CVEs published January 23, 2017
97 CVEs were published on January 23, 2017: 0 critical, 1 high.
- Published
- 97
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 0
- Unrated
- 95
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- validator
- 5
- cakephp/cakephp
- 1
- doorkeeper
- 1
- EMC Documentum Webtop and Clients
- 1
- EMC Isilon OneFS
- 1
- handlebars
- 1
- marked
- 1
- Micro Focus International Open Enterprise Server
- 1
- moment
- 1
- ms
- 1
High 1
Medium, low and unrated 96
- CVE-2013-7451The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag.validator
- CVE-2013-7452The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted javascrivalidator
- CVE-2013-7453The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related tovalidator
- CVE-2013-7454The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden svalidator
- CVE-2014-8362Vivint Sky Control Panel 1.1.1.9926 allows remote attackers to enable and disable the alarm system and modify other security settings via th
- CVE-2014-9772The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded charavalidator
- CVE-2015-4626B.A.S C2Box before 4.0.0 (r19171) relies on client-side validation, which allows remote attackers to "corrupt the business logic" via a nega
- CVE-2015-7743XML external entity vulnerability in PRTG Network Monitor before 16.2.23.3077/3078 allows remote authenticated users to read arbitrary files
- CVE-2015-8854The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trimarked
- CVE-2015-8855The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka asemver
- CVE-2015-8856Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary webserve-index
- CVE-2015-8857The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which muglify-js · uglifier
- CVE-2015-8858The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse uglify-js
- CVE-2015-8859The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.send
- CVE-2015-8860The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.tar
- CVE-2015-8861The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a templahandlebars
- CVE-2015-8862mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template witmustache
- CVE-2015-8971Terminology 0.7.0 allows remote attackers to execute arbitrary commands via escape sequences that modify the window title and then are writt
- CVE-2015-8972Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess (aka gnuchess) before 6.2.4 might allow context-de
- CVE-2016-0765Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to i
- CVE-2016-0769Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execu
- CVE-2016-1281Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before 1.17-BETA, and possibly other products all
- CVE-2016-1417Untrusted search path vulnerability in Snort 2.9.7.0-WIN32 allows remote attackers to execute arbitrary code and conduct DLL hijacking attac
- CVE-2016-1925Integer underflow in header.c in lha allows remote attackers to have unspecified impact via a large header size value for the (1) level0 or
- CVE-2016-2242Exponent CMS 2.x before 2.3.7 Patch 3 allows remote attackers to execute arbitrary code via the sc parameter to install/index.php.
- CVE-2016-2783Avaya Fabric Connect Virtual Services Platform (VSP) Operating System Software (VOSS) before 4.2.3.0 and 5.x before 5.0.1.0 does not properl
- CVE-2016-3147Buffer overflow in the collector.exe listener of the Landesk Management Suite 10.0.0.271 and earlier allows remote attackers to cause a deni
- CVE-2016-3177Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors.
- CVE-2016-4010Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted
- CVE-2016-4055The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption)moment
- CVE-2016-4056Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary wtypo3/cms
- CVE-2016-4338The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.
- CVE-2016-4340The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 thro
- CVE-2016-4484The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via man
- CVE-2016-4793The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.cakephp/cakephp
- CVE-2016-5091Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly executtypo3/cms-extbase
- CVE-2016-5119The automatic update feature in KeePass 2.33 and earlier allows man-in-the-middle attackers to execute arbitrary code by spoofing the versio
- CVE-2016-5237Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to modify the files and
- CVE-2016-5697Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.ruby-saml
- CVE-2016-5720Multiple untrusted search path vulnerabilities in Microsoft Skype allow local users to execute arbitrary code and conduct DLL hijacking atta
- CVE-2016-5742SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6 and Movable Ty
- CVE-2016-5873Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-p
- CVE-2016-5876ownCloud server before 8.2.6 and 9.x before 9.0.3, when the gallery app is enabled, allows remote attackers to download arbitrary images via
- CVE-2016-6160tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service (segmentation fault) via a large frame, a related
- CVE-2016-6164Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before 3.0.3 and 3.1.x before 3.1.1 allo
- CVE-2016-6223The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in tif_read.c in libtiff before 4.0.7 allows remote attackers to cause a denial of serv
- CVE-2016-6484CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbitrary HTTP headers and
- CVE-2016-6517Directory traversal vulnerability in Liferay 5.1.0 allows remote attackers to have unspecified impact via a %2E%2E (encoded dot dot) in the
- CVE-2016-6521Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earli
- CVE-2016-6582The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging faidoorkeeper
- CVE-2016-6600Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to uploa
- CVE-2016-6601Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to rea
- CVE-2016-6602ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtai
- CVE-2016-6603ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP
- CVE-2016-6668The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence
- CVE-2016-6920Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3 allows remote attackers to cause a denial
- CVE-2016-7036python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.python-jose
- CVE-2016-7037The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, wh
- CVE-2016-7102ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan library in a "special p
- CVE-2016-7410The _dwarf_read_loc_section function in dwarf_loc.c in libdwarf 20160613 allows attackers to cause a denial of service (buffer over-read) vi
- CVE-2016-7567Buffer overflow in the SLPFoldWhiteSpace function in common/slp_compare.c in OpenSLP 2.0 allows remote attackers to have unspecified impact
- CVE-2016-7792Ubiquiti Networks UniFi 5.2.7 does not restrict access to the database, which allows remote attackers to modify the database by directly con
- CVE-2016-9012CloudVision Portal (CVP) before 2016.1.2.1 allows remote authenticated users to gain access to the internal configuration mechanisms via the
- CVE-2016-9081Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perform other user account
- CVE-2016-9379The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to r
- CVE-2016-9380The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to
- CVE-2016-9381Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka
- CVE-2016-9382Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cau
- CVE-2016-9383Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive infor
- CVE-2016-9385The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial
- CVE-2016-9386The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users
- CVE-2016-9401popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.
- CVE-2016-9445Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via large width and heigh
- CVE-2016-9446The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as de
- CVE-2016-9447The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) an
- CVE-2017-5371Odata Server in SAP Adaptive Server Enterprise (ASE) 16 allows remote attackers to cause a denial of service (process crash) via a series of
- CVE-2017-5372The function msp (aka MSPRuntimeInterface) in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obtain sensitive system
- CVE-2017-5569An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13.
- CVE-2017-5570An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13.
- CVE-2017-5182Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted UMicro Focus International Open Enterprise Server
- CVE-2016-10101Information Disclosure can occur in Hitek Software's Automize 10.x and 11.x passManager.jsd.
- CVE-2016-10102hitek.jar in Hitek Software's Automize uses weak encryption when encrypting SSH/SFTP and Encryption profile passwords.
- CVE-2016-10103Information Disclosure can occur in encryptionProfiles.jsd in Hitek Software's Automize because of the Read attribute being set for Users.
- CVE-2016-10104Information Disclosure can occur in sshProfiles.jsd in Hitek Software's Automize because of the Read attribute being set for Users.
- CVE-2016-10156A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowi
- CVE-2016-10157Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path.
- CVE-2016-8213EMC Documentum WebTop Version 6.8, prior to P18 and Version 6.8.1, prior to P06; and EMC Documentum TaskSpace version 6.7SP3, prior to P02; EMC Documentum Webtop and Clients
- CVE-2016-9870EMC Isilon OneFS 8.0.0.0, EMC Isilon OneFS 7.2.1.0 - 7.2.1.2, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.1.10, and EMC Isilon EMC Isilon OneFS
- CVE-2017-5539The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability.
- CVE-2017-5544An issue was discovered on FiberHome Fengine S5800 switches V210R240.
- CVE-2017-5553Cross-site scripting (XSS) vulnerability in plugins/markdown_plugin/_markdown.plugin.php in b2evolution before 6.8.5 allows remote authentic
- CVE-2017-5554An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2.
- CVE-2017-5556The ConvertToPDF plugin in Foxit Reader before 8.2 and PhantomPDF before 8.2 on Windows, when the gflags app is enabled, allows remote attac
- CVE-2017-5563LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image
- CVE-2017-5574SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows unauthenticated users to execute arbitrary SQL commands via the
- CVE-2017-5575SQL injection vulnerability in inc/lib/Options.class.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands