# CVEs published 2017-01-15 10 CVEs were published on January 15, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-5480](https://cve.now/CVE-2017-5480.md): Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated users to read or dele (no CVSS) - [CVE-2017-5494](https://cve.now/CVE-2017-5494.md): Multiple cross-site scripting (XSS) vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to (no CVSS) - [CVE-2017-2584](https://cve.now/CVE-2017-2584.md): arch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local users to obtain sensitive information from kernel memory or cause a de (no CVSS) - [CVE-2017-5487](https://cve.now/CVE-2017-5487.md): wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not prop (no CVSS) - [CVE-2017-5488](https://cve.now/CVE-2017-5488.md): Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject a (no CVSS) - [CVE-2017-5489](https://cve.now/CVE-2017-5489.md): Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecifie (no CVSS) - [CVE-2017-5490](https://cve.now/CVE-2017-5490.md): Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7. (no CVSS) - [CVE-2017-5491](https://cve.now/CVE-2017-5491.md): wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with th (no CVSS) - [CVE-2017-5492](https://cve.now/CVE-2017-5492.md): Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote att (no CVSS) - [CVE-2017-5493](https://cve.now/CVE-2017-5493.md): wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, whic (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-01-15 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.