# CVEs published 2017-01-23

97 CVEs were published on January 23, 2017: 0 critical, 1 high. Days are UTC.

- [CVE-2013-7451](https://cve.now/CVE-2013-7451.md): The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag. (no CVSS, validator)
- [CVE-2013-7452](https://cve.now/CVE-2013-7452.md): The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted javascri (no CVSS, validator)
- [CVE-2013-7453](https://cve.now/CVE-2013-7453.md): The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related to (no CVSS, validator)
- [CVE-2013-7454](https://cve.now/CVE-2013-7454.md): The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden s (no CVSS, validator)
- [CVE-2014-8362](https://cve.now/CVE-2014-8362.md): Vivint Sky Control Panel 1.1.1.9926 allows remote attackers to enable and disable the alarm system and modify other security settings via th (no CVSS)
- [CVE-2014-9772](https://cve.now/CVE-2014-9772.md): The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded chara (no CVSS, validator)
- [CVE-2015-4626](https://cve.now/CVE-2015-4626.md): B.A.S C2Box before 4.0.0 (r19171) relies on client-side validation, which allows remote attackers to "corrupt the business logic" via a nega (no CVSS)
- [CVE-2015-7743](https://cve.now/CVE-2015-7743.md): XML external entity vulnerability in PRTG Network Monitor before 16.2.23.3077/3078 allows remote authenticated users to read arbitrary files (no CVSS)
- [CVE-2015-8315](https://cve.now/CVE-2015-8315.md): The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "re (CVSS 7.5, ms)
- [CVE-2015-8854](https://cve.now/CVE-2015-8854.md): The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that tri (no CVSS, marked)
- [CVE-2015-8855](https://cve.now/CVE-2015-8855.md): The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a (no CVSS, semver)
- [CVE-2015-8856](https://cve.now/CVE-2015-8856.md): Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web (no CVSS, serve-index)
- [CVE-2015-8857](https://cve.now/CVE-2015-8857.md): The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which m (no CVSS, uglify-js · uglifier)
- [CVE-2015-8858](https://cve.now/CVE-2015-8858.md): The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse (no CVSS, uglify-js)
- [CVE-2015-8859](https://cve.now/CVE-2015-8859.md): The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors. (no CVSS, send)
- [CVE-2015-8860](https://cve.now/CVE-2015-8860.md): The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive. (no CVSS, tar)
- [CVE-2015-8861](https://cve.now/CVE-2015-8861.md): The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a templa (no CVSS, handlebars)
- [CVE-2015-8862](https://cve.now/CVE-2015-8862.md): mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template wit (no CVSS, mustache)
- [CVE-2015-8971](https://cve.now/CVE-2015-8971.md): Terminology 0.7.0 allows remote attackers to execute arbitrary commands via escape sequences that modify the window title and then are writt (no CVSS)
- [CVE-2015-8972](https://cve.now/CVE-2015-8972.md): Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess (aka gnuchess) before 6.2.4 might allow context-de (no CVSS)
- [CVE-2016-0765](https://cve.now/CVE-2016-0765.md): Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to i (no CVSS)
- [CVE-2016-0769](https://cve.now/CVE-2016-0769.md): Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execu (no CVSS)
- [CVE-2016-1281](https://cve.now/CVE-2016-1281.md): Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before 1.17-BETA, and possibly other products all (no CVSS)
- [CVE-2016-1417](https://cve.now/CVE-2016-1417.md): Untrusted search path vulnerability in Snort 2.9.7.0-WIN32 allows remote attackers to execute arbitrary code and conduct DLL hijacking attac (no CVSS)
- [CVE-2016-1925](https://cve.now/CVE-2016-1925.md): Integer underflow in header.c in lha allows remote attackers to have unspecified impact via a large header size value for the (1) level0 or (no CVSS)
- [CVE-2016-2242](https://cve.now/CVE-2016-2242.md): Exponent CMS 2.x before 2.3.7 Patch 3 allows remote attackers to execute arbitrary code via the sc parameter to install/index.php. (no CVSS)
- [CVE-2016-2783](https://cve.now/CVE-2016-2783.md): Avaya Fabric Connect Virtual Services Platform (VSP) Operating System Software (VOSS) before 4.2.3.0 and 5.x before 5.0.1.0 does not properl (no CVSS)
- [CVE-2016-3147](https://cve.now/CVE-2016-3147.md): Buffer overflow in the collector.exe listener of the Landesk Management Suite 10.0.0.271 and earlier allows remote attackers to cause a deni (no CVSS)
- [CVE-2016-3177](https://cve.now/CVE-2016-3177.md): Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors. (no CVSS)
- [CVE-2016-4010](https://cve.now/CVE-2016-4010.md): Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted (no CVSS)
- [CVE-2016-4055](https://cve.now/CVE-2016-4055.md): The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) (no CVSS, moment)
- [CVE-2016-4056](https://cve.now/CVE-2016-4056.md): Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary w (no CVSS, typo3/cms)
- [CVE-2016-4338](https://cve.now/CVE-2016-4338.md): The mysql user parameter configuration script (userparameter\_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0. (no CVSS)
- [CVE-2016-4340](https://cve.now/CVE-2016-4340.md): The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 thro (no CVSS)
- [CVE-2016-4484](https://cve.now/CVE-2016-4484.md): The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via man (no CVSS)
- [CVE-2016-4793](https://cve.now/CVE-2016-4793.md): The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header. (no CVSS, cakephp/cakephp)
- [CVE-2016-5091](https://cve.now/CVE-2016-5091.md): Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execut (no CVSS, typo3/cms-extbase)
- [CVE-2016-5119](https://cve.now/CVE-2016-5119.md): The automatic update feature in KeePass 2.33 and earlier allows man-in-the-middle attackers to execute arbitrary code by spoofing the versio (no CVSS)
- [CVE-2016-5237](https://cve.now/CVE-2016-5237.md): Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to modify the files and (no CVSS)
- [CVE-2016-5697](https://cve.now/CVE-2016-5697.md): Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors. (no CVSS, ruby-saml)
- [CVE-2016-5720](https://cve.now/CVE-2016-5720.md): Multiple untrusted search path vulnerabilities in Microsoft Skype allow local users to execute arbitrary code and conduct DLL hijacking atta (no CVSS)
- [CVE-2016-5742](https://cve.now/CVE-2016-5742.md): SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6 and Movable Ty (no CVSS)
- [CVE-2016-5873](https://cve.now/CVE-2016-5873.md): Buffer overflow in the HTTP URL parsing functions in pecl\_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-p (no CVSS)
- [CVE-2016-5876](https://cve.now/CVE-2016-5876.md): ownCloud server before 8.2.6 and 9.x before 9.0.3, when the gallery app is enabled, allows remote attackers to download arbitrary images via (no CVSS)
- [CVE-2016-6160](https://cve.now/CVE-2016-6160.md): tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service (segmentation fault) via a large frame, a related (no CVSS)
- [CVE-2016-6164](https://cve.now/CVE-2016-6164.md): Integer overflow in the mov\_build\_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before 3.0.3 and 3.1.x before 3.1.1 allo (no CVSS)
- [CVE-2016-6223](https://cve.now/CVE-2016-6223.md): The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in tif\_read.c in libtiff before 4.0.7 allows remote attackers to cause a denial of serv (no CVSS)
- [CVE-2016-6484](https://cve.now/CVE-2016-6484.md): CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbitrary HTTP headers and (no CVSS)
- [CVE-2016-6517](https://cve.now/CVE-2016-6517.md): Directory traversal vulnerability in Liferay 5.1.0 allows remote attackers to have unspecified impact via a %2E%2E (encoded dot dot) in the (no CVSS)
- [CVE-2016-6521](https://cve.now/CVE-2016-6521.md): Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earli (no CVSS)
- [CVE-2016-6582](https://cve.now/CVE-2016-6582.md): The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging fai (no CVSS, doorkeeper)
- [CVE-2016-6600](https://cve.now/CVE-2016-6600.md): Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to uploa (no CVSS)
- [CVE-2016-6601](https://cve.now/CVE-2016-6601.md): Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to rea (no CVSS)
- [CVE-2016-6602](https://cve.now/CVE-2016-6602.md): ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtai (no CVSS)
- [CVE-2016-6603](https://cve.now/CVE-2016-6603.md): ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP (no CVSS)
- [CVE-2016-6668](https://cve.now/CVE-2016-6668.md): The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence (no CVSS)
- [CVE-2016-6920](https://cve.now/CVE-2016-6920.md): Heap-based buffer overflow in the decode\_block function in libavcodec/exr.c in FFmpeg before 3.1.3 allows remote attackers to cause a denial (no CVSS)
- [CVE-2016-7036](https://cve.now/CVE-2016-7036.md): python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys. (no CVSS, python-jose)
- [CVE-2016-7037](https://cve.now/CVE-2016-7037.md): The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, wh (no CVSS)
- [CVE-2016-7102](https://cve.now/CVE-2016-7102.md): ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan library in a "special p (no CVSS)
- [CVE-2016-7410](https://cve.now/CVE-2016-7410.md): The \_dwarf\_read\_loc\_section function in dwarf\_loc.c in libdwarf 20160613 allows attackers to cause a denial of service (buffer over-read) vi (no CVSS)
- [CVE-2016-7567](https://cve.now/CVE-2016-7567.md): Buffer overflow in the SLPFoldWhiteSpace function in common/slp\_compare.c in OpenSLP 2.0 allows remote attackers to have unspecified impact (no CVSS)
- [CVE-2016-7792](https://cve.now/CVE-2016-7792.md): Ubiquiti Networks UniFi 5.2.7 does not restrict access to the database, which allows remote attackers to modify the database by directly con (no CVSS)
- [CVE-2016-9012](https://cve.now/CVE-2016-9012.md): CloudVision Portal (CVP) before 2016.1.2.1 allows remote authenticated users to gain access to the internal configuration mechanisms via the (no CVSS)
- [CVE-2016-9081](https://cve.now/CVE-2016-9081.md): Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perform other user account (no CVSS)
- [CVE-2016-9379](https://cve.now/CVE-2016-9379.md): The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to r (no CVSS)
- [CVE-2016-9380](https://cve.now/CVE-2016-9380.md): The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to (no CVSS)
- [CVE-2016-9381](https://cve.now/CVE-2016-9381.md): Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka (no CVSS)
- [CVE-2016-9382](https://cve.now/CVE-2016-9382.md): Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cau (no CVSS)
- [CVE-2016-9383](https://cve.now/CVE-2016-9383.md): Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive infor (no CVSS)
- [CVE-2016-9385](https://cve.now/CVE-2016-9385.md): The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial (no CVSS)
- [CVE-2016-9386](https://cve.now/CVE-2016-9386.md): The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users (no CVSS)
- [CVE-2016-9401](https://cve.now/CVE-2016-9401.md): popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address. (CVSS 6.2)
- [CVE-2016-9445](https://cve.now/CVE-2016-9445.md): Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via large width and heigh (no CVSS)
- [CVE-2016-9446](https://cve.now/CVE-2016-9446.md): The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as de (no CVSS)
- [CVE-2016-9447](https://cve.now/CVE-2016-9447.md): The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) an (no CVSS)
- [CVE-2017-5371](https://cve.now/CVE-2017-5371.md): Odata Server in SAP Adaptive Server Enterprise (ASE) 16 allows remote attackers to cause a denial of service (process crash) via a series of (no CVSS)
- [CVE-2017-5372](https://cve.now/CVE-2017-5372.md): The function msp (aka MSPRuntimeInterface) in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obtain sensitive system (no CVSS)
- [CVE-2017-5569](https://cve.now/CVE-2017-5569.md): An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. (no CVSS)
- [CVE-2017-5570](https://cve.now/CVE-2017-5570.md): An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. (no CVSS)
- [CVE-2017-5182](https://cve.now/CVE-2017-5182.md): Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted U (no CVSS, Micro Focus International Open Enterprise Server)
- [CVE-2016-10101](https://cve.now/CVE-2016-10101.md): Information Disclosure can occur in Hitek Software's Automize 10.x and 11.x passManager.jsd. (no CVSS)
- [CVE-2016-10102](https://cve.now/CVE-2016-10102.md): hitek.jar in Hitek Software's Automize uses weak encryption when encrypting SSH/SFTP and Encryption profile passwords. (no CVSS)
- [CVE-2016-10103](https://cve.now/CVE-2016-10103.md): Information Disclosure can occur in encryptionProfiles.jsd in Hitek Software's Automize because of the Read attribute being set for Users. (no CVSS)
- [CVE-2016-10104](https://cve.now/CVE-2016-10104.md): Information Disclosure can occur in sshProfiles.jsd in Hitek Software's Automize because of the Read attribute being set for Users. (no CVSS)
- [CVE-2016-10156](https://cve.now/CVE-2016-10156.md): A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowi (no CVSS)
- [CVE-2016-10157](https://cve.now/CVE-2016-10157.md): Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path. (no CVSS)
- [CVE-2016-8213](https://cve.now/CVE-2016-8213.md): EMC Documentum WebTop Version 6.8, prior to P18 and Version 6.8.1, prior to P06; and EMC Documentum TaskSpace version 6.7SP3, prior to P02; (no CVSS, EMC Documentum Webtop and Clients)
- [CVE-2016-9870](https://cve.now/CVE-2016-9870.md): EMC Isilon OneFS 8.0.0.0, EMC Isilon OneFS 7.2.1.0 - 7.2.1.2, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.1.10, and EMC Isilon (no CVSS, EMC Isilon OneFS)
- [CVE-2017-5539](https://cve.now/CVE-2017-5539.md): The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. (no CVSS)
- [CVE-2017-5544](https://cve.now/CVE-2017-5544.md): An issue was discovered on FiberHome Fengine S5800 switches V210R240. (no CVSS)
- [CVE-2017-5553](https://cve.now/CVE-2017-5553.md): Cross-site scripting (XSS) vulnerability in plugins/markdown\_plugin/\_markdown.plugin.php in b2evolution before 6.8.5 allows remote authentic (no CVSS)
- [CVE-2017-5554](https://cve.now/CVE-2017-5554.md): An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. (no CVSS)
- [CVE-2017-5556](https://cve.now/CVE-2017-5556.md): The ConvertToPDF plugin in Foxit Reader before 8.2 and PhantomPDF before 8.2 on Windows, when the gflags app is enabled, allows remote attac (no CVSS)
- [CVE-2017-5563](https://cve.now/CVE-2017-5563.md): LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif\_lzw.c resulting in DoS or code execution via a crafted bmp image (no CVSS)
- [CVE-2017-5574](https://cve.now/CVE-2017-5574.md): SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows unauthenticated users to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2017-5575](https://cve.now/CVE-2017-5575.md): SQL injection vulnerability in inc/lib/Options.class.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-01-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.