# CVEs published 2018-01-09

33 CVEs were published on January 9, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2017-1000465](https://cve.now/CVE-2017-1000465.md): Sulu-standard version 1.6.6 is vulnerable to stored cross-site scripting vulnerability, within the page creation page, which can result in d (no CVSS)
- [CVE-2018-5316](https://cve.now/CVE-2018-5316.md): The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter. (no CVSS)
- [CVE-2017-1000429](https://cve.now/CVE-2017-1000429.md): rui Li finecms 5.0.10 is vulnerable to a reflected XSS in the file Weixin.php. (no CVSS)
- [CVE-2017-12695](https://cve.now/CVE-2017-12695.md): An Improper Authentication issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. (no CVSS, General Motors and Shanghai OnStar (SOS) iOS Client)
- [CVE-2017-12697](https://cve.now/CVE-2017-12697.md): A Man-in-the-Middle issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. (no CVSS, General Motors and Shanghai OnStar (SOS) iOS Client)
- [CVE-2017-15124](https://cve.now/CVE-2017-15124.md): VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as i (no CVSS, Qemu)
- [CVE-2017-15131](https://cve.now/CVE-2017-15131.md): It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh befor (no CVSS, Red Hat RHEL shipped xdg-user-dirs and gnome-session)
- [CVE-2017-16740](https://cve.now/CVE-2017-16740.md): A Buffer Overflow issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers, Series B and C Versions 21.002 and (no CVSS, Rockwell Automation Allen-Bradley MicroLogix 1400 Controlle…)
- [CVE-2017-9663](https://cve.now/CVE-2017-9663.md): An Cleartext Storage of Sensitive Information issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. (no CVSS, General Motors and Shanghai OnStar (SOS) iOS Client)
- [CVE-2018-3610](https://cve.now/CVE-2018-3610.md): SEMA driver in Intel Driver and Support Assistant before version 3.1.1 allows a local attacker the ability to read and writing to Memory Sta (no CVSS, Intel Driver and Support Assistant)
- [CVE-2018-4871](https://cve.now/CVE-2018-4871.md): An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. (no CVSS, Adobe Flash Player before)
- [CVE-2017-1000415](https://cve.now/CVE-2017-1000415.md): MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certifi (no CVSS)
- [CVE-2017-1493](https://cve.now/CVE-2017-1493.md): IBM UrbanCode Deploy (UCD) 6.1 and 6.2 could allow an authenticated user to edit objects that they should not have access to due to improper (no CVSS, IBM UrbanCode Deploy)
- [CVE-2017-1612](https://cve.now/CVE-2017-1612.md): IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. (no CVSS, IBM MQ)
- [CVE-2017-1666](https://cve.now/CVE-2017-1666.md): IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. (no CVSS, IBM Security Key Lifecycle Manager)
- [CVE-2017-1668](https://cve.now/CVE-2017-1668.md): IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (no CVSS, IBM Security Key Lifecycle Manager)
- [CVE-2017-1670](https://cve.now/CVE-2017-1670.md): IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to SQL injection. (no CVSS, IBM Security Key Lifecycle Manager)
- [CVE-2017-1671](https://cve.now/CVE-2017-1671.md): IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. (no CVSS, IBM Security Key Lifecycle Manager)
- [CVE-2017-15129](https://cve.now/CVE-2017-15129.md): A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. (no CVSS, Linux kernel v4.0-rc1 through v4.15-rc5)
- [CVE-2015-1208](https://cve.now/CVE-2015-1208.md): Integer underflow in the mov\_read\_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive i (no CVSS)
- [CVE-2015-1290](https://cve.now/CVE-2015-1290.md): The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1, allows remote attackers to cause (no CVSS)
- [CVE-2018-5211](https://cve.now/CVE-2018-5211.md): PHP Melody version 2.7.1 suffer from SQL Injection Time-based attack on the page ajax.php with the parameter playlist. (no CVSS)
- [CVE-2018-5221](https://cve.now/CVE-2018-5221.md): Multiple buffer overflows in BarCodeWiz BarCode before 6.7 ActiveX control (BarcodeWiz.DLL) allow remote attackers to execute arbitrary code (no CVSS)
- [CVE-2018-2360](https://cve.now/CVE-2018-2360.md): SAP Startup Service, SAP KERNEL 7.45, 7.49, and 7.52, is missing an authentication check for functionalities that require user identity and (no CVSS, SAP SE SAP Startup Service)
- [CVE-2018-2361](https://cve.now/CVE-2018-2361.md): In SAP Solution Manager 7.20, the role SAP\_BPO\_CONFIG gives the Business Process Operations (BPO) configuration user more authorization than (no CVSS, SAP SE SAP Solution Manager)
- [CVE-2018-2362](https://cve.now/CVE-2018-2362.md): A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclos (no CVSS, SAP SE SAP HANA)
- [CVE-2018-2363](https://cve.now/CVE-2018-2363.md): SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute (no CVSS, SAP SE SAP NetWeaver)
- [CVE-2018-5308](https://cve.now/CVE-2018-5308.md): PoDoFo 0.9.5 does not properly validate memcpy arguments in the PdfMemoryOutputStream::Write function (base/PdfOutputStream.cpp). (no CVSS)
- [CVE-2018-5309](https://cve.now/CVE-2018-5309.md): In PoDoFo 0.9.5, there is an integer overflow in the PdfObjectStreamParserObject::ReadObjectsFromStream function (base/PdfObjectStreamParser (no CVSS)
- [CVE-2018-5310](https://cve.now/CVE-2018-5310.md): In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?p (no CVSS)
- [CVE-2018-5311](https://cve.now/CVE-2018-5311.md): The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjoo\_ecae\_options\[custom\_css\] parameter to the wp-admin/admin.php? (no CVSS)
- [CVE-2018-5312](https://cve.now/CVE-2018-5312.md): The tabs-responsive plugin 1.8.0 for WordPress has XSS via the post\_title parameter to wp-admin/post.php. (no CVSS)
- [CVE-2017-18025](https://cve.now/CVE-2017-18025.md): cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allows remote attackers to execute arbitrary OS commands via shell metacharacters in (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.