# CVEs published 2017-01-20 25 CVEs were published on January 20, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2014-2045](https://cve.now/CVE-2014-2045.md): Multiple cross-site scripting (XSS) vulnerabilities in the old and new interfaces in Viprinet Multichannel VPN Router 300 allow remote attac (no CVSS) - [CVE-2014-9754](https://cve.now/CVE-2014-9754.md): The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint ident (no CVSS) - [CVE-2014-9755](https://cve.now/CVE-2014-9755.md): The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint ident (no CVSS) - [CVE-2016-5316](https://cve.now/CVE-2016-5316.md): Out-of-bounds read in the PixarLogCleanup function in tif\_pixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the appli (no CVSS) - [CVE-2016-5317](https://cve.now/CVE-2016-5317.md): Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlier, as used in GNOME n (no CVSS) - [CVE-2016-5318](https://cve.now/CVE-2016-5318.md): Stack-based buffer overflow in the \_TIFFVGetField function in libtiff 4.0.6 and earlier allows remote attackers to crash the application via (no CVSS) - [CVE-2016-5319](https://cve.now/CVE-2016-5319.md): Heap-based buffer overflow in tif\_packbits.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application via a crafted bmp (no CVSS) - [CVE-2016-5321](https://cve.now/CVE-2016-5321.md): The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service (invalid read and crash) via a crafte (no CVSS) - [CVE-2016-5323](https://cve.now/CVE-2016-5323.md): The \_TIFFFax3fillruns function in libtiff before 4.0.6 allows remote attackers to cause a denial of service (divide-by-zero error and applic (no CVSS) - [CVE-2016-6253](https://cve.now/CVE-2016-6253.md): mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbi (no CVSS) - [CVE-2016-9435](https://cve.now/CVE-2016-9435.md): The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to cr (no CVSS) - [CVE-2016-9436](https://cve.now/CVE-2016-9436.md): parsetagx.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via (no CVSS) - [CVE-2016-10143](https://cve.now/CVE-2016-10143.md): A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a (no CVSS) - [CVE-2016-5012](https://cve.now/CVE-2016-5012.md): In Moodle 3.x, glossary search displays entries without checking user permissions to view them. (no CVSS, moodle/moodle) - [CVE-2016-5013](https://cve.now/CVE-2016-5013.md): In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam. (no CVSS, moodle/moodle) - [CVE-2016-5014](https://cve.now/CVE-2016-5014.md): In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course. (no CVSS, moodle/moodle) - [CVE-2016-7038](https://cve.now/CVE-2016-7038.md): In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed. (no CVSS, Moodle 2.x and 3.x · moodle/moodle) - [CVE-2016-8642](https://cve.now/CVE-2016-8642.md): In Moodle 2.x and 3.x, the question engine allows access to files that should not be available. (no CVSS, Moodle 2.x and 3.x · moodle/moodle) - [CVE-2016-8643](https://cve.now/CVE-2016-8643.md): In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services. (no CVSS, Moodle 2.x and 3.x) - [CVE-2016-8644](https://cve.now/CVE-2016-8644.md): In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context. (no CVSS, Moodle 2.x and 3.x) - [CVE-2017-2576](https://cve.now/CVE-2017-2576.md): In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums. (no CVSS, Moodle 2.x and 3.x · moodle/moodle) - [CVE-2017-2578](https://cve.now/CVE-2017-2578.md): In Moodle 3.x, there is XSS in the assignment submission page. (no CVSS, Moodle 3.x · moodle/moodle) - [CVE-2017-5541](https://cve.now/CVE-2017-5541.md): Directory traversal vulnerability in template/usererror.missing\_extension.php in Symphony CMS before 2.6.10 allows remote attackers to renam (no CVSS) - [CVE-2017-5542](https://cve.now/CVE-2017-5542.md): Cross-site scripting (XSS) vulnerability in template/usererror.missing\_extension.php in Symphony CMS before 2.6.10 allows remote attackers t (no CVSS) - [CVE-2017-5543](https://cve.now/CVE-2017-5543.md): includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serializ (no CVSS, intelliants/subrion) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-01-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.