# CVEs published 2018-01-31

39 CVEs were published on January 31, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2017-16911](https://cve.now/CVE-2017-16911.md): The vhci\_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to disclose kernel memory addresses. (no CVSS, Flexera Software Linux Kernel)
- [CVE-2017-16912](https://cve.now/CVE-2017-16912.md): The "get\_pipe()" function (drivers/usb/usbip/stub\_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 allows attackers to… (no CVSS, Flexera Software Linux Kernel)
- [CVE-2017-16913](https://cve.now/CVE-2017-16913.md): The "stub\_recv\_cmd\_submit()" function (drivers/usb/usbip/stub\_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 when… (no CVSS, Flexera Software Linux Kernel)
- [CVE-2017-16914](https://cve.now/CVE-2017-16914.md): The "stub\_send\_ret\_submit()" function (drivers/usb/usbip/stub\_tx.c) in the Linux Kernel before version 4.14.8, 4.9.71, 4.1.49, and 4.4.107… (no CVSS, Flexera Software Linux Kernel)
- [CVE-2018-6374](https://cve.now/CVE-2018-6374.md): The GUI component (aka PulseUI) in Pulse Secure Desktop Linux clients before PULSE5.2R9.2 and 5.3.x before PULSE5.3R4.2 does not perform… (no CVSS)
- [CVE-2017-15653](https://cve.now/CVE-2017-15653.md): Improper administrator IP validation after his login in the HTTPd server in all current versions (\<= 3.0.0.4.380.7743) of Asus asuswrt… (no CVSS)
- [CVE-2017-15654](https://cve.now/CVE-2017-15654.md): Highly predictable session tokens in the HTTPd server in all current versions (\<= 3.0.0.4.380.7743) of Asus asuswrt allow gaining… (no CVSS)
- [CVE-2017-15655](https://cve.now/CVE-2017-15655.md): Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version \<=3.0.0.4.376.X. (no CVSS)
- [CVE-2017-15656](https://cve.now/CVE-2017-15656.md): Password are stored in plaintext in nvram in the HTTPd server in all current versions (\<= 3.0.0.4.380.7743) of Asus asuswrt. (no CVSS)
- [CVE-2017-16928](https://cve.now/CVE-2017-16928.md): The arq\_updater binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root… (no CVSS)
- [CVE-2017-16945](https://cve.now/CVE-2017-16945.md): The standardrestorer binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root… (no CVSS)
- [CVE-2017-18043](https://cve.now/CVE-2017-18043.md): Integer overflow in the macro ROUND\_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of service (Qemu process crash). (no CVSS)
- [CVE-2018-0136](https://cve.now/CVE-2018-0136.md): A vulnerability in the IPv6 subsystem of Cisco IOS XR Software Release 5.3.4 for the Cisco Aggregation Services Router (ASR) 9000 Series… (no CVSS, Cisco Aggregation Services Router 9000 Series)
- [CVE-2018-6479](https://cve.now/CVE-2018-6479.md): An issue was discovered on Netwave IP Camera devices. (no CVSS)
- [CVE-2018-6480](https://cve.now/CVE-2018-6480.md): A type confusion issue was discovered in CCN-lite 2, leading to a memory access violation and a failure of the nonce feature (which, for… (no CVSS)
- [CVE-2018-6471](https://cve.now/CVE-2018-6471.md): In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or… (no CVSS)
- [CVE-2018-6472](https://cve.now/CVE-2018-6472.md): In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or… (no CVSS)
- [CVE-2018-6473](https://cve.now/CVE-2018-6473.md): In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or… (no CVSS)
- [CVE-2018-6474](https://cve.now/CVE-2018-6474.md): In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or… (no CVSS)
- [CVE-2018-6475](https://cve.now/CVE-2018-6475.md): In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Privileges. (no CVSS)
- [CVE-2018-6476](https://cve.now/CVE-2018-6476.md): In SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\\SYSTEM because of not… (no CVSS)
- [CVE-2014-1631](https://cve.now/CVE-2014-1631.md): Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php. (no CVSS)
- [CVE-2014-1632](https://cve.now/CVE-2014-1632.md): htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter. (no CVSS)
- [CVE-2018-5701](https://cve.now/CVE-2018-5701.md): In Iolo System Shield AntiVirus and AntiSpyware 5.0.0.136, the amp.sys driver file contains an Arbitrary Write vulnerability due to not… (no CVSS)
- [CVE-2018-5996](https://cve.now/CVE-2018-5996.md): Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory… (no CVSS)
- [CVE-2018-6462](https://cve.now/CVE-2018-6462.md): Tracker PDF-XChange Viewer and Viewer AX SDK before 2.5.322.8 mishandle conversion from YCC to RGB colour spaces by calculating on the… (no CVSS)
- [CVE-2018-6464](https://cve.now/CVE-2018-6464.md): Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1. (no CVSS, simditor)
- [CVE-2018-6465](https://cve.now/CVE-2018-6465.md): The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to… (no CVSS)
- [CVE-2018-6460](https://cve.now/CVE-2018-6460.md): Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. (no CVSS)
- [CVE-2017-8916](https://cve.now/CVE-2017-8916.md): In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's… (no CVSS)
- [CVE-2018-6384](https://cve.now/CVE-2018-6384.md): Unquoted Windows search path vulnerability in NSClient++ before 0.4.1.73 allows non-privileged local users to execute arbitrary code with… (no CVSS)
- [CVE-2017-1233](https://cve.now/CVE-2017-1233.md): IBM Remote Control v9 could allow a local user to use the component to replace files to which he does not have write access and which he… (no CVSS, IBM BigFix Remote Control)
- [CVE-2017-1773](https://cve.now/CVE-2017-1773.md): IBM DataPower Gateways 7.1, 7,2, 7.5, and 7.6 could allow an attacker using man-in-the-middle techniques to spoof DNS responses to perform… (no CVSS, IBM DataPower Gateways)
- [CVE-2017-1000411](https://cve.now/CVE-2017-1000411.md): OpenFlow Plugin and OpenDayLight Controller versions Nitrogen, Carbon, Boron, Robert Varga, Anil Vishnoi contain a flaw when multiple… (no CVSS)
- [CVE-2017-15698](https://cve.now/CVE-2017-15698.md): When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not… (no CVSS, Apache Software Foundation Apache Tomcat Native)
- [CVE-2017-15706](https://cve.now/CVE-2017-15706.md): As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to… (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2017-16858](https://cve.now/CVE-2017-16858.md): The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2… (no CVSS, Atlassian Crowd)
- [CVE-2018-1000001](https://cve.now/CVE-2018-1000001.md): In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination… (no CVSS)
- [CVE-2018-6412](https://cve.now/CVE-2018-6412.md): In the function sbusfb\_ioctl\_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-01-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.