CVEs published January 3, 2018
57 CVEs were published on January 3, 2018: 1 critical, 0 high. 1 is now in CISA KEV.
- Published
- 57
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 56
- Now in CISA KEV
- 1
- Fix available
- 15
Most affected products
- mautic/core
- 3
- plone
- 2
- products-cmfplone · plone
- 2
- cobbler
- 1
- com.caverock:androidsvg
- 1
- desperado/xml-bundle
- 1
- lavalite/cms
- 1
- org.codehaus.plexus:plexus-utils
- 1
- org.primefaces:primefaces
- 1
- phpmyadmin/phpmyadmin
- 1
Critical 1
Medium, low and unrated 56
- CVE-2018-5079In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie
- CVE-2018-5080In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie
- CVE-2018-5081In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie
- CVE-2018-5082In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie
- CVE-2018-5083In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie
- CVE-2018-5084In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie
- CVE-2018-5085In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie
- CVE-2018-5086In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie
- CVE-2018-5087In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie
- CVE-2018-5088In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie
- CVE-2017-1000460In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), the return value of init_get_bits is ign
- CVE-2017-1000461Brave Software's Brave Browser, version 0.19.73 (and earlier) is vulnerable to an incorrect access control issue in the "JS fingerprinting b
- CVE-2017-1000462BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of serv
- CVE-2017-1000469Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execucobbler
- CVE-2017-1000470EmbedThis GoAhead Webserver versions 4.0.0 and earlier is vulnerable to an integer overflow in the HTTP listener resulting in denial of serv
- CVE-2017-1000471EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or d
- CVE-2017-1000472The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename valu
- CVE-2017-1000473Linux Dash up to version v2 is vulnerable to multiple command injection vulnerabilities in the way module names are parsed and then executed
- CVE-2017-1000484By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website.plone
- CVE-2017-1000485Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information
- CVE-2017-1000487Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.org.codehaus.plexus:plexus-utils
- CVE-2018-5072Online Ticket Booking has XSS via the admin/sitesettings.php keyword parameter.
- CVE-2018-5073Online Ticket Booking has CSRF via admin/movieedit.php.
- CVE-2018-5074Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter.
- CVE-2018-5075Online Ticket Booking has XSS via the admin/snacks_edit.php snacks_name parameter.
- CVE-2018-5076Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter.
- CVE-2018-5077Online Ticket Booking has XSS via the admin/movieedit.php moviename parameter.
- CVE-2018-5078Online Ticket Booking has XSS via the admin/eventlist.php cast parameter.
- CVE-2017-1000476ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allows attackers to ca
- CVE-2017-1000477XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result in denial of service attacks.desperado/xml-bundle
- CVE-2017-1000478ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of Jav
- CVE-2017-1000479pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrar
- CVE-2017-1000480Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not ssmarty/smarty
- CVE-2017-1000481When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previousproducts-cmfplone · plone
- CVE-2017-1000482A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor cproducts-cmfplone · plone
- CVE-2017-1000483Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1.plone
- CVE-2017-1000489Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email addressmautic/core
- CVE-2017-1000490Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanmautic/core
- CVE-2017-1000488Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parametersmautic/core
- CVE-2017-1000467LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruplavalite/cms
- CVE-2017-1000501Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in
- CVE-2017-1000494Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd < 2.0 allows an attacker to cause Denial
- CVE-2017-1000495QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and pequickapps/cms
- CVE-2017-1000496Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality resulting in denial of service and possibly remo
- CVE-2017-1000497Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting in denial of service and possibly remote cod
- CVE-2017-1000498AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code ecom.caverock:androidsvg
- CVE-2017-1000499phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness.phpmyadmin/phpmyadmin
- CVE-2018-4862In Octopus Deploy versions 3.2.11 - 4.1.5 (fixed in 4.1.6), an authenticated user with ProcessEdit permission could reference an Azure accou
- CVE-2018-4868The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers to cause a denial of service (excessive mem
- CVE-2017-18017The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attac
- CVE-2017-1000466Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result i
- CVE-2017-1000491Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.shiba
- CVE-2017-1000492Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration
- CVE-2017-1000493Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeover
- CVE-2017-1000459Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes
- CVE-2017-1000463Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within the edit blog post page, which can result in