# CVEs published 2017-01-10

16 CVEs were published on January 10, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-0002](https://cve.now/CVE-2017-0002.md): Microsoft Edge allows remote attackers to bypass the Same Origin Policy via vectors involving the about:blank URL and data: URLs, aka… (no CVSS)
- [CVE-2017-0003](https://cve.now/CVE-2017-0003.md): Microsoft Word 2016 and SharePoint Enterprise Server 2016 allow remote attackers to execute arbitrary code via a crafted document, aka… (no CVSS)
- [CVE-2017-0004](https://cve.now/CVE-2017-0004.md): The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7… (no CVSS)
- [CVE-2016-9247](https://cve.now/CVE-2016-9247.md): Under certain conditions for BIG-IP systems using a virtual server with an associated FastL4 profile and TCP analytics profile, a specific… (no CVSS, F5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, D…)
- [CVE-2015-4591](https://cve.now/CVE-2015-4591.md): eClinicalWorks Population Health (CCMR) suffers from a cross site scripting vulnerability in login.jsp which allows remote unauthenticated… (no CVSS)
- [CVE-2015-4592](https://cve.now/CVE-2015-4592.md): eClinicalWorks Population Health (CCMR) suffers from an SQL injection vulnerability in portalUserService.jsp which allows remote… (no CVSS)
- [CVE-2015-4593](https://cve.now/CVE-2015-4593.md): eClinicalWorks Population Health (CCMR) suffers from a cross-site request forgery (CSRF) vulnerability in portalUserService.jsp which… (no CVSS)
- [CVE-2015-4594](https://cve.now/CVE-2015-4594.md): eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. (no CVSS)
- [CVE-2016-6286](https://cve.now/CVE-2016-6286.md): The "spiffy-cgi-handlers" egg would convert a nonexistent "Proxy" header to the HTTP\_PROXY environment variable, which would allow… (no CVSS)
- [CVE-2016-6287](https://cve.now/CVE-2016-6287.md): The "http-client" egg always used a HTTP\_PROXY environment variable to determine whether HTTP traffic should be routed via a proxy, even… (no CVSS)
- [CVE-2016-6580](https://cve.now/CVE-2016-6580.md): A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious… (no CVSS, priority)
- [CVE-2016-6581](https://cve.now/CVE-2016-6581.md): A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of… (no CVSS, hpack)
- [CVE-2016-6830](https://cve.now/CVE-2016-6830.md): The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size buffers for holding the arguments and environment… (no CVSS)
- [CVE-2016-6831](https://cve.now/CVE-2016-6831.md): The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory… (no CVSS)
- [CVE-2016-6837](https://cve.now/CVE-2016-6837.md): Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versions 2.0.0-beta1, 1.3.0-beta1… (no CVSS)
- [CVE-2016-10126](https://cve.now/CVE-2016-10126.md): Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3.x before 6.3.8… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-01-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.