CVEs published January 1, 2018
11 CVEs were published on January 1, 2018: 0 critical, 0 high.
- Published
- 11
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- craftcms/cms
- 1
- opencv-python · opencv-contrib-python
- 1
Medium, low and unrated 11
- CVE-2018-3813getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0 4.1.53.166 has Incorrect Access Control, as demonstrated by reading the AVI_USE
- CVE-2018-3814Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace itcraftcms/cms
- CVE-2017-18008In ImageMagick 7.0.7-17 Q16, there is a Memory Leak in ReadPWPImage in coders/pwp.c.
- CVE-2017-18009In OpenCV 3.3.1, a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp.opencv-python · opencv-contrib-python
- CVE-2017-18010The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form
- CVE-2017-18011The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the text_ads_ajax.php border_color parameter
- CVE-2017-18012The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter.
- CVE-2017-18013In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.
- CVE-2018-3810Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attacker
- CVE-2018-3811SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to exe
- CVE-2017-18006netpub/server.np in Extensis Portfolio NetPublish has XSS in the quickfind parameter, aka Open Bug Bounty ID OBB-290447.