# CVEs published 2017-01-30

57 CVEs were published on January 30, 2017: 1 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2015-2180](https://cve.now/CVE-2015-2180.md): The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metachara (no CVSS)
- [CVE-2015-2181](https://cve.now/CVE-2015-2181.md): Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified i (no CVSS)
- [CVE-2015-7331](https://cve.now/CVE-2015-7331.md): The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --s (no CVSS)
- [CVE-2015-8034](https://cve.now/CVE-2015-8034.md): The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive informa (no CVSS, salt)
- [CVE-2016-10087](https://cve.now/CVE-2016-10087.md): The png\_set\_text\_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1. (no CVSS)
- [CVE-2016-2217](https://cve.now/CVE-2016-2217.md): The OpenSSL address implementation in Socat 1.7.3.0 and 2.0.0-b8 does not use a prime number for the DH, which makes it easier for remote at (no CVSS)
- [CVE-2016-2399](https://cve.now/CVE-2016-2399.md): Integer overflow in the quicktime\_read\_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2016-2402](https://cve.now/CVE-2016-2402.md): OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain wit (no CVSS, com.squareup.okhttp3:okhttp)
- [CVE-2016-5026](https://cve.now/CVE-2016-5026.md): hs.py in OnionShare before 0.9.1 allows local users to modify the hiddenservice by pre-creating the /tmp/onionshare directory. (no CVSS)
- [CVE-2016-5434](https://cve.now/CVE-2016-5434.md): libalpm, as used in pacman 5.0.1, allows remote attackers to cause a denial of service (infinite loop or out-of-bounds read) via a crafted s (no CVSS)
- [CVE-2016-6167](https://cve.now/CVE-2016-6167.md): Multiple untrusted search path vulnerabilities in Putty beta 0.67 allow local users to execute arbitrary code and conduct DLL hijacking atta (no CVSS)
- [CVE-2016-6266](https://cve.now/CVE-2016-6266.md): ccca\_ajaxhandler.php in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows r (no CVSS)
- [CVE-2016-6267](https://cve.now/CVE-2016-6267.md): SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authe (no CVSS)
- [CVE-2016-6268](https://cve.now/CVE-2016-6268.md): Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows local webserv users to ex (no CVSS)
- [CVE-2016-6269](https://cve.now/CVE-2016-6269.md): Multiple directory traversal vulnerabilities in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 be (no CVSS)
- [CVE-2016-6270](https://cve.now/CVE-2016-6270.md): The handle\_certificate function in /vmi/manager/engine/management/commands/apns\_worker.py in Trend Micro Virtual Mobile Infrastructure befor (no CVSS)
- [CVE-2016-6604](https://cve.now/CVE-2016-6604.md): NULL pointer dereference in Samsung Exynos fimg2d driver for Android L(5.0/5.1) and M(6.0) allows attackers to have unspecified impact via u (no CVSS)
- [CVE-2016-7798](https://cve.now/CVE-2016-7798.md): The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-\*-gcm) when the IV is set before the key, which makes it (no CVSS, openssl)
- [CVE-2016-9119](https://cve.now/CVE-2016-9119.md): Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbit (no CVSS, moin)
- [CVE-2016-9132](https://cve.now/CVE-2016-9132.md): In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be co (no CVSS)
- [CVE-2015-7973](https://cve.now/CVE-2015-7973.md): NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks (no CVSS)
- [CVE-2015-7975](https://cve.now/CVE-2015-7975.md): The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, which allows an attac (no CVSS)
- [CVE-2015-7976](https://cve.now/CVE-2015-7976.md): The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, (no CVSS)
- [CVE-2015-7977](https://cve.now/CVE-2015-7977.md): ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntp (no CVSS)
- [CVE-2015-7978](https://cve.now/CVE-2015-7978.md): NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist com (no CVSS)
- [CVE-2015-7979](https://cve.now/CVE-2015-7979.md): NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sen (no CVSS)
- [CVE-2015-8138](https://cve.now/CVE-2015-8138.md): NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin tim (no CVSS)
- [CVE-2015-8139](https://cve.now/CVE-2015-8139.md): ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors. (no CVSS)
- [CVE-2015-8140](https://cve.now/CVE-2015-8140.md): The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network. (no CVSS)
- [CVE-2015-8158](https://cve.now/CVE-2015-8158.md): The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2016-2516](https://cve.now/CVE-2016-2516.md): NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by usin (no CVSS)
- [CVE-2016-2517](https://cve.now/CVE-2016-2517.md): NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by lever (no CVSS)
- [CVE-2016-2518](https://cve.now/CVE-2016-2518.md): The MATCH\_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference v (no CVSS)
- [CVE-2016-2519](https://cve.now/CVE-2016-2519.md): ntpd in NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (ntpd abort) by a large request data (no CVSS)
- [CVE-2016-7544](https://cve.now/CVE-2016-7544.md): Crypto++ 5.6.4 incorrectly uses Microsoft's stack-based \_malloca and \_freea functions. (no CVSS)
- [CVE-2016-9939](https://cve.now/CVE-2016-9939.md): Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. (no CVSS)
- [CVE-2017-5572](https://cve.now/CVE-2017-5572.md): An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. (no CVSS)
- [CVE-2017-5573](https://cve.now/CVE-2017-5573.md): An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. (no CVSS)
- [CVE-2016-10174](https://cve.now/CVE-2016-10174.md): The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden\_lang\_avi parameter when invoking the URL /apply.cgi?/lang\_check.html. (CVSS 9.8, KEV)
- [CVE-2016-10175](https://cve.now/CVE-2016-10175.md): The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS\_netgear\_success.html URI. (no CVSS)
- [CVE-2016-10176](https://cve.now/CVE-2016-10176.md): The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the dev (no CVSS)
- [CVE-2016-10177](https://cve.now/CVE-2016-10177.md): An issue was discovered on the D-Link DWR-932B router. (no CVSS)
- [CVE-2016-10178](https://cve.now/CVE-2016-10178.md): An issue was discovered on the D-Link DWR-932B router. (no CVSS)
- [CVE-2016-10179](https://cve.now/CVE-2016-10179.md): An issue was discovered on the D-Link DWR-932B router. (no CVSS)
- [CVE-2016-10180](https://cve.now/CVE-2016-10180.md): An issue was discovered on the D-Link DWR-932B router. (CVSS 7.5)
- [CVE-2016-10181](https://cve.now/CVE-2016-10181.md): An issue was discovered on the D-Link DWR-932B router. (no CVSS)
- [CVE-2016-10182](https://cve.now/CVE-2016-10182.md): An issue was discovered on the D-Link DWR-932B router. (no CVSS)
- [CVE-2016-10183](https://cve.now/CVE-2016-10183.md): An issue was discovered on the D-Link DWR-932B router. (no CVSS)
- [CVE-2016-10184](https://cve.now/CVE-2016-10184.md): An issue was discovered on the D-Link DWR-932B router. (no CVSS)
- [CVE-2016-10185](https://cve.now/CVE-2016-10185.md): An issue was discovered on the D-Link DWR-932B router. (no CVSS)
- [CVE-2016-10186](https://cve.now/CVE-2016-10186.md): An issue was discovered on the D-Link DWR-932B router. (no CVSS)
- [CVE-2017-5610](https://cve.now/CVE-2017-5610.md): wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assign (no CVSS)
- [CVE-2017-5611](https://cve.now/CVE-2017-5611.md): SQL injection vulnerability in wp-includes/class-wp-query.php in WP\_Query in WordPress before 4.7.2 allows remote attackers to execute arbit (no CVSS)
- [CVE-2017-5612](https://cve.now/CVE-2017-5612.md): Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7. (no CVSS)
- [CVE-2017-5627](https://cve.now/CVE-2017-5627.md): An issue was discovered in Artifex Software, Inc. (no CVSS)
- [CVE-2017-5628](https://cve.now/CVE-2017-5628.md): An issue was discovered in Artifex Software, Inc. (no CVSS)
- [CVE-2017-5632](https://cve.now/CVE-2017-5632.md): An issue was discovered on the ASUS RT-N56U Wireless Router with Firmware 3.0.0.4.374\_979. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-01-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.