# CVEs published 2018-01-08

59 CVEs were published on January 8, 2018: 0 critical, 2 high. Days are UTC.

- [CVE-2018-5263](https://cve.now/CVE-2018-5263.md): The StackIdeas EasyDiscuss (aka com\_easydiscuss) extension before 4.0.21 for Joomla! allows XSS. (no CVSS)
- [CVE-2018-5301](https://cve.now/CVE-2018-5301.md): Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address (no CVSS, magento/community-edition)
- [CVE-2012-3353](https://cve.now/CVE-2012-3353.md): The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files i (no CVSS, Apache Software Foundation Apache Sling · org.apache.sling:…)
- [CVE-2013-4364](https://cve.now/CVE-2013-4364.md): (1) oo-analytics-export and (2) oo-analytics-import in the openshift-origin-broker-util package in Red Hat OpenShift Enterprise 1 and 2 allo (no CVSS)
- [CVE-2014-1858](https://cve.now/CVE-2014-1858.md): \_\_init\_\_.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file. (no CVSS, numpy)
- [CVE-2014-1859](https://cve.now/CVE-2014-1859.md): (1) core/tests/test\_memmap.py, (2) core/tests/test\_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test\_io.py in NumPy before 1.8.1 all (no CVSS, numpy)
- [CVE-2014-2071](https://cve.now/CVE-2014-2071.md): Aruba Networks ClearPass Policy Manager 6.1.x, 6.2.x before 6.2.5.61640 and 6.3.x before 6.3.0.61712, when configured to use tunneled and no (no CVSS)
- [CVE-2014-3607](https://cve.now/CVE-2014-3607.md): DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subjec (no CVSS, edu.vt.middleware:vt-ldap · edu.internet2.middleware:shibbo…)
- [CVE-2014-4972](https://cve.now/CVE-2014-4972.md): Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute ar (no CVSS)
- [CVE-2014-5069](https://cve.now/CVE-2014-5069.md): Cross-site scripting (XSS) vulnerability in Symmetricom s350i 2.70.15 allows remote attackers to inject arbitrary web script or HTML via vec (no CVSS)
- [CVE-2014-5071](https://cve.now/CVE-2014-5071.md): SQL injection vulnerability in the checkPassword function in Symmetricom s350i 2.70.15 allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2014-5334](https://cve.now/CVE-2014-5334.md): FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root privileges by leveraging a WebGui login. (no CVSS)
- [CVE-2014-5394](https://cve.now/CVE-2014-5394.md): Multiple Huawei Campus switches allow remote attackers to enumerate usernames via vectors involving use of SSH by the maintenance terminal. (no CVSS)
- [CVE-2014-5509](https://cve.now/CVE-2014-5509.md): clipedit in the Clipboard module for Perl allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$. (no CVSS)
- [CVE-2014-7221](https://cve.now/CVE-2014-7221.md): TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (buffer overflow and application crash) b (no CVSS)
- [CVE-2014-7222](https://cve.now/CVE-2014-7222.md): Buffer overflow in TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (application crash) by (no CVSS)
- [CVE-2015-2318](https://cve.now/CVE-2015-2318.md): The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clie (no CVSS)
- [CVE-2015-2319](https://cve.now/CVE-2015-2319.md): The TLS stack in Mono before 3.12.1 makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT\_RSA ciphers via craft (no CVSS)
- [CVE-2015-2320](https://cve.now/CVE-2015-2320.md): The TLS stack in Mono before 3.12.1 allows remote attackers to have unspecified impact via vectors related to client-side SSLv2 fallback. (no CVSS)
- [CVE-2017-15883](https://cve.now/CVE-2017-15883.md): Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial (no CVSS)
- [CVE-2017-7997](https://cve.now/CVE-2017-7997.md): Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show\_prn (no CVSS)
- [CVE-2017-7998](https://cve.now/CVE-2017-7998.md): Multiple cross-site scripting (XSS) vulnerabilities in Gespage before 7.4.9 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2018-5259](https://cve.now/CVE-2018-5259.md): Discuz! DiscuzX X3.4 allows remote authenticated users to bypass intended attachment-deletion restrictions via a modified aid parameter. (no CVSS)
- [CVE-2018-5280](https://cve.now/CVE-2018-5280.md): SonicWall SonicOS on Network Security Appliance (NSA) 2016 Q4 devices has XSS via the Configure SSO screens. (no CVSS)
- [CVE-2018-5281](https://cve.now/CVE-2018-5281.md): SonicWall SonicOS on Network Security Appliance (NSA) 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings (no CVSS)
- [CVE-2018-5282](https://cve.now/CVE-2018-5282.md): Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstal (no CVSS)
- [CVE-2018-5283](https://cve.now/CVE-2018-5283.md): The Photos in Wifi application 1.0.1 for iOS has directory traversal via the ext parameter to assets-library://asset/asset.php. (no CVSS)
- [CVE-2018-5298](https://cve.now/CVE-2018-5298.md): In the Procter & Gamble "Oral-B App" (aka com.pg.oralb.oralbapp) application 5.0.0 for Android, AES encryption with static parameters is use (no CVSS)
- [CVE-2018-5284](https://cve.now/CVE-2018-5284.md): The ImageInject plugin 1.15 for WordPress has XSS via the flickr\_appid parameter to wp-admin/options-general.php. (no CVSS)
- [CVE-2018-5285](https://cve.now/CVE-2018-5285.md): The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php. (no CVSS)
- [CVE-2018-5286](https://cve.now/CVE-2018-5286.md): The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page. (no CVSS)
- [CVE-2018-5287](https://cve.now/CVE-2018-5287.md): The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-abo (no CVSS)
- [CVE-2018-5288](https://cve.now/CVE-2018-5288.md): The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page. (no CVSS)
- [CVE-2018-5289](https://cve.now/CVE-2018-5289.md): The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-inf (no CVSS)
- [CVE-2018-5290](https://cve.now/CVE-2018-5290.md): The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tra (no CVSS)
- [CVE-2018-5291](https://cve.now/CVE-2018-5291.md): The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-too (no CVSS)
- [CVE-2018-5292](https://cve.now/CVE-2018-5292.md): The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page. (no CVSS)
- [CVE-2018-5293](https://cve.now/CVE-2018-5293.md): The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-tools page. (no CVSS)
- [CVE-2018-5294](https://cve.now/CVE-2018-5294.md): In libming 0.4.8, there is an integer overflow (caused by an out-of-range left shift) in the readUInt32 function (util/read.c). (no CVSS)
- [CVE-2018-5295](https://cve.now/CVE-2018-5295.md): In PoDoFo 0.9.5, there is an integer overflow in the PdfXRefStreamParserObject::ParseStream function (base/PdfXRefStreamParserObject.cpp). (no CVSS)
- [CVE-2018-5296](https://cve.now/CVE-2018-5296.md): In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PdfParser::ReadXRefSubsection function (base/PdfParser.cpp). (no CVSS)
- [CVE-2017-5971](https://cve.now/CVE-2017-5971.md): SQL injection vulnerability in NewsBee CMS allow remote attackers to execute arbitrary SQL commands. (no CVSS)
- [CVE-2018-3815](https://cve.now/CVE-2018-3815.md): The "XML Interface to Messaging, Scheduling, and Signaling" (XIMSS) protocol implementation in CommuniGate Pro (CGP) 6.2 suffers from a Miss (no CVSS)
- [CVE-2018-5268](https://cve.now/CVE-2018-5268.md): In OpenCV 3.3.1, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt\_jpeg2000.cpp when (no CVSS, opencv-contrib-python · opencv-python)
- [CVE-2018-5269](https://cve.now/CVE-2018-5269.md): In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect intege (no CVSS, opencv-contrib-python · opencv-python)
- [CVE-2018-5270](https://cve.now/CVE-2018-5270.md): In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have uns (CVSS 7.8)
- [CVE-2018-5271](https://cve.now/CVE-2018-5271.md): In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-5272](https://cve.now/CVE-2018-5272.md): In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-5273](https://cve.now/CVE-2018-5273.md): In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-5274](https://cve.now/CVE-2018-5274.md): In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-5275](https://cve.now/CVE-2018-5275.md): In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-5276](https://cve.now/CVE-2018-5276.md): In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-5277](https://cve.now/CVE-2018-5277.md): In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-5278](https://cve.now/CVE-2018-5278.md): In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have uns (CVSS 3.3)
- [CVE-2018-5279](https://cve.now/CVE-2018-5279.md): In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have uns (CVSS 7.8)
- [CVE-2017-15913](https://cve.now/CVE-2017-15913.md): The Installer in Whale allows DLL hijacking. (no CVSS)
- [CVE-2018-5071](https://cve.now/CVE-2018-5071.md): Persistent XSS exists in the web server on Cobham Sea Tel 116 build 222429 satellite communication system devices: remote attackers can inje (no CVSS)
- [CVE-2018-5266](https://cve.now/CVE-2018-5266.md): Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information about valid usernames by reading (no CVSS)
- [CVE-2018-5267](https://cve.now/CVE-2018-5267.md): Cobham Sea Tel 121 build 222701 devices allow remote attackers to bypass authentication via a direct request to MenuDealerGx.html, MenuDeale (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.