# CVEs published 2018-01-01

11 CVEs were published on January 1, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-3813](https://cve.now/CVE-2018-3813.md): getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0 4.1.53.166 has Incorrect Access Control, as demonstrated by reading the AVI\_USE (no CVSS)
- [CVE-2018-3814](https://cve.now/CVE-2018-3814.md): Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets-\>Upload files" screen and then the "Replace it (no CVSS, craftcms/cms)
- [CVE-2017-18008](https://cve.now/CVE-2017-18008.md): In ImageMagick 7.0.7-17 Q16, there is a Memory Leak in ReadPWPImage in coders/pwp.c. (no CVSS)
- [CVE-2017-18009](https://cve.now/CVE-2017-18009.md): In OpenCV 3.3.1, a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt\_hdr.cpp. (no CVSS, opencv-python · opencv-contrib-python)
- [CVE-2017-18010](https://cve.now/CVE-2017-18010.md): The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form (no CVSS)
- [CVE-2017-18011](https://cve.now/CVE-2017-18011.md): The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the text\_ads\_ajax.php border\_color parameter (no CVSS)
- [CVE-2017-18012](https://cve.now/CVE-2017-18012.md): The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter. (no CVSS)
- [CVE-2017-18013](https://cve.now/CVE-2017-18013.md): In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif\_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash. (no CVSS)
- [CVE-2018-3810](https://cve.now/CVE-2018-3810.md): Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attacker (no CVSS)
- [CVE-2018-3811](https://cve.now/CVE-2018-3811.md): SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to exe (no CVSS)
- [CVE-2017-18006](https://cve.now/CVE-2017-18006.md): netpub/server.np in Extensis Portfolio NetPublish has XSS in the quickfind parameter, aka Open Bug Bounty ID OBB-290447. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.