# CVEs published 2017-01-31

48 CVEs were published on January 31, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2015-8973](https://cve.now/CVE-2015-8973.md): xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to (no CVSS)
- [CVE-2015-8974](https://cve.now/CVE-2015-8974.md): SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x (no CVSS)
- [CVE-2015-8975](https://cve.now/CVE-2015-8975.md): Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Me (no CVSS)
- [CVE-2015-8976](https://cve.now/CVE-2015-8976.md): Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8 (no CVSS)
- [CVE-2015-8977](https://cve.now/CVE-2015-8977.md): MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the inst (no CVSS)
- [CVE-2016-6285](https://cve.now/CVE-2016-6285.md): Cross-site scripting (XSS) vulnerability in includes/decorators/global-translations.jsp in Atlassian JIRA before 7.2.2 allows remote attacke (no CVSS)
- [CVE-2016-6329](https://cve.now/CVE-2016-6329.md): OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a lon (no CVSS)
- [CVE-2016-8685](https://cve.now/CVE-2016-8685.md): The findnext function in decompose.c in potrace 1.13 allows remote attackers to cause a denial of service (invalid memory access and crash) (no CVSS)
- [CVE-2016-8686](https://cve.now/CVE-2016-8686.md): The bm\_new function in bitmap.h in potrace 1.13 allows remote attackers to have unspecified impact via a crafted image, which triggers a mem (no CVSS)
- [CVE-2016-8694](https://cve.now/CVE-2016-8694.md): The bm\_readbody\_bmp function in bitmap\_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer derefe (no CVSS)
- [CVE-2016-8695](https://cve.now/CVE-2016-8695.md): The bm\_readbody\_bmp function in bitmap\_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer derefe (no CVSS)
- [CVE-2016-8696](https://cve.now/CVE-2016-8696.md): The bm\_readbody\_bmp function in bitmap\_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer derefe (no CVSS)
- [CVE-2016-8697](https://cve.now/CVE-2016-8697.md): The bm\_new function in bitmap.h in potrace before 1.13 allows remote attackers to cause a denial of service (divide-by-zero error and crash) (no CVSS)
- [CVE-2016-8698](https://cve.now/CVE-2016-8698.md): Heap-based buffer overflow in the bm\_readbody\_bmp function in bitmap\_io.c in potrace before 1.13 allows remote attackers to have unspecified (no CVSS)
- [CVE-2016-8699](https://cve.now/CVE-2016-8699.md): Heap-based buffer overflow in the bm\_readbody\_bmp function in bitmap\_io.c in potrace before 1.13 allows remote attackers to have unspecified (no CVSS)
- [CVE-2016-8700](https://cve.now/CVE-2016-8700.md): Heap-based buffer overflow in the bm\_readbody\_bmp function in bitmap\_io.c in potrace before 1.13 allows remote attackers to have unspecified (no CVSS)
- [CVE-2016-8701](https://cve.now/CVE-2016-8701.md): Heap-based buffer overflow in the bm\_readbody\_bmp function in bitmap\_io.c in potrace before 1.13 allows remote attackers to have unspecified (no CVSS)
- [CVE-2016-8702](https://cve.now/CVE-2016-8702.md): Heap-based buffer overflow in the bm\_readbody\_bmp function in bitmap\_io.c in potrace before 1.13 allows remote attackers to have unspecified (no CVSS)
- [CVE-2016-8703](https://cve.now/CVE-2016-8703.md): Heap-based buffer overflow in the bm\_readbody\_bmp function in bitmap\_io.c in potrace before 1.13 allows remote attackers to have unspecified (no CVSS)
- [CVE-2016-9260](https://cve.now/CVE-2016-9260.md): Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9 allows remote authenticated users to inject arbitrary web script or HT (no CVSS)
- [CVE-2016-9402](https://cve.now/CVE-2016-9402.md): SQL injection vulnerability in the moderation tool in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow (no CVSS)
- [CVE-2016-9403](https://cve.now/CVE-2016-9403.md): newreply.php in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impac (no CVSS)
- [CVE-2016-9404](https://cve.now/CVE-2016-9404.md): Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote at (no CVSS)
- [CVE-2016-9405](https://cve.now/CVE-2016-9405.md): Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 (no CVSS)
- [CVE-2016-9406](https://cve.now/CVE-2016-9406.md): Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1 (no CVSS)
- [CVE-2016-9407](https://cve.now/CVE-2016-9407.md): Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote at (no CVSS)
- [CVE-2016-9408](https://cve.now/CVE-2016-9408.md): Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1. (no CVSS)
- [CVE-2016-9409](https://cve.now/CVE-2016-9409.md): Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before (no CVSS)
- [CVE-2016-9410](https://cve.now/CVE-2016-9410.md): MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database informa (no CVSS)
- [CVE-2016-9411](https://cve.now/CVE-2016-9411.md): The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the (no CVSS)
- [CVE-2016-9412](https://cve.now/CVE-2016-9412.md): MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to (no CVSS)
- [CVE-2016-9413](https://cve.now/CVE-2016-9413.md): The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct cli (no CVSS)
- [CVE-2016-9414](https://cve.now/CVE-2016-9414.md): MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leverag (no CVSS)
- [CVE-2016-9415](https://cve.now/CVE-2016-9415.md): MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitra (no CVSS)
- [CVE-2016-9416](https://cve.now/CVE-2016-9416.md): SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows r (no CVSS)
- [CVE-2016-9417](https://cve.now/CVE-2016-9417.md): The fetch\_remote\_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to cond (no CVSS)
- [CVE-2016-9418](https://cve.now/CVE-2016-9418.md): MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sens (no CVSS)
- [CVE-2016-9419](https://cve.now/CVE-2016-9419.md): Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before (no CVSS)
- [CVE-2016-9420](https://cve.now/CVE-2016-9420.md): MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors rel (no CVSS)
- [CVE-2016-9421](https://cve.now/CVE-2016-9421.md): Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB (no CVSS)
- [CVE-2016-9962](https://cve.now/CVE-2016-9962.md): RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. (no CVSS, github.com/opencontainers/runc)
- [CVE-2016-9039](https://cve.now/CVE-2016-9039.md): An exploitable denial of service exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. (CVSS 6.2, Joyent SmartOS)
- [CVE-2016-2050](https://cve.now/CVE-2016-2050.md): The get\_abbrev\_array\_info function in libdwarf-20151114 allows remote attackers to cause a denial of service (out-of-bounds write) via a cra (no CVSS)
- [CVE-2016-3176](https://cve.now/CVE-2016-3176.md): Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured a (no CVSS, salt)
- [CVE-2016-5117](https://cve.now/CVE-2016-5117.md): OpenNTPD before 6.0p1 does not validate the CN for HTTPS constraint requests, which allows remote attackers to bypass the man-in-the-middle (no CVSS)
- [CVE-2016-6621](https://cve.now/CVE-2016-6621.md): The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-s (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2016-10043](https://cve.now/CVE-2016-10043.md): An issue was discovered in Radisys MRF Web Panel (SWMS) 9.0.1. (no CVSS)
- [CVE-2016-9249](https://cve.now/CVE-2016-9249.md): An undisclosed traffic pattern received by a BIG-IP Virtual Server with TCP Fast Open enabled may cause the Traffic Management Microkernel ( (no CVSS, F5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, D…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-01-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.