Skip to content
OpenAdvisories

Archive

December 2017

Vulnerabilities first published in this month (UTC), newest first.

← November 2017 2017 / December January 2018 →
  1. 141
  2. 26
  3. 38
  4. 422
  5. 560
  6. 657
  7. 730
  8. 830
  9. 986
  10. 103
  11. 1152
  12. 1258
  13. 13104
  14. 1435
  15. 1536
  16. 165
  17. 174
  18. 1831
  19. 1913
  20. 20134
  21. 2151
  22. 2235
  23. 2316
  24. 2428
  25. 2540
  26. 2619
  27. 2723
  28. 2826
  29. 2926
  30. 3024
  31. 314
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.8
    CVE-2014-9515

    Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arb…

  • Critical 9.8
    CVE-2017-5641 EPSS 21%

    Apache Flex BlazeDS unsafe deserialization

    Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the deserialization process code is executed that for several known types has undesired side-effects. O…

    Apache Software Foundation Apache Flex Blaze DS org.apache.flex.blazeds:flex-messaging-remoting org.apache.flex.blazeds:flex-messaging-core Maven
  • Critical 9.8
    CVE-2017-17897

    Dolibarr SQL injection vulnerability in comm/multiprix.php

    SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.8
    CVE-2017-17900

    Dolibarr SQL injection vulnerability in fourn/index.php

    SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the socid parameter.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.8
    CVE-2017-17899

    Dolibarr SQL injection vulnerability in adherents/subscription/info.php

    SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the rowid parameter.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.8
    CVE-2017-15944 Exploited Public exploit Scanner template EPSS 98%

    Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote…

    KEV Aug 18, 2022
  • Critical 9.8
    CVE-2017-15708 Public exploit EPSS 18%

    Remote Code Execution in Apache Synapse

    In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by inject…

    Apache Software Foundation Apache Synapse org.apache.synapse:synapse-core Maven
  • Critical 9.8
    CVE-2017-10906

    Fluentd Escape Sequence Injection Vulnerability

    Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.

    Cloud Native Computing Foundation (CNCF) Fluentd fluentd RubyGems
  • Critical 9.8
    CVE-2017-17458

    Mercurial vulnerable to arbitrary code injection

    In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of s…

    mercurial mercurial mercurial Debian Ubuntu PyPI
  • Critical 9.8
    CVE-2017-15702

    Apache Qpid Broker vulnerable to authentication port spoofing

    In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of which is an HTTP port, then the broker can be tricked by a remote unauthenticated attacker connecting to the HTTP port int…

    Apache Software Foundation Apache Qpid Broker-J org.apache.qpid:qpid-broker Maven