# CVEs published 2018-01-05 27 CVEs were published on January 5, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2018-5252](https://cve.now/CVE-2018-5252.md): libimageworsener.a in ImageWorsener 1.3.2, when libjpeg 8d is used, has a large loop in the get\_raw\_sample\_int function in imagew-main.c. (no CVSS) - [CVE-2018-5253](https://cve.now/CVE-2018-5253.md): The AP4\_FtypAtom class in Core/Ap4FtypAtom.cpp in Bento4 1.5.1.0 has an Infinite loop via a crafted MP4 file that triggers size mishandling. (no CVSS) - [CVE-2018-5249](https://cve.now/CVE-2018-5249.md): Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via (no CVSS) - [CVE-2018-5251](https://cve.now/CVE-2018-5251.md): In libming 0.4.8, there is an integer signedness error vulnerability (left shift of a negative value) in the readSBits function (util/read.c (no CVSS) - [CVE-2017-18021](https://cve.now/CVE-2017-18021.md): It was discovered that QtPass before 1.2.1, when using the built-in password generator, generates possibly predictable and enumerable passwo (no CVSS) - [CVE-2017-18022](https://cve.now/CVE-2017-18022.md): In ImageMagick 7.0.7-12 Q16, there are memory leaks in MontageImageCommand in MagickWand/montage.c. (no CVSS) - [CVE-2018-5246](https://cve.now/CVE-2018-5246.md): In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadPATTERNImage in coders/pattern.c. (no CVSS) - [CVE-2018-5247](https://cve.now/CVE-2018-5247.md): In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadRLAImage in coders/rla.c. (no CVSS) - [CVE-2018-5248](https://cve.now/CVE-2018-5248.md): In ImageMagick 7.0.7-17 Q16, there is a heap-based buffer over-read in coders/sixel.c in the ReadSIXELImage function, related to the sixel\_d (no CVSS) - [CVE-2018-5244](https://cve.now/CVE-2018-5244.md): In Xen 4.10, new infrastructure was introduced as part of an overhaul to how MSR emulation happens for guests. (no CVSS) - [CVE-2017-15548](https://cve.now/CVE-2017-15548.md): An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and (no CVSS, EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0, EMC Ne…) - [CVE-2017-15549](https://cve.now/CVE-2017-15549.md): An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and (no CVSS, EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0, EMC Ne…) - [CVE-2017-15550](https://cve.now/CVE-2017-15550.md): An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and (no CVSS, EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0, EMC Ne…) - [CVE-2014-8335](https://cve.now/CVE-2014-8335.md): (1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credenti (no CVSS) - [CVE-2014-8336](https://cve.now/CVE-2014-8336.md): The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary (no CVSS) - [CVE-2014-8540](https://cve.now/CVE-2014-8540.md): The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leverag (no CVSS) - [CVE-2014-8579](https://cve.now/CVE-2014-8579.md): TRENDnet TEW-823DRU devices with firmware before 1.00b36 have a hardcoded password of kcodeskcodes for the root account, which makes it easi (no CVSS) - [CVE-2017-16666](https://cve.now/CVE-2017-16666.md): Xplico before 1.2.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the name of an uploaded PCAP (no CVSS) - [CVE-2017-4945](https://cve.now/CVE-2017-4945.md): VMware Workstation (14.x and 12.x) and Fusion (10.x and 8.x) contain a guest access control vulnerability. (no CVSS, VMware Workstation · VMware Fusion) - [CVE-2017-4946](https://cve.now/CVE-2017-4946.md): The VMware V4H and V4PA desktop agents (6.x before 6.5.1) contain a privilege escalation vulnerability. (no CVSS, VMware vRealize Operations for Horizon · VMware vRealize Op…) - [CVE-2017-4948](https://cve.now/CVE-2017-4948.md): VMware Workstation (14.x before 14.1.0 and 12.x) and Horizon View Client (4.x before 4.7.0) contain an out-of-bounds read vulnerability in T (no CVSS, VMware Workstation · VMware Horizon Client for Windows) - [CVE-2017-16716](https://cve.now/CVE-2017-16716.md): A SQL Injection issue was discovered in WebAccess versions prior to 8.3. (no CVSS, Advantech WebAccess) - [CVE-2017-16720](https://cve.now/CVE-2017-16720.md): A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. (no CVSS, Advantech WebAccess) - [CVE-2017-16724](https://cve.now/CVE-2017-16724.md): A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to 8.3. (no CVSS, Advantech WebAccess) - [CVE-2017-16728](https://cve.now/CVE-2017-16728.md): An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to 8.3. (no CVSS, Advantech WebAccess) - [CVE-2017-16753](https://cve.now/CVE-2017-16753.md): An Improper Input Validation issue was discovered in Advantech WebAccess versions prior to 8.3. (no CVSS, Advantech WebAccess) - [CVE-2017-16905](https://cve.now/CVE-2017-16905.md): The DuoLingo TinyCards application before 1.0 for Android has one use of unencrypted HTTP, which allows remote attackers to spoof content, a (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-01-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.