# CVEs published 2017-01-05

14 CVEs were published on January 5, 2017: 0 critical, 3 high. Days are UTC.

- [CVE-2015-3441](https://cve.now/CVE-2015-3441.md): The Parental Control panel in Genexis devices with DRGOS before 1.14.1 allows remote authenticated users to execute arbitrary CLI commands v (no CVSS)
- [CVE-2016-6890](https://cve.now/CVE-2016-6890.md): Heap-based buffer overflow in MatrixSSL before 3.8.6 allows remote attackers to execute arbitrary code via a crafted Subject Alt Name in an (no CVSS)
- [CVE-2016-6891](https://cve.now/CVE-2016-6891.md): MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ASN.1 Bit Field primitive in (no CVSS)
- [CVE-2016-6892](https://cve.now/CVE-2016-6892.md): The x509FreeExtensions function in MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (free of unallocated memory) (no CVSS)
- [CVE-2016-8006](https://cve.now/CVE-2016-8006.md): Authentication bypass vulnerability in Enterprise Security Manager (ESM) and License Manager (LM) in Intel Security McAfee Security Informat (no CVSS)
- [CVE-2017-5179](https://cve.now/CVE-2017-5179.md): Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9.3 allows remote authenticated users to inject arbitrary web script or (no CVSS)
- [CVE-2016-10030](https://cve.now/CVE-2016-10030.md): The \_prolog\_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability i (no CVSS)
- [CVE-2016-9754](https://cve.now/CVE-2016-9754.md): The ring\_buffer\_resize function in kernel/trace/ring\_buffer.c in the profiling subsystem in the Linux kernel before 4.6.1 mishandles certain (no CVSS)
- [CVE-2016-7168](https://cve.now/CVE-2016-7168.md): Cross-site scripting (XSS) vulnerability in the media\_handle\_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might (no CVSS)
- [CVE-2016-7169](https://cve.now/CVE-2016-7169.md): Directory traversal vulnerability in the File\_Upload\_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade packa (no CVSS)
- [CVE-2016-10009](https://cve.now/CVE-2016-10009.md): Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKC (CVSS 7.3)
- [CVE-2016-10010](https://cve.now/CVE-2016-10010.md): sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local us (CVSS 7.0)
- [CVE-2016-10011](https://cve.now/CVE-2016-10011.md): authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users (CVSS 6.2)
- [CVE-2016-10012](https://cve.now/CVE-2016-10012.md): The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-01-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.