CVEs published January 30, 2017
57 CVEs were published on January 30, 2017: 1 critical, 1 high. 1 is now in CISA KEV.
- Published
- 57
- Critical
- 1
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 55
- Now in CISA KEV
- 1
- Fix available
- 4
Most affected products
- com.squareup.okhttp3:okhttp
- 1
- moin
- 1
- openssl
- 1
- salt
- 1
Critical 1
High 1
Medium, low and unrated 55
- CVE-2015-2180The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metachara
- CVE-2015-2181Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified i
- CVE-2015-7331The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --s
- CVE-2015-8034The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive informasalt
- CVE-2016-10087The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.
- CVE-2016-2217The OpenSSL address implementation in Socat 1.7.3.0 and 2.0.0-b8 does not use a prime number for the DH, which makes it easier for remote at
- CVE-2016-2399Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of servic
- CVE-2016-2402OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain witcom.squareup.okhttp3:okhttp
- CVE-2016-5026hs.py in OnionShare before 0.9.1 allows local users to modify the hiddenservice by pre-creating the /tmp/onionshare directory.
- CVE-2016-5434libalpm, as used in pacman 5.0.1, allows remote attackers to cause a denial of service (infinite loop or out-of-bounds read) via a crafted s
- CVE-2016-6167Multiple untrusted search path vulnerabilities in Putty beta 0.67 allow local users to execute arbitrary code and conduct DLL hijacking atta
- CVE-2016-6266ccca_ajaxhandler.php in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows r
- CVE-2016-6267SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authe
- CVE-2016-6268Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows local webserv users to ex
- CVE-2016-6269Multiple directory traversal vulnerabilities in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 be
- CVE-2016-6270The handle_certificate function in /vmi/manager/engine/management/commands/apns_worker.py in Trend Micro Virtual Mobile Infrastructure befor
- CVE-2016-6604NULL pointer dereference in Samsung Exynos fimg2d driver for Android L(5.0/5.1) and M(6.0) allows attackers to have unspecified impact via u
- CVE-2016-7798The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it openssl
- CVE-2016-9119Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitmoin
- CVE-2016-9132In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be co
- CVE-2015-7973NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks
- CVE-2015-7975The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, which allows an attac
- CVE-2015-7976The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters,
- CVE-2015-7977ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntp
- CVE-2015-7978NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist com
- CVE-2015-7979NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sen
- CVE-2015-8138NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin tim
- CVE-2015-8139ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors.
- CVE-2015-8140The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.
- CVE-2015-8158The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service
- CVE-2016-2516NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by usin
- CVE-2016-2517NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by lever
- CVE-2016-2518The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference v
- CVE-2016-2519ntpd in NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (ntpd abort) by a large request data
- CVE-2016-7544Crypto++ 5.6.4 incorrectly uses Microsoft's stack-based _malloca and _freea functions.
- CVE-2016-9939Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine.
- CVE-2017-5572An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0.
- CVE-2017-5573An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0.
- CVE-2016-10175The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI.
- CVE-2016-10176The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the dev
- CVE-2016-10177An issue was discovered on the D-Link DWR-932B router.
- CVE-2016-10178An issue was discovered on the D-Link DWR-932B router.
- CVE-2016-10179An issue was discovered on the D-Link DWR-932B router.
- CVE-2016-10181An issue was discovered on the D-Link DWR-932B router.
- CVE-2016-10182An issue was discovered on the D-Link DWR-932B router.
- CVE-2016-10183An issue was discovered on the D-Link DWR-932B router.
- CVE-2016-10184An issue was discovered on the D-Link DWR-932B router.
- CVE-2016-10185An issue was discovered on the D-Link DWR-932B router.
- CVE-2016-10186An issue was discovered on the D-Link DWR-932B router.
- CVE-2017-5610wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assign
- CVE-2017-5611SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbit
- CVE-2017-5612Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.
- CVE-2017-5627An issue was discovered in Artifex Software, Inc.
- CVE-2017-5628An issue was discovered in Artifex Software, Inc.
- CVE-2017-5632An issue was discovered on the ASUS RT-N56U Wireless Router with Firmware 3.0.0.4.374_979.