CVEs published January 10, 2018
103 CVEs were published on January 10, 2018: 2 critical, 5 high. 2 are now in CISA KEV.
- Published
- 103
- Critical
- 2
- High
- 5
- Medium
- 8
- Low
- 0
- Unrated
- 88
- Now in CISA KEV
- 2
- Fix available
- 25
Most affected products
- Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- 18
- Juniper Networks Junos OS
- 8
- Microsoft Equation Editor
- 8
- Apache Software Foundation Apache Geode · org.apache.geode:…
- 3
- IBM Security Access Manager
- 3
- Juniper Networks Junos Space
- 3
- IBM Security QRadar SIEM
- 2
- Microsoft ASP.NET Core
- 2
- Microsoft Office
- 2
- Microsoft Outlook
- 2
Critical 2
- CVE-2018-0001Junos: Unauthenticated Remote Code Execution through J-Web interfaceJuniper Networks Junos OS
- CVE-2017-17485FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix com.fasterxml.jackson.core:jackson-databind
High 5
- CVE-2018-0002MX series, SRX series: Junos OS: Denial of service vulnerability in Flowd on devices with ALG enabled.Juniper Networks Junos OS
- CVE-2018-0005Security Bulletin: Junos OS: MAC move limit configured to drop traffic may forward traffic.Juniper Networks Junos OS
- CVE-2018-0012Junos Space: Local privilege escalation vulnerability in Junos SpaceJuniper Networks Junos Space
- CVE-2018-0798Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execuMicrosoft Equation Editor
- CVE-2018-0802Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code executMicrosoft Equation Editor
Medium, low and unrated 96
- CVE-2017-11003In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while updating a firmware imQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11066In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing ubi image an Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11079In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing sparse imagQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11080In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a user suppQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-11081In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a potential buffer Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-14869In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while performing update of FQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-14870In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while updating the recovery Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-14873In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the pp_pgc_get_config() gQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-14879In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, by calling an IPA ioctl and Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-15845In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an invalid input of firmwareQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-15847In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the SPCom kernel driver, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-15848In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the fastrpc kernel driverQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-15850In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, userspace can read values frQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-9689In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a specially-crafted HDMI CECQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-9705In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, concurrent rx notifications Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-9712In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, if userspace provides a too-Qualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2018-0003Junos OS: A crafted MPLS packet may lead to a kernel crashJuniper Networks Junos OS
- CVE-2018-0004Junos OS: Kernel Denial of Service VulnerabilityJuniper Networks Junos OS
- CVE-2018-0006Junos OS: bbe-smgd process denial of service while processing VLAN authentication requests/rejectsJuniper Networks Junos OS
- CVE-2018-0007An unauthenticated network-based attacker able to send a maliciously crafted LLDP packet to the local segment, through a local segment broad
- CVE-2018-0008Junos OS: commit script may allow unauthenticated root login upon rebootJuniper Networks Junos OS
- CVE-2018-0009SRX Series: Firewall bypass vulnerability when UUID with leading zeros is configured.Juniper Networks Junos OS
- CVE-2018-0010A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the UR
- CVE-2018-0011Junos Space: Reflected XSS vulnerability in Junos Space management interfaceJuniper Networks Junos Space
- CVE-2018-0013Junos Space: Local File Inclusion VulnerabilityJuniper Networks Junos Space
- CVE-2018-0014ScreenOS: Etherleak vulnerability found on ScreenOS deviceJuniper Networks ScreenOS
- CVE-2017-17946A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data
- CVE-2017-11069In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, manipulation of SafeSwitch IQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2017-12189It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handlinRed Hat JBoss Enterprise Application Platform
- CVE-2017-15849In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a LayerStack can be destroyeQualcomm Android for MSM, Firefox OS for MSM, QRD Android
- CVE-2014-4991(1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials ocodders-dataset
- CVE-2014-4992lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtcap-strap
- CVE-2014-4993(1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for Rubybackup-agoddard · backup_checksum
- CVE-2014-4994lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file,gyazo
- CVE-2014-4995Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reVladTheEnterprising
- CVE-2014-4996lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary files via a symlink attack on /tmVladTheEnterprising
- CVE-2014-4997lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sepoint-cli
- CVE-2014-4998test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local ulean-ruport
- CVE-2014-4999vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldumpkajam
- CVE-2014-5000The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local userslawn-login
- CVE-2014-5001lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg_dump, (3) mysql, and (4) pskcapifony
- CVE-2014-5002The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive informationlynx
- CVE-2014-5003chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary fciborg
- CVE-2014-5004lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtaibrbackup
- CVE-2017-15662In Flexense VX Search Enterprise v10.1.12, the Control Protocol suffers from a denial of service vulnerability.
- CVE-2017-15663In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability.
- CVE-2017-15664In Flexense Sync Breeze Enterprise v10.1.16, the Control Protocol suffers from a denial of service vulnerability.
- CVE-2017-15665In Flexense DiskBoss Enterprise 8.5.12, the Control Protocol suffers from a denial of service vulnerability.
- CVE-2017-15941Cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x bef
- CVE-2017-16878Cross-site scripting (XSS) vulnerability in the Captive Portal function in Palo Alto Networks PAN-OS before 8.0.7 allows remote attackers to
- CVE-2017-17662Directory traversal in the HTTP server on Yawcam 0.2.6 through 0.6.0 devices allows attackers to read arbitrary files through a sequence of
- CVE-2017-17841Palo Alto Networks PAN-OS 6.1, 7.1, and 8.0.x before 8.0.7, when an interface implements SSL decryption with RSA enabled or hosts a GlobalPr
- CVE-2017-18023Office Tracker 11.2.5 has XSS via the logincount parameter to the /otweb/OTPClientLogin URI.
- CVE-2017-18024AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT eleme
- CVE-2017-3765In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "HLenovo Group Enterprise Network Operating System affecting…
- CVE-2016-9722IBM QRadar 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by uIBM Security QRadar SIEM
- CVE-2017-1459IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specifies permissions for a security-critical resource in a way that allows that resouIBM Security Access Manager
- CVE-2017-1533IBM Security Access Manager Appliance 9.0.3 is vulnerable to cross-site scripting.IBM Security Access Manager
- CVE-2017-1534IBM Security Access Manager Appliance 8.0.0 and 9.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attaIBM Security Access Manager
- CVE-2017-1623IBM QRadar 7.2 and 7.3 is vulnerable to cross-site scripting.IBM Security QRadar SIEM
- CVE-2017-16514Multiple persistent stored Cross-Site-Scripting (XSS) vulnerabilities in the files /wb/admin/admintools/tool.php (Droplet Description) and /
- CVE-2016-6810In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based admiApache Software Foundation Apache ActiveMQ · org.apache.act…
- CVE-2017-12169It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission.FreeIPA ipa
- CVE-2017-7536In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, whiRed Hat hibernate-validator · org.hibernate:hibernate-valid…
- CVE-2017-7559In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 wRed Hat undertow · io.undertow:undertow-core
- CVE-2017-15717A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilApache Software Foundation Apache Sling · org.apache.sli… +1
- CVE-2017-18026Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg progra
- CVE-2018-5331Discuz! DiscuzX X3.4 has XSS via the view parameter to include/space/space_poll.php, as demonstrated by a mod=space do=poll request to home.
- CVE-2017-12622When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh Apache Software Foundation Apache Geode · org.apache.geode:…
- CVE-2017-9795When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster mApache Software Foundation Apache Geode · org.apache.geode:…
- CVE-2017-9796When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster mApache Software Foundation Apache Geode · org.apache.geode:…
- CVE-2016-10256The Symantec ProxySG 6.5 (prior to 6.5.10.6), 6.6, and 6.7 (prior to 6.7.2.1) management console is susceptible to a reflected XSS vulnerabiSymantec ProxySG
- CVE-2016-10257The Symantec Advanced Secure Gateway (ASG) 6.6, ASG 6.7 (prior to 6.7.2.1), ProxySG 6.5 (prior to 6.5.10.6), ProxySG 6.6, and ProxySG 6.7 (pSymantec ASG · Symantec ProxySG
- CVE-2017-1000428flatCore-CMS 1.4.6 is vulnerable to reflected XSS in user_management.php due to the use of $_SERVER['PHP_SELF'] to build links and a stored
- CVE-2018-0764Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0.Microsoft .NET Framework and .NET Core · System.Security.Cr…
- CVE-2018-0784ASP.NET Core 1.0.Microsoft ASP.NET Core
- CVE-2018-0785ASP.NET Core 1.0.Microsoft ASP.NET Core
- CVE-2018-0786Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.Microsoft .NET Framework, .NET Core, and PowerShell Core… +6
- CVE-2018-0789Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 and Microsoft SharePoint Server 2016 allow an elevation of privilege Microsoft SharePoint Server
- CVE-2018-0790Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 and Microsoft SharePoint Server 2016 allow an elevation of privilege Microsoft SharePoint
- CVE-2018-0791Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, and Microsoft Outlook 2016 allow a remote code execution vulnerabiliMicrosoft Outlook
- CVE-2018-0792Microsoft Word 2016 in Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka Microsoft Word
- CVE-2018-0793Microsoft Outlook 2007, Microsoft Outlook 2010 and Microsoft Outlook 2013 allow a remote code execution vulnerability due to the way email mMicrosoft Outlook
- CVE-2018-0794Microsoft Word in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code executMicrosoft Word
- CVE-2018-0795Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects aMicrosoft Office
- CVE-2018-0796Microsoft Excel in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execuMicrosoft Excel
- CVE-2018-0797Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way RTF conteMicrosoft Office
- CVE-2018-0799Microsoft Access in Microsoft SharePoint Enterprise Server 2013 and Microsoft SharePoint Enterprise Server 2016 allows a cross-site-scriptinMicrosoft Access
- CVE-2018-0801Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execuMicrosoft Equation Editor
- CVE-2018-0804Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allMicrosoft Equation Editor
- CVE-2018-0805Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allMicrosoft Equation Editor
- CVE-2018-0806Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allMicrosoft Equation Editor
- CVE-2018-0807Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allMicrosoft Equation Editor
- CVE-2018-0812Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allMicrosoft Equation Editor
- CVE-2018-0818Microsoft ChakraCore allows an attacker to bypass Control Flow Guard (CFG) in conjunction with another vulnerability to run arbitrary code oMicrosoft ChakraCore · Microsoft.ChakraCore
- CVE-2018-0819Microsoft Office 2016 for Mac allows an attacker to send a specially crafted email attachment to a user in an attempt to launch a social engMicrosoft Office 2016 for Mac