528 74 2017-12-14 2017-12-29
6.8
None Remote Medium Not required Partial Partial Partial
backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
246 CVE-2017-17527 74 2017-12-14 2018-01-03
6.8
None Remote Medium Not required Partial Partial Partial
** DISPUTED ** delphi_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer has indicated that the code referencing the BROWSER environment variable is never used.
247 CVE-2017-17526 74 2017-12-14 2017-12-28
6.8
None Remote Medium Not required Partial Partial Partial
Input.cc in Bernard Parisse Giac 1.2.3.57 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
248 CVE-2017-17525 74 2017-12-14 2017-12-28
6.8
None Remote Medium Not required Partial Partial Partial
guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
249 CVE-2017-17524 74 2017-12-14 2017-12-28
6.8
None Remote Medium Not required Partial Partial Partial
library/www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
250 CVE-2017-17523 74 2017-12-11 2017-12-29
6.8
None Remote Medium Not required Partial Partial Partial
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument.
Total number of vulnerabilities : 774   Page : 1 2 3 4 5 (This Page)6 7 8 9 10 11 12 13 14 15 16
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.