Skip to content
OpenAdvisories

Archive

28 December 2017

Vulnerabilities first published on this day (UTC), newest first.

← November 2017 2017 / December /28 January 2018 →
  1. 141
  2. 26
  3. 38
  4. 422
  5. 560
  6. 657
  7. 730
  8. 830
  9. 986
  10. 103
  11. 1152
  12. 1258
  13. 13104
  14. 1435
  15. 1536
  16. 165
  17. 174
  18. 1831
  19. 1913
  20. 20134
  21. 2151
  22. 2235
  23. 2316
  24. 2428
  25. 2540
  26. 2619
  27. 2723
  28. 2826
  29. 2926
  30. 3024
  31. 314
All Critical High Medium Low Exploited only Public exploit

26 results · Feed

  • Unscored —
    CVE-2017-17967

    pptreader.dll in Kingsoft WPS Office 10.1.0.6930 allows remote attackers to cause a denial of service via a crafted PPT…

  • Unscored —
    CVE-2017-17957

    PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the my_wishlist.php fid parameter.

  • Unscored —
    CVE-2017-17955

    PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the shopping-cart.php cusid parameter.

  • Unscored —
    CVE-2017-17959

    PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the seller-view.php usid parameter.

  • Unscored —
    CVE-2017-17953

    PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the category.php chid1 parameter.

  • Unscored —
    CVE-2017-17952

    PHP Scripts Mall PHP Multivendor Ecommerce has a predicable registration URL, which makes it easier for remote attacker…

  • Unscored —
    CVE-2017-17951

    PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the shopping-cart.php cusid parameter.

  • Unscored —
    CVE-2017-17948

    Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request.

  • Unscored —
    CVE-2017-17960

    PHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php.

  • Unscored —
    CVE-2017-17949

    Cells Blog 3.5 has XSS via the pub_readpost.php fmid parameter.

  • Unscored —
    CVE-2017-17958

    PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the my_wishlist.php fid parameter.

  • Unscored —
    CVE-2017-17954

    PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the seller-view.php usid parameter.

  • Unscored —
    CVE-2017-17950

    Cells Blog 3.5 has SQL Injection via the pub_readpost.php ptid parameter.

  • Unscored —
    CVE-2017-17956

    PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter.

  • Unscored —
    CVE-2017-15667 Public exploit

    In Flexense SysGauge Server 3.6.18, the Control Protocol suffers from a denial of service. The attack vector is a craft…

  • Unscored —
    CVE-2017-15892

    Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow r…

    Synology Chat
  • Unscored —
    CVE-2017-15886

    Server-side request forgery (SSRF) vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authe…

    Synology Chat
  • Critical 9.8
    CVE-2017-5641 EPSS 21%

    Apache Flex BlazeDS unsafe deserialization

    Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the deserialization process code is executed that for several known types has undesired side-effects. O…

    Apache Software Foundation Apache Flex Blaze DS org.apache.flex.blazeds:flex-messaging-remoting org.apache.flex.blazeds:flex-messaging-core Maven
  • Unscored —
    CVE-2017-17937

    Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search.

  • Unscored —
    CVE-2017-17932 Public exploit EPSS 54%

    A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow…

  • Unscored —
    CVE-2017-17939

    PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php.

  • Unscored —
    CVE-2017-17942

    In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2017-17938

    PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter.

  • Unscored —
    CVE-2017-17936

    Vanguard Marketplace Digital Products PHP has CSRF via /search.

  • Unscored —
    CVE-2017-17941

    PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter.

  • Unscored —
    CVE-2017-17940

    PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.