CVEs published January 2, 2018
40 CVEs were published on January 2, 2018: 0 critical, 0 high.
- Published
- 40
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 40
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Schneider Electric SE Pelco VideoXpert Enterprise
- 3
- base64
- 1
- com.liferay.portal:release.portal.bom
- 1
- electron
- 1
- ezsystems/ezpublish-legacy
- 1
- fs-git
- 1
- github.com/syncthing/syncthing
- 1
- IBM MQ
- 1
- mapproxy
- 1
- marked
- 1
Medium, low and unrated 40
- CVE-2017-1000425Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers tcom.liferay.portal:release.portal.bom
- CVE-2017-1000427marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.marked
- CVE-2017-1000432Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access
- CVE-2017-1000433pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled.pysaml2
- CVE-2017-1000434Wordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect parameter on a page allows for a redirect to
- CVE-2017-1000437Creolabs Gravity 1.0 contains a stack based buffer overflow in the operator_string_add function, resulting in remote code execution.
- CVE-2017-1000438In OMERO 5.3.3 or earlier a user could create an OriginalFile and adjust its path such that it now points to another user's file on the unde
- CVE-2017-1000426MapProxy version 1.10.3 and older is vulnerable to a Cross Site Scripting attack in the demo service resulting in possible information disclmapproxy
- CVE-2017-1000422Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and p
- CVE-2017-1000423b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resu
- CVE-2017-1000424Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loadielectron
- CVE-2017-1000430rust-base64 version <= 0.5.1 is vulnerable to a buffer overflow when calculating the size of a buffer to use when encoding base64 using the base64
- CVE-2017-1000431eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk ezsystems/ezpublish-legacy
- CVE-2017-1000419phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting phpbb/phpbb
- CVE-2017-1000420Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwritegithub.com/syncthing/syncthing
- CVE-2017-1000421Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function resulting potential code execution
- CVE-2017-1000418The WildMidi_Open function in WildMIDI since commit d8a466829c67cacbb1700beded25c448d99514e5 allows remote attackers to cause a denial of se
- CVE-2017-1000456freedesktop.org libpoppler 0.60.1 fails to validate boundaries in TextPool::addWord, leading to overflow in subsequent calculations.
- CVE-2017-1000457Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script o
- CVE-2017-1000458Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of ser
- CVE-2017-1000412Linaro's open source TEE solution called OP-TEE, version 2.4.0 (and older) is vulnerable to the bellcore attack in the LibTomCrypt code resu
- CVE-2017-1000413Linaro's open source TEE solution called OP-TEE, version 2.4.0 (and older) is vulnerable a timing attack in the Montgomery parts of libMPA i
- CVE-2017-1000448Structured Data Linter versions 2.4.1 and older are vulnerable to a directory traversal attack in the URL input field resulting in the possi
- CVE-2017-1000450In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer oopencv-contrib-python · opencv-python
- CVE-2017-1000451fs-git is a file system like api for git repository.fs-git
- CVE-2017-1000452An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers tosamlify
- CVE-2017-1000453CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP c
- CVE-2017-1000454CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2
- CVE-2017-1000455GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links incorrectly, leading the creation of setuid execut
- CVE-2017-1557IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user with authority to send a specially crafted request that could cause a channelIBM MQ
- CVE-2017-1000444Eleix Openhacker version 0.1.47 is vulnerable to an SQL injection in the account registration and login component resulting in information d
- CVE-2017-1000445ImageMagick 7.0.7-1 and older version are vulnerable to null pointer dereference in the MagickCore component and might lead to denial of ser
- CVE-2017-17097gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthentica
- CVE-2017-17098The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject a
- CVE-2017-1000442Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspacepassbolt/passbolt_api
- CVE-2017-1000443Eleix Openhacker version 0.1.47 is vulnerable to a XSS vulnerability in the bank transactions component resulting in arbitrary code executio
- CVE-2017-18015The ILLID Share This Image plugin before 1.04 for WordPress has XSS via the sharer.php url parameter.
- CVE-2017-9964A Path Traversal issue was discovered in Schneider Electric Pelco VideoXpert Enterprise all versions prior to 2.1.Schneider Electric SE Pelco VideoXpert Enterprise
- CVE-2017-9965An exposure of sensitive information vulnerability exists in Schneider Electric's Pelco VideoXpert Enterprise versions 2.0 and prior.Schneider Electric SE Pelco VideoXpert Enterprise
- CVE-2017-9966A privilege escalation vulnerability exists in Schneider Electric's Pelco VideoXpert Enterprise versions 2.0 and prior.Schneider Electric SE Pelco VideoXpert Enterprise