# CVEs published 2018-01-04

66 CVEs were published on January 4, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2017-17867](https://cve.now/CVE-2017-17867.md): Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field (no CVSS)
- [CVE-2018-5215](https://cve.now/CVE-2018-5215.md): Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter. (no CVSS, forkcms/forkcms)
- [CVE-2018-5216](https://cve.now/CVE-2018-5216.md): Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part\_body\_content parameter to an admin/pages/\*/edit resource. (no CVSS, radiant)
- [CVE-2018-5217](https://cve.now/CVE-2018-5217.md): In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie (no CVSS)
- [CVE-2018-5218](https://cve.now/CVE-2018-5218.md): In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie (no CVSS)
- [CVE-2018-5219](https://cve.now/CVE-2018-5219.md): In K7 Antivirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie (no CVSS)
- [CVE-2018-5220](https://cve.now/CVE-2018-5220.md): In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie (no CVSS)
- [CVE-2018-5212](https://cve.now/CVE-2018-5212.md): The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm\_upload\_thumbnail (aka File Thumbnail) parameter in an edit (no CVSS)
- [CVE-2018-5213](https://cve.now/CVE-2018-5213.md): The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm\_upload (aka Downloadable File) parameter in an edit action (no CVSS)
- [CVE-2018-5214](https://cve.now/CVE-2018-5214.md): The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb\_facebook\_id parameter to wp-admin/profile.php. (no CVSS)
- [CVE-2014-7862](https://cve.now/CVE-2014-7862.md): The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create ad (no CVSS)
- [CVE-2017-14960](https://cve.now/CVE-2017-14960.md): xDashboard in OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 has SQL Injection. (no CVSS)
- [CVE-2017-1664](https://cve.now/CVE-2017-1664.md): IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decryp (no CVSS, IBM Security Key Lifecycle Manager)
- [CVE-2017-1665](https://cve.now/CVE-2017-1665.md): IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decryp (no CVSS, IBM Security Key Lifecycle Manager)
- [CVE-2017-1669](https://cve.now/CVE-2017-1669.md): IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 stores sensitive information in URL parameters. (no CVSS, IBM Security Key Lifecycle Manager)
- [CVE-2017-1672](https://cve.now/CVE-2017-1672.md): IBM Tivoli Key Lifecycle Manager 2.6 and 2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious (no CVSS, IBM Security Key Lifecycle Manager)
- [CVE-2017-1673](https://cve.now/CVE-2017-1673.md): IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to cross-site scripting. (no CVSS, IBM Security Key Lifecycle Manager)
- [CVE-2017-1699](https://cve.now/CVE-2017-1699.md): IBM MQ Managed File Transfer Agent 8.0 and 9.0 sets insecure permissions on certain files it creates. (no CVSS, IBM MQ)
- [CVE-2017-1727](https://cve.now/CVE-2017-1727.md): IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 discloses sensitive information in error messages that could aid an attacker in further a (no CVSS, IBM Security Key Lifecycle Manager)
- [CVE-2017-15714](https://cve.now/CVE-2017-15714.md): The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2017-17837](https://cve.now/CVE-2017-17837.md): The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. (no CVSS, Apache Software Foundation Apache DeltaSpike · org.apache.d…)
- [CVE-2018-0741](https://cve.now/CVE-2018-0741.md): The Color Management Module (Icm32.dll) in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an information disclosure vulnerabili (no CVSS, Microsoft Color Management Module)
- [CVE-2018-0743](https://cve.now/CVE-2018-0743.md): Windows Subsystem for Linux in Windows 10 version 1703, Windows 10 version 1709, and Windows Server, version 1709 allows an elevation of pri (no CVSS, Microsoft Windows Subsystem for Linux)
- [CVE-2018-0744](https://cve.now/CVE-2018-0744.md): The Windows kernel in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 an (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0745](https://cve.now/CVE-2018-0745.md): The Windows kernel in Windows 10 version 1703. (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0746](https://cve.now/CVE-2018-0746.md): The Windows kernel in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 an (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0747](https://cve.now/CVE-2018-0747.md): The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0748](https://cve.now/CVE-2018-0748.md): The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0749](https://cve.now/CVE-2018-0749.md): The Microsoft Server Message Block (SMB) Server in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server (no CVSS, Microsoft SMB Server)
- [CVE-2018-0750](https://cve.now/CVE-2018-0750.md): The Windows GDI component in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an information disclosure vulnerability due to the (no CVSS, Microsoft Windows GDI)
- [CVE-2018-0751](https://cve.now/CVE-2018-0751.md): The Windows Kernel API in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 201 (no CVSS, Microsoft Windows)
- [CVE-2018-0752](https://cve.now/CVE-2018-0752.md): The Windows Kernel API in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 201 (no CVSS, Microsoft Windows kernel)
- [CVE-2018-0753](https://cve.now/CVE-2018-0753.md): Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, vers (no CVSS, Microsoft Windows)
- [CVE-2018-0754](https://cve.now/CVE-2018-0754.md): The Windows Adobe Type Manager Font Driver (Atmfd.dll) in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows (no CVSS, Microsoft Windows Adobe Type Manager Font Driver)
- [CVE-2018-0758](https://cve.now/CVE-2018-0758.md): Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte (no CVSS, Microsoft Edge)
- [CVE-2018-0762](https://cve.now/CVE-2018-0762.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, an (no CVSS, Microsoft Edge, Internet Explorer)
- [CVE-2018-0766](https://cve.now/CVE-2018-0766.md): Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to fur (no CVSS, Microsoft Edge)
- [CVE-2018-0767](https://cve.now/CVE-2018-0767.md): Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further c (no CVSS, Microsoft Edge)
- [CVE-2018-0768](https://cve.now/CVE-2018-0768.md): Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting (no CVSS, Microsoft Edge)
- [CVE-2018-0769](https://cve.now/CVE-2018-0769.md): Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte (no CVSS, Microsoft Edge)
- [CVE-2018-0770](https://cve.now/CVE-2018-0770.md): Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte (no CVSS, Microsoft Edge)
- [CVE-2018-0772](https://cve.now/CVE-2018-0772.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, an (no CVSS, Microsoft Edge, Internet Explorer)
- [CVE-2018-0773](https://cve.now/CVE-2018-0773.md): Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting (no CVSS, Microsoft Edge)
- [CVE-2018-0774](https://cve.now/CVE-2018-0774.md): Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting (no CVSS, Microsoft Edge)
- [CVE-2018-0775](https://cve.now/CVE-2018-0775.md): Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting (no CVSS, Microsoft Edge)
- [CVE-2018-0776](https://cve.now/CVE-2018-0776.md): Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte (no CVSS, Microsoft Edge)
- [CVE-2018-0777](https://cve.now/CVE-2018-0777.md): Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte (no CVSS, Microsoft Edge)
- [CVE-2018-0778](https://cve.now/CVE-2018-0778.md): Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting (no CVSS, Microsoft Edge)
- [CVE-2018-0780](https://cve.now/CVE-2018-0780.md): Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to fur (no CVSS, Microsoft Edge)
- [CVE-2018-0781](https://cve.now/CVE-2018-0781.md): Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the conte (no CVSS, Microsoft Edge)
- [CVE-2018-0788](https://cve.now/CVE-2018-0788.md): The Windows Adobe Type Manager Font Driver (Atmfd.dll) in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, and Win (no CVSS, Microsoft Windows Adobe Type Manager Font Driver)
- [CVE-2018-0800](https://cve.now/CVE-2018-0800.md): Microsoft Edge in Microsoft Windows 10 1709 allows an attacker to obtain information to further compromise the user's system, due to how the (no CVSS, Microsoft Edge)
- [CVE-2018-0803](https://cve.now/CVE-2018-0803.md): Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to access information from o (no CVSS, Microsoft Edge)
- [CVE-2017-5715](https://cve.now/CVE-2017-5715.md): Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information (CVSS 5.6, Intel Microprocessors with Speculative Execution)
- [CVE-2017-5753](https://cve.now/CVE-2017-5753.md): Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an at (CVSS 5.6, Intel Most Modern Operating Systems)
- [CVE-2017-5754](https://cve.now/CVE-2017-5754.md): Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information (CVSS 5.6, Intel Most Modern Operating Systems)
- [CVE-2017-14383](https://cve.now/CVE-2017-14383.md): In Dell EMC VNX2 versions prior to Operating Environment for File 8.1.9.217 and VNX1 versions prior to Operating Environment for File 7.1.80 (no CVSS, Dell EMC VNX2 versions prior to Operating Environment for F…)
- [CVE-2017-18020](https://cve.now/CVE-2017-18020.md): On Samsung mobile devices with L(5.x), M(6.x), and N(7.x) software and Exynos chipsets, attackers can execute arbitrary code in the bootload (no CVSS)
- [CVE-2017-8046](https://cve.now/CVE-2017-8046.md): Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1 (no CVSS, Pivotal Spring Data REST and Spring Boot · org.springframew…)
- [CVE-2018-0103](https://cve.now/CVE-2018-0103.md): A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a local attack (no CVSS, Cisco WebEx Network Recording Player)
- [CVE-2018-0104](https://cve.now/CVE-2018-0104.md): A vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a remote attacker to execute a (no CVSS, Cisco WebEx Advanced Recording Format Player)
- [CVE-2018-0114](https://cve.now/CVE-2018-0114.md): A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens u (no CVSS, Node-jose Library · node-jose)
- [CVE-2018-1190](https://cve.now/CVE-2018-1190.md): An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA b (no CVSS, Pivotal Cloud Foundry products: all versions prior to cf-re…)
- [CVE-2018-5210](https://cve.now/CVE-2018-5210.md): On Samsung mobile devices with N(7.x) software and Exynos chipsets, attackers can conduct a Trustlet stack overflow attack for arbitrary TEE (no CVSS)
- [CVE-2017-18018](https://cve.now/CVE-2017-18018.md): In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the (CVSS 7.1)
- [CVE-2017-18019](https://cve.now/CVE-2017-18019.md): In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficiently sanitized: the user-controlled inpu (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.