CVEs published January 19, 2018
32 CVEs were published on January 19, 2018: 0 critical, 3 high. Browse them by severity, product and exploitation status.
- Published
- 32
- Critical
- 0
- High
- 3
- Medium
- 9
- Low
- 0
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Talos CPP-Ethereum
- 9
- Trend Micro Smart Protection Server
- 5
- Apache Software Foundation Apache Hadoop · org.apache.hadoo…
- 1
- F5 Networks BIG-IP AFM
- 1
- IBM Cram Social Program Management
- 1
- IBM Integration Bus
- 1
- oxid-esales/oxideshop-ce
- 1
- rails_admin
- 1
- Talos delayed_job_web rails gem · delayed_job_web
- 1
- Talos Parity
- 1
High 3
- CVE-2017-12119An exploitable unhandled exception vulnerability exists in multiple APIs of CPP-Ethereum JSON-RPC.Talos CPP-Ethereum
- CVE-2017-14457An exploitable information leak/denial of service vulnerability exists in the libevm (Ethereum Virtual Machine) `create2` opcode handler…Talos CPP-Ethereum
- CVE-2017-14460An exploitable overly permissive cross-domain (CORS) whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8.Talos Parity
Medium, low and unrated 29
- CVE-2017-12113An exploitable improper authorization vulnerability exists in admin_nodeInfo API of cpp-ethereum's JSON-RPC (commit…Talos CPP-Ethereum
- CVE-2017-12116An exploitable improper authorization vulnerability exists in miner_setGasPrice API of cpp-ethereum's JSON-RPC (commit…Talos CPP-Ethereum
- CVE-2017-12118An exploitable improper authorization vulnerability exists in miner_stop API of cpp-ethereum's JSON-RPC (commit…Talos CPP-Ethereum
- CVE-2017-12112An exploitable improper authorization vulnerability exists in admin_addPeer API of cpp-ethereum's JSON-RPC (commit…Talos CPP-Ethereum
- CVE-2017-12114An exploitable improper authorization vulnerability exists in admin_peers API of cpp-ethereum's JSON-RPC (commit…Talos CPP-Ethereum
- CVE-2017-12115An exploitable improper authorization vulnerability exists in miner_setEtherbase API of cpp-ethereum's JSON-RPC (commit…Talos CPP-Ethereum
- CVE-2017-12117An exploitable improper authorization vulnerability exists in miner_start API of cpp-ethereum's JSON-RPC (commit…Talos CPP-Ethereum
- CVE-2017-12097An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem version 1.4.Talos delayed_job_web rails gem · delayed_job_web
- CVE-2017-11398A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could…Trend Micro Smart Protection Server
- CVE-2017-12098An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0.rails_admin
- CVE-2017-14082An uninitialized pointer information disclosure vulnerability in Trend Micro Mobile Security (Enterprise) versions 9.7 and below could…Trend Micro Mobile Security
- CVE-2017-14094A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote…Trend Micro Smart Protection Server
- CVE-2017-14095A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote…Trend Micro Smart Protection Server
- CVE-2017-14096A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow…Trend Micro Smart Protection Server
- CVE-2017-14097An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an…Trend Micro Smart Protection Server
- CVE-2017-15713Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to…Apache Software Foundation Apache Hadoop · org.apache.hadoo…
- CVE-2017-18044A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6.
- CVE-2017-7325Yandex Browser before 16.9.0 allows remote attackers to spoof the address bar via window.open.Yandex N.V. Yandex Browser
- CVE-2017-7326Race condition issue in Yandex Browser for Android before 17.4.0.16 allowed a remote attacker to potentially exploit memory corruption via…Yandex N.V. Yandex Browser for Android
- CVE-2017-7327Yandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path is used for…Yandex N.V. Yandex Browser for Desktop
- CVE-2014-4919OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition before 5.0.13 and 5.1.x before 5.1.7, and…
- CVE-2015-6926The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the…oxid-esales/oxideshop-ce
- CVE-2017-1693IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users session during a…IBM Integration Bus
- CVE-2017-6142X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall…F5 Networks BIG-IP AFM
- CVE-2018-1362IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow an authenticated user to withdraw…IBM Cram Social Program Management
Show all 29 entriesShow fewer entries
- CVE-2018-5783In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function (base/PdfVecObjects.h).
- CVE-2018-5784In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c.
- CVE-2018-5785In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder function (openjp2/j2k.c).
- CVE-2018-5786In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the get_fileinfo function (lrzip.c).