# CVEs published 2018-01-02

40 CVEs were published on January 2, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2017-1000425](https://cve.now/CVE-2017-1000425.md): Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers t (no CVSS, com.liferay.portal:release.portal.bom)
- [CVE-2017-1000427](https://cve.now/CVE-2017-1000427.md): marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser. (no CVSS, marked)
- [CVE-2017-1000432](https://cve.now/CVE-2017-1000432.md): Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access (no CVSS)
- [CVE-2017-1000433](https://cve.now/CVE-2017-1000433.md): pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. (no CVSS, pysaml2)
- [CVE-2017-1000434](https://cve.now/CVE-2017-1000434.md): Wordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect parameter on a page allows for a redirect to (no CVSS)
- [CVE-2017-1000437](https://cve.now/CVE-2017-1000437.md): Creolabs Gravity 1.0 contains a stack based buffer overflow in the operator\_string\_add function, resulting in remote code execution. (no CVSS)
- [CVE-2017-1000438](https://cve.now/CVE-2017-1000438.md): In OMERO 5.3.3 or earlier a user could create an OriginalFile and adjust its path such that it now points to another user's file on the unde (no CVSS)
- [CVE-2017-1000426](https://cve.now/CVE-2017-1000426.md): MapProxy version 1.10.3 and older is vulnerable to a Cross Site Scripting attack in the demo service resulting in possible information discl (no CVSS, mapproxy)
- [CVE-2017-1000422](https://cve.now/CVE-2017-1000422.md): Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif\_get\_lzw function resulting in memory corruption and p (no CVSS)
- [CVE-2017-1000423](https://cve.now/CVE-2017-1000423.md): b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resu (no CVSS)
- [CVE-2017-1000424](https://cve.now/CVE-2017-1000424.md): Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loadi (no CVSS, electron)
- [CVE-2017-1000430](https://cve.now/CVE-2017-1000430.md): rust-base64 version \<= 0.5.1 is vulnerable to a buffer overflow when calculating the size of a buffer to use when encoding base64 using the (no CVSS, base64)
- [CVE-2017-1000431](https://cve.now/CVE-2017-1000431.md): eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk (no CVSS, ezsystems/ezpublish-legacy)
- [CVE-2017-1000419](https://cve.now/CVE-2017-1000419.md): phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting (no CVSS, phpbb/phpbb)
- [CVE-2017-1000420](https://cve.now/CVE-2017-1000420.md): Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite (no CVSS, github.com/syncthing/syncthing)
- [CVE-2017-1000421](https://cve.now/CVE-2017-1000421.md): Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read\_gif function resulting potential code execution (no CVSS)
- [CVE-2017-1000418](https://cve.now/CVE-2017-1000418.md): The WildMidi\_Open function in WildMIDI since commit d8a466829c67cacbb1700beded25c448d99514e5 allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2017-1000456](https://cve.now/CVE-2017-1000456.md): freedesktop.org libpoppler 0.60.1 fails to validate boundaries in TextPool::addWord, leading to overflow in subsequent calculations. (no CVSS)
- [CVE-2017-1000457](https://cve.now/CVE-2017-1000457.md): Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2017-1000458](https://cve.now/CVE-2017-1000458.md): Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of ser (no CVSS)
- [CVE-2017-1000412](https://cve.now/CVE-2017-1000412.md): Linaro's open source TEE solution called OP-TEE, version 2.4.0 (and older) is vulnerable to the bellcore attack in the LibTomCrypt code resu (no CVSS)
- [CVE-2017-1000413](https://cve.now/CVE-2017-1000413.md): Linaro's open source TEE solution called OP-TEE, version 2.4.0 (and older) is vulnerable a timing attack in the Montgomery parts of libMPA i (no CVSS)
- [CVE-2017-1000448](https://cve.now/CVE-2017-1000448.md): Structured Data Linter versions 2.4.1 and older are vulnerable to a directory traversal attack in the URL input field resulting in the possi (no CVSS)
- [CVE-2017-1000450](https://cve.now/CVE-2017-1000450.md): In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer o (no CVSS, opencv-contrib-python · opencv-python)
- [CVE-2017-1000451](https://cve.now/CVE-2017-1000451.md): fs-git is a file system like api for git repository. (no CVSS, fs-git)
- [CVE-2017-1000452](https://cve.now/CVE-2017-1000452.md): An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to (no CVSS, samlify)
- [CVE-2017-1000453](https://cve.now/CVE-2017-1000453.md): CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP c (no CVSS)
- [CVE-2017-1000454](https://cve.now/CVE-2017-1000454.md): CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2 (no CVSS)
- [CVE-2017-1000455](https://cve.now/CVE-2017-1000455.md): GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links incorrectly, leading the creation of setuid execut (no CVSS)
- [CVE-2017-1557](https://cve.now/CVE-2017-1557.md): IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user with authority to send a specially crafted request that could cause a channel (no CVSS, IBM MQ)
- [CVE-2017-1000444](https://cve.now/CVE-2017-1000444.md): Eleix Openhacker version 0.1.47 is vulnerable to an SQL injection in the account registration and login component resulting in information d (no CVSS)
- [CVE-2017-1000445](https://cve.now/CVE-2017-1000445.md): ImageMagick 7.0.7-1 and older version are vulnerable to null pointer dereference in the MagickCore component and might lead to denial of ser (no CVSS)
- [CVE-2017-17097](https://cve.now/CVE-2017-17097.md): gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthentica (no CVSS)
- [CVE-2017-17098](https://cve.now/CVE-2017-17098.md): The writeLog function in fn\_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject a (no CVSS)
- [CVE-2017-1000442](https://cve.now/CVE-2017-1000442.md): Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace (no CVSS, passbolt/passbolt\_api)
- [CVE-2017-1000443](https://cve.now/CVE-2017-1000443.md): Eleix Openhacker version 0.1.47 is vulnerable to a XSS vulnerability in the bank transactions component resulting in arbitrary code executio (no CVSS)
- [CVE-2017-18015](https://cve.now/CVE-2017-18015.md): The ILLID Share This Image plugin before 1.04 for WordPress has XSS via the sharer.php url parameter. (no CVSS)
- [CVE-2017-9964](https://cve.now/CVE-2017-9964.md): A Path Traversal issue was discovered in Schneider Electric Pelco VideoXpert Enterprise all versions prior to 2.1. (no CVSS, Schneider Electric SE Pelco VideoXpert Enterprise)
- [CVE-2017-9965](https://cve.now/CVE-2017-9965.md): An exposure of sensitive information vulnerability exists in Schneider Electric's Pelco VideoXpert Enterprise versions 2.0 and prior. (no CVSS, Schneider Electric SE Pelco VideoXpert Enterprise)
- [CVE-2017-9966](https://cve.now/CVE-2017-9966.md): A privilege escalation vulnerability exists in Schneider Electric's Pelco VideoXpert Enterprise versions 2.0 and prior. (no CVSS, Schneider Electric SE Pelco VideoXpert Enterprise)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.