# CVEs published 2017-01-10

16 CVEs were published on January 10, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-0002](https://cve.now/CVE-2017-0002.md): Microsoft Edge allows remote attackers to bypass the Same Origin Policy via vectors involving the about:blank URL and data: URLs, aka "Micro (no CVSS)
- [CVE-2017-0003](https://cve.now/CVE-2017-0003.md): Microsoft Word 2016 and SharePoint Enterprise Server 2016 allow remote attackers to execute arbitrary code via a crafted document, aka "Micr (no CVSS)
- [CVE-2017-0004](https://cve.now/CVE-2017-0004.md): The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 (no CVSS)
- [CVE-2016-9247](https://cve.now/CVE-2016-9247.md): Under certain conditions for BIG-IP systems using a virtual server with an associated FastL4 profile and TCP analytics profile, a specific s (no CVSS, F5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, D…)
- [CVE-2015-4591](https://cve.now/CVE-2015-4591.md): eClinicalWorks Population Health (CCMR) suffers from a cross site scripting vulnerability in login.jsp which allows remote unauthenticated u (no CVSS)
- [CVE-2015-4592](https://cve.now/CVE-2015-4592.md): eClinicalWorks Population Health (CCMR) suffers from an SQL injection vulnerability in portalUserService.jsp which allows remote authenticat (no CVSS)
- [CVE-2015-4593](https://cve.now/CVE-2015-4593.md): eClinicalWorks Population Health (CCMR) suffers from a cross-site request forgery (CSRF) vulnerability in portalUserService.jsp which allows (no CVSS)
- [CVE-2015-4594](https://cve.now/CVE-2015-4594.md): eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. (no CVSS)
- [CVE-2016-6286](https://cve.now/CVE-2016-6286.md): The "spiffy-cgi-handlers" egg would convert a nonexistent "Proxy" header to the HTTP\_PROXY environment variable, which would allow attackers (no CVSS)
- [CVE-2016-6287](https://cve.now/CVE-2016-6287.md): The "http-client" egg always used a HTTP\_PROXY environment variable to determine whether HTTP traffic should be routed via a proxy, even whe (no CVSS)
- [CVE-2016-6580](https://cve.now/CVE-2016-6580.md): A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer (no CVSS, priority)
- [CVE-2016-6581](https://cve.now/CVE-2016-6581.md): A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of serv (no CVSS, hpack)
- [CVE-2016-6830](https://cve.now/CVE-2016-6830.md): The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size buffers for holding the arguments and environment var (no CVSS)
- [CVE-2016-6831](https://cve.now/CVE-2016-6831.md): The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak (no CVSS)
- [CVE-2016-6837](https://cve.now/CVE-2016-6837.md): Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versions 2.0.0-beta1, 1.3.0-beta1 al (no CVSS)
- [CVE-2016-10126](https://cve.now/CVE-2016-10126.md): Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3.x before 6.3.8, and (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-01-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.