CVEs published January 9, 2018
33 CVEs were published on January 9, 2018: 0 critical, 0 high.
- Published
- 33
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- IBM Security Key Lifecycle Manager
- 4
- General Motors and Shanghai OnStar (SOS) iOS Client
- 3
- Adobe Flash Player before
- 1
- IBM MQ
- 1
- IBM UrbanCode Deploy
- 1
- Intel Driver and Support Assistant
- 1
- Linux kernel v4.0-rc1 through v4.15-rc5
- 1
- Qemu
- 1
- Red Hat RHEL shipped xdg-user-dirs and gnome-session
- 1
- Rockwell Automation Allen-Bradley MicroLogix 1400 Controlle…
- 1
Medium, low and unrated 33
- CVE-2017-1000465Sulu-standard version 1.6.6 is vulnerable to stored cross-site scripting vulnerability, within the page creation page, which can result in d
- CVE-2018-5316The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter.
- CVE-2017-1000429rui Li finecms 5.0.10 is vulnerable to a reflected XSS in the file Weixin.php.
- CVE-2017-12695An Improper Authentication issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1.General Motors and Shanghai OnStar (SOS) iOS Client
- CVE-2017-12697A Man-in-the-Middle issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1.General Motors and Shanghai OnStar (SOS) iOS Client
- CVE-2017-15124VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as iQemu
- CVE-2017-15131It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh beforRed Hat RHEL shipped xdg-user-dirs and gnome-session
- CVE-2017-16740A Buffer Overflow issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers, Series B and C Versions 21.002 and Rockwell Automation Allen-Bradley MicroLogix 1400 Controlle…
- CVE-2017-9663An Cleartext Storage of Sensitive Information issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1.General Motors and Shanghai OnStar (SOS) iOS Client
- CVE-2018-3610SEMA driver in Intel Driver and Support Assistant before version 3.1.1 allows a local attacker the ability to read and writing to Memory StaIntel Driver and Support Assistant
- CVE-2018-4871An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137.Adobe Flash Player before
- CVE-2017-1000415MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certifi
- CVE-2017-1493IBM UrbanCode Deploy (UCD) 6.1 and 6.2 could allow an authenticated user to edit objects that they should not have access to due to improperIBM UrbanCode Deploy
- CVE-2017-1612IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user.IBM MQ
- CVE-2017-1666IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data.IBM Security Key Lifecycle Manager
- CVE-2017-1668IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM Security Key Lifecycle Manager
- CVE-2017-1670IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to SQL injection.IBM Security Key Lifecycle Manager
- CVE-2017-1671IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system.IBM Security Key Lifecycle Manager
- CVE-2017-15129A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11.Linux kernel v4.0-rc1 through v4.15-rc5
- CVE-2015-1208Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive i
- CVE-2015-1290The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1, allows remote attackers to cause
- CVE-2018-5211PHP Melody version 2.7.1 suffer from SQL Injection Time-based attack on the page ajax.php with the parameter playlist.
- CVE-2018-5221Multiple buffer overflows in BarCodeWiz BarCode before 6.7 ActiveX control (BarcodeWiz.DLL) allow remote attackers to execute arbitrary code
- CVE-2018-2360SAP Startup Service, SAP KERNEL 7.45, 7.49, and 7.52, is missing an authentication check for functionalities that require user identity and SAP SE SAP Startup Service
- CVE-2018-2361In SAP Solution Manager 7.20, the role SAP_BPO_CONFIG gives the Business Process Operations (BPO) configuration user more authorization thanSAP SE SAP Solution Manager
- CVE-2018-2362A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclosSAP SE SAP HANA
- CVE-2018-2363SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to executeSAP SE SAP NetWeaver
- CVE-2018-5308PoDoFo 0.9.5 does not properly validate memcpy arguments in the PdfMemoryOutputStream::Write function (base/PdfOutputStream.cpp).
- CVE-2018-5309In PoDoFo 0.9.5, there is an integer overflow in the PdfObjectStreamParserObject::ReadObjectsFromStream function (base/PdfObjectStreamParser
- CVE-2018-5310In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?p
- CVE-2018-5311The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjoo_ecae_options[custom_css] parameter to the wp-admin/admin.php?
- CVE-2018-5312The tabs-responsive plugin 1.8.0 for WordPress has XSS via the post_title parameter to wp-admin/post.php.
- CVE-2017-18025cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allows remote attackers to execute arbitrary OS commands via shell metacharacters in