CVEs published January 20, 2017
25 CVEs were published on January 20, 2017: 0 critical, 0 high.
- Published
- 25
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Moodle 2.x and 3.x · moodle/moodle
- 3
- moodle/moodle
- 3
- Moodle 2.x and 3.x
- 2
- intelliants/subrion
- 1
- Moodle 3.x · moodle/moodle
- 1
Medium, low and unrated 25
- CVE-2014-2045Multiple cross-site scripting (XSS) vulnerabilities in the old and new interfaces in Viprinet Multichannel VPN Router 300 allow remote attac
- CVE-2014-9754The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint ident
- CVE-2014-9755The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint ident
- CVE-2016-5316Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the appli
- CVE-2016-5317Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlier, as used in GNOME n
- CVE-2016-5318Stack-based buffer overflow in the _TIFFVGetField function in libtiff 4.0.6 and earlier allows remote attackers to crash the application via
- CVE-2016-5319Heap-based buffer overflow in tif_packbits.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application via a crafted bmp
- CVE-2016-5321The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service (invalid read and crash) via a crafte
- CVE-2016-5323The _TIFFFax3fillruns function in libtiff before 4.0.6 allows remote attackers to cause a denial of service (divide-by-zero error and applic
- CVE-2016-6253mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbi
- CVE-2016-9435The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to cr
- CVE-2016-9436parsetagx.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via
- CVE-2016-10143A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a
- CVE-2016-5012In Moodle 3.x, glossary search displays entries without checking user permissions to view them.moodle/moodle
- CVE-2016-5013In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.moodle/moodle
- CVE-2016-5014In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.moodle/moodle
- CVE-2016-7038In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.Moodle 2.x and 3.x · moodle/moodle
- CVE-2016-8642In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.Moodle 2.x and 3.x · moodle/moodle
- CVE-2016-8643In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services.Moodle 2.x and 3.x
- CVE-2016-8644In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.Moodle 2.x and 3.x
- CVE-2017-2576In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.Moodle 2.x and 3.x · moodle/moodle
- CVE-2017-2578In Moodle 3.x, there is XSS in the assignment submission page.Moodle 3.x · moodle/moodle
- CVE-2017-5541Directory traversal vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to renam
- CVE-2017-5542Cross-site scripting (XSS) vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers t
- CVE-2017-5543includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serializintelliants/subrion