# CVEs published 2017-01-18

61 CVEs were published on January 18, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-10086](https://cve.now/CVE-2016-10086.md): RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or m (no CVSS)
- [CVE-2016-3401](https://cve.now/CVE-2016-3401.md): Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote authenticated users to affect integrity via unknown vectors, ak (no CVSS)
- [CVE-2016-3402](https://cve.now/CVE-2016-3402.md): Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect confidentiality via unknown vectors, aka bu (no CVSS)
- [CVE-2016-3404](https://cve.now/CVE-2016-3404.md): Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 1039 (no CVSS)
- [CVE-2016-3405](https://cve.now/CVE-2016-3405.md): Multiple unspecified vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to affect integrity via unknown vectors, ak (no CVSS)
- [CVE-2016-3406](https://cve.now/CVE-2016-3406.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to hijack the authent (no CVSS)
- [CVE-2016-3407](https://cve.now/CVE-2016-3407.md): Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2016-3408](https://cve.now/CVE-2016-3408.md): Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2016-3409](https://cve.now/CVE-2016-3409.md): Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2016-3410](https://cve.now/CVE-2016-3410.md): Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2016-3411](https://cve.now/CVE-2016-3411.md): Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2016-3412](https://cve.now/CVE-2016-3412.md): Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2016-3413](https://cve.now/CVE-2016-3413.md): Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 1039 (no CVSS)
- [CVE-2016-3414](https://cve.now/CVE-2016-3414.md): Unspecified vulnerability in Zimbra Collaboration before 8.6.0 Patch 7 allows remote authenticated users to affect availability via unknown (no CVSS)
- [CVE-2016-3415](https://cve.now/CVE-2016-3415.md): Zimbra Collaboration before 8.7.0 allows remote attackers to conduct deserialization attacks via unspecified vectors, aka bug 102276. (no CVSS)
- [CVE-2016-3999](https://cve.now/CVE-2016-3999.md): Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2016-4019](https://cve.now/CVE-2016-4019.md): Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 1044 (no CVSS)
- [CVE-2016-6271](https://cve.now/CVE-2016-6271.md): The Bzrtp library (aka libbzrtp) 1.0.x before 1.0.4 allows man-in-the-middle attackers to conduct spoofing attacks by leveraging a missing H (no CVSS)
- [CVE-2016-6283](https://cve.now/CVE-2016-6283.md): Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.10.6 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2016-6497](https://cve.now/CVE-2016-6497.md): main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows attackers to conduct LDAP entry poisoning attack (no CVSS)
- [CVE-2016-9676](https://cve.now/CVE-2016-9676.md): Buffer overflow in Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code via unspecified vectors. (no CVSS)
- [CVE-2016-9677](https://cve.now/CVE-2016-9677.md): Citrix Provisioning Services before 7.12 allows attackers to obtain sensitive kernel address information via unspecified vectors. (no CVSS)
- [CVE-2016-9678](https://cve.now/CVE-2016-9678.md): Use-after-free vulnerability in Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code via unspecified vectors. (no CVSS)
- [CVE-2016-9679](https://cve.now/CVE-2016-9679.md): Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code by overwriting a function pointer. (no CVSS)
- [CVE-2016-9680](https://cve.now/CVE-2016-9680.md): Citrix Provisioning Services before 7.12 allows attackers to obtain sensitive information from kernel memory via unspecified vectors. (no CVSS)
- [CVE-2016-10147](https://cve.now/CVE-2016-10147.md): crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service (NULL pointer dereference and system cras (no CVSS)
- [CVE-2016-10148](https://cve.now/CVE-2016-10148.md): The wp\_ajax\_update\_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get\_plugin\_data call before checkin (no CVSS)
- [CVE-2016-6896](https://cve.now/CVE-2016-6896.md): Directory traversal vulnerability in the wp\_ajax\_update\_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remo (no CVSS)
- [CVE-2016-6897](https://cve.now/CVE-2016-6897.md): Cross-site request forgery (CSRF) vulnerability in the wp\_ajax\_update\_plugin function in wp-admin/includes/ajax-actions.php in WordPress bef (no CVSS)
- [CVE-2014-9909](https://cve.now/CVE-2014-9909.md): An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2014-9910](https://cve.now/CVE-2014-9910.md): An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code wi (no CVSS, Google Android)
- [CVE-2014-9913](https://cve.now/CVE-2014-9913.md): Buffer overflow in the list\_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via (no CVSS)
- [CVE-2015-8667](https://cve.now/CVE-2015-8667.md): Cross-site scripting (XSS) vulnerability in Reset Your Password module in Exponent CMS before 2.3.5 allows remote attackers to inject arbitr (no CVSS)
- [CVE-2015-8684](https://cve.now/CVE-2015-8684.md): Exponent CMS before 2.3.7 does not properly restrict the types of files that can be uploaded, which allows remote attackers to conduct cross (no CVSS)
- [CVE-2016-2087](https://cve.now/CVE-2016-2087.md): Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (no CVSS)
- [CVE-2016-2233](https://cve.now/CVE-2016-2233.md): Stack-based buffer overflow in the inbound\_cap\_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial (no CVSS)
- [CVE-2016-6526](https://cve.now/CVE-2016-6526.md): The SpamCall Activity component in Telecom application on Samsung Note device L(5.0/5.1) and M(6.0) allows attackers to cause a denial of se (no CVSS)
- [CVE-2016-6527](https://cve.now/CVE-2016-6527.md): The SmartCall Activity component in Telecom application on Samsung Note device L(5.0/5.1) and M(6.0) allows attackers to cause a denial of s (no CVSS)
- [CVE-2016-6823](https://cve.now/CVE-2016-6823.md): Integer overflow in the BMP coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (crash) via crafted he (no CVSS)
- [CVE-2016-7101](https://cve.now/CVE-2016-7101.md): The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value (no CVSS)
- [CVE-2016-7144](https://cve.now/CVE-2016-7144.md): The m\_authenticate function in modules/m\_sasl.c in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certific (no CVSS)
- [CVE-2016-7149](https://cve.now/CVE-2016-7149.md): Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2016-7150](https://cve.now/CVE-2016-7150.md): Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script o (no CVSS)
- [CVE-2016-7563](https://cve.now/CVE-2016-7563.md): The chartorune function in Artifex Software MuJS allows attackers to cause a denial of service (out-of-bounds read) via a \* (asterisk) at th (no CVSS)
- [CVE-2016-7564](https://cve.now/CVE-2016-7564.md): Heap-based buffer overflow in the Fp\_toString function in jsfunction.c in Artifex Software MuJS allows attackers to cause a denial of servic (no CVSS)
- [CVE-2016-7799](https://cve.now/CVE-2016-7799.md): MagickCore/profile.c in ImageMagick before 7.0.3-2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted f (no CVSS)
- [CVE-2016-7906](https://cve.now/CVE-2016-7906.md): magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file. (no CVSS)
- [CVE-2016-7980](https://cve.now/CVE-2016-7980.md): Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider\_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack t (no CVSS)
- [CVE-2016-7981](https://cve.now/CVE-2016-7981.md): Cross-site scripting (XSS) vulnerability in valider\_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2016-7982](https://cve.now/CVE-2016-7982.md): Directory traversal vulnerability in ecrire/exec/valider\_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on (no CVSS)
- [CVE-2016-7996](https://cve.now/CVE-2016-7996.md): Heap-based buffer overflow in the WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to have unspecified impact (no CVSS)
- [CVE-2016-7997](https://cve.now/CVE-2016-7997.md): The WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (assertion failure and crash (no CVSS)
- [CVE-2016-7998](https://cve.now/CVE-2016-7998.md): The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading a (no CVSS)
- [CVE-2016-7999](https://cve.now/CVE-2016-7999.md): ecrire/exec/valider\_xml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a UR (no CVSS)
- [CVE-2016-9109](https://cve.now/CVE-2016-9109.md): Artifex Software MuJS allows attackers to cause a denial of service (crash) via vectors related to incomplete escape sequences. (no CVSS)
- [CVE-2016-9273](https://cve.now/CVE-2016-9273.md): tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file, related to changing (no CVSS)
- [CVE-2016-9278](https://cve.now/CVE-2016-9278.md): The Samsung Exynos fimg2d driver for Android with Exynos 5433, 54xx, or 7420 chipsets allows local users to cause a denial of service (kerne (no CVSS)
- [CVE-2016-9279](https://cve.now/CVE-2016-9279.md): Use-after-free vulnerability in the Samsung Exynos fimg2d driver for Android with Exynos 5433, 54xx, or 7420 chipsets allows attackers to ob (no CVSS)
- [CVE-2016-9297](https://cve.now/CVE-2016-9297.md): The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted TIFF\_ (no CVSS)
- [CVE-2016-9584](https://cve.now/CVE-2016-9584.md): libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file. (no CVSS)
- [CVE-2016-9844](https://cve.now/CVE-2016-9844.md): Buffer overflow in the zi\_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-01-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.