# CVEs published 2018-01-03

57 CVEs were published on January 3, 2018: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2018-5079](https://cve.now/CVE-2018-5079.md): In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie (no CVSS)
- [CVE-2018-5080](https://cve.now/CVE-2018-5080.md): In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie (no CVSS)
- [CVE-2018-5081](https://cve.now/CVE-2018-5081.md): In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie (no CVSS)
- [CVE-2018-5082](https://cve.now/CVE-2018-5082.md): In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie (no CVSS)
- [CVE-2018-5083](https://cve.now/CVE-2018-5083.md): In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie (no CVSS)
- [CVE-2018-5084](https://cve.now/CVE-2018-5084.md): In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie (no CVSS)
- [CVE-2018-5085](https://cve.now/CVE-2018-5085.md): In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie (no CVSS)
- [CVE-2018-5086](https://cve.now/CVE-2018-5086.md): In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie (no CVSS)
- [CVE-2018-5087](https://cve.now/CVE-2018-5087.md): In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie (no CVSS)
- [CVE-2018-5088](https://cve.now/CVE-2018-5088.md): In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie (no CVSS)
- [CVE-2017-1000460](https://cve.now/CVE-2017-1000460.md): In line libavcodec/h264dec.c:500 in libav(v13\_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), the return value of init\_get\_bits is ign (no CVSS)
- [CVE-2017-1000461](https://cve.now/CVE-2017-1000461.md): Brave Software's Brave Browser, version 0.19.73 (and earlier) is vulnerable to an incorrect access control issue in the "JS fingerprinting b (no CVSS)
- [CVE-2017-1000462](https://cve.now/CVE-2017-1000462.md): BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of serv (no CVSS)
- [CVE-2017-1000469](https://cve.now/CVE-2017-1000469.md): Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execu (no CVSS, cobbler)
- [CVE-2017-1000470](https://cve.now/CVE-2017-1000470.md): EmbedThis GoAhead Webserver versions 4.0.0 and earlier is vulnerable to an integer overflow in the HTTP listener resulting in denial of serv (no CVSS)
- [CVE-2017-1000471](https://cve.now/CVE-2017-1000471.md): EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or d (no CVSS)
- [CVE-2017-1000472](https://cve.now/CVE-2017-1000472.md): The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename valu (no CVSS)
- [CVE-2017-1000473](https://cve.now/CVE-2017-1000473.md): Linux Dash up to version v2 is vulnerable to multiple command injection vulnerabilities in the way module names are parsed and then executed (no CVSS)
- [CVE-2017-1000484](https://cve.now/CVE-2017-1000484.md): By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. (no CVSS, plone)
- [CVE-2017-1000485](https://cve.now/CVE-2017-1000485.md): Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information (no CVSS)
- [CVE-2017-1000486](https://cve.now/CVE-2017-1000486.md): Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution (CVSS 9.8, KEV, org.primefaces:primefaces)
- [CVE-2017-1000487](https://cve.now/CVE-2017-1000487.md): Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings. (no CVSS, org.codehaus.plexus:plexus-utils)
- [CVE-2018-5072](https://cve.now/CVE-2018-5072.md): Online Ticket Booking has XSS via the admin/sitesettings.php keyword parameter. (no CVSS)
- [CVE-2018-5073](https://cve.now/CVE-2018-5073.md): Online Ticket Booking has CSRF via admin/movieedit.php. (no CVSS)
- [CVE-2018-5074](https://cve.now/CVE-2018-5074.md): Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter. (no CVSS)
- [CVE-2018-5075](https://cve.now/CVE-2018-5075.md): Online Ticket Booking has XSS via the admin/snacks\_edit.php snacks\_name parameter. (no CVSS)
- [CVE-2018-5076](https://cve.now/CVE-2018-5076.md): Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter. (no CVSS)
- [CVE-2018-5077](https://cve.now/CVE-2018-5077.md): Online Ticket Booking has XSS via the admin/movieedit.php moviename parameter. (no CVSS)
- [CVE-2018-5078](https://cve.now/CVE-2018-5078.md): Online Ticket Booking has XSS via the admin/eventlist.php cast parameter. (no CVSS)
- [CVE-2017-1000476](https://cve.now/CVE-2017-1000476.md): ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allows attackers to ca (no CVSS)
- [CVE-2017-1000477](https://cve.now/CVE-2017-1000477.md): XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result in denial of service attacks. (no CVSS, desperado/xml-bundle)
- [CVE-2017-1000478](https://cve.now/CVE-2017-1000478.md): ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of Jav (no CVSS)
- [CVE-2017-1000479](https://cve.now/CVE-2017-1000479.md): pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrar (no CVSS)
- [CVE-2017-1000480](https://cve.now/CVE-2017-1000480.md): Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not s (no CVSS, smarty/smarty)
- [CVE-2017-1000481](https://cve.now/CVE-2017-1000481.md): When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came\_from' parameter set to the previous (no CVSS, products-cmfplone · plone)
- [CVE-2017-1000482](https://cve.now/CVE-2017-1000482.md): A member of the Plone 2.5-5.1rc1 site could set javascript in the home\_page property of his profile, and have this executed when a visitor c (no CVSS, products-cmfplone · plone)
- [CVE-2017-1000483](https://cve.now/CVE-2017-1000483.md): Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. (no CVSS, plone)
- [CVE-2017-1000489](https://cve.now/CVE-2017-1000489.md): Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address (no CVSS, mautic/core)
- [CVE-2017-1000490](https://cve.now/CVE-2017-1000490.md): Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Fileman (no CVSS, mautic/core)
- [CVE-2017-1000488](https://cve.now/CVE-2017-1000488.md): Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters (no CVSS, mautic/core)
- [CVE-2017-1000467](https://cve.now/CVE-2017-1000467.md): LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disrup (no CVSS, lavalite/cms)
- [CVE-2017-1000501](https://cve.now/CVE-2017-1000501.md): Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in (no CVSS)
- [CVE-2017-1000494](https://cve.now/CVE-2017-1000494.md): Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd \< 2.0 allows an attacker to cause Denial (no CVSS)
- [CVE-2017-1000495](https://cve.now/CVE-2017-1000495.md): QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and pe (no CVSS, quickapps/cms)
- [CVE-2017-1000496](https://cve.now/CVE-2017-1000496.md): Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality resulting in denial of service and possibly remo (no CVSS)
- [CVE-2017-1000497](https://cve.now/CVE-2017-1000497.md): Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting in denial of service and possibly remote cod (no CVSS)
- [CVE-2017-1000498](https://cve.now/CVE-2017-1000498.md): AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code e (no CVSS, com.caverock:androidsvg)
- [CVE-2017-1000499](https://cve.now/CVE-2017-1000499.md): phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2018-4862](https://cve.now/CVE-2018-4862.md): In Octopus Deploy versions 3.2.11 - 4.1.5 (fixed in 4.1.6), an authenticated user with ProcessEdit permission could reference an Azure accou (no CVSS)
- [CVE-2018-4868](https://cve.now/CVE-2018-4868.md): The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers to cause a denial of service (excessive mem (no CVSS)
- [CVE-2017-18017](https://cve.now/CVE-2017-18017.md): The tcpmss\_mangle\_packet function in net/netfilter/xt\_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attac (no CVSS)
- [CVE-2017-1000466](https://cve.now/CVE-2017-1000466.md): Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result i (no CVSS)
- [CVE-2017-1000491](https://cve.now/CVE-2017-1000491.md): Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration. (no CVSS, shiba)
- [CVE-2017-1000492](https://cve.now/CVE-2017-1000492.md): Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration (no CVSS)
- [CVE-2017-1000493](https://cve.now/CVE-2017-1000493.md): Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeover (no CVSS)
- [CVE-2017-1000459](https://cve.now/CVE-2017-1000459.md): Leanote version \<= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes (no CVSS)
- [CVE-2017-1000463](https://cve.now/CVE-2017-1000463.md): Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within the edit blog post page, which can result in (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.