# CVEs published 2018-01-10

103 CVEs were published on January 10, 2018: 2 critical, 5 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2017-11003](https://cve.now/CVE-2017-11003.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while updating a firmware im (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-11066](https://cve.now/CVE-2017-11066.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing ubi image an (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-11079](https://cve.now/CVE-2017-11079.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing sparse imag (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-11080](https://cve.now/CVE-2017-11080.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a user supp (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-11081](https://cve.now/CVE-2017-11081.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a potential buffer (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-14869](https://cve.now/CVE-2017-14869.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while performing update of F (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-14870](https://cve.now/CVE-2017-14870.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while updating the recovery (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-14873](https://cve.now/CVE-2017-14873.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the pp\_pgc\_get\_config() g (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-14879](https://cve.now/CVE-2017-14879.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, by calling an IPA ioctl and (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-15845](https://cve.now/CVE-2017-15845.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an invalid input of firmware (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-15847](https://cve.now/CVE-2017-15847.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the SPCom kernel driver, (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-15848](https://cve.now/CVE-2017-15848.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the fastrpc kernel driver (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-15850](https://cve.now/CVE-2017-15850.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, userspace can read values fr (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-9689](https://cve.now/CVE-2017-9689.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a specially-crafted HDMI CEC (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-9705](https://cve.now/CVE-2017-9705.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, concurrent rx notifications (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-9712](https://cve.now/CVE-2017-9712.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, if userspace provides a too- (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-0001](https://cve.now/CVE-2018-0001.md): Junos: Unauthenticated Remote Code Execution through J-Web interface (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2018-0002](https://cve.now/CVE-2018-0002.md): MX series, SRX series: Junos OS: Denial of service vulnerability in Flowd on devices with ALG enabled. (CVSS 8.2, Juniper Networks Junos OS)
- [CVE-2018-0003](https://cve.now/CVE-2018-0003.md): Junos OS: A crafted MPLS packet may lead to a kernel crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2018-0004](https://cve.now/CVE-2018-0004.md): Junos OS: Kernel Denial of Service Vulnerability (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2018-0005](https://cve.now/CVE-2018-0005.md): Security Bulletin: Junos OS: MAC move limit configured to drop traffic may forward traffic. (CVSS 7.4, Juniper Networks Junos OS)
- [CVE-2018-0006](https://cve.now/CVE-2018-0006.md): Junos OS: bbe-smgd process denial of service while processing VLAN authentication requests/rejects (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2018-0007](https://cve.now/CVE-2018-0007.md): An unauthenticated network-based attacker able to send a maliciously crafted LLDP packet to the local segment, through a local segment broad (no CVSS)
- [CVE-2018-0008](https://cve.now/CVE-2018-0008.md): Junos OS: commit script may allow unauthenticated root login upon reboot (CVSS 6.2, Juniper Networks Junos OS)
- [CVE-2018-0009](https://cve.now/CVE-2018-0009.md): SRX Series: Firewall bypass vulnerability when UUID with leading zeros is configured. (CVSS 5.4, Juniper Networks Junos OS)
- [CVE-2018-0010](https://cve.now/CVE-2018-0010.md): A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the UR (no CVSS)
- [CVE-2018-0011](https://cve.now/CVE-2018-0011.md): Junos Space: Reflected XSS vulnerability in Junos Space management interface (CVSS 5.4, Juniper Networks Junos Space)
- [CVE-2018-0012](https://cve.now/CVE-2018-0012.md): Junos Space: Local privilege escalation vulnerability in Junos Space (CVSS 7.8, Juniper Networks Junos Space)
- [CVE-2018-0013](https://cve.now/CVE-2018-0013.md): Junos Space: Local File Inclusion Vulnerability (CVSS 6.5, Juniper Networks Junos Space)
- [CVE-2018-0014](https://cve.now/CVE-2018-0014.md): ScreenOS: Etherleak vulnerability found on ScreenOS device (CVSS 4.3, Juniper Networks ScreenOS)
- [CVE-2017-17946](https://cve.now/CVE-2017-17946.md): A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data (no CVSS)
- [CVE-2017-11069](https://cve.now/CVE-2017-11069.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, manipulation of SafeSwitch I (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-12189](https://cve.now/CVE-2017-12189.md): It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handlin (no CVSS, Red Hat JBoss Enterprise Application Platform)
- [CVE-2017-15849](https://cve.now/CVE-2017-15849.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a LayerStack can be destroye (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2014-4991](https://cve.now/CVE-2014-4991.md): (1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials o (no CVSS, codders-dataset)
- [CVE-2014-4992](https://cve.now/CVE-2014-4992.md): lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obt (no CVSS, cap-strap)
- [CVE-2014-4993](https://cve.now/CVE-2014-4993.md): (1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup\_checksum gem 3.0.23 for Ruby (no CVSS, backup-agoddard · backup\_checksum)
- [CVE-2014-4994](https://cve.now/CVE-2014-4994.md): lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, (no CVSS, gyazo)
- [CVE-2014-4995](https://cve.now/CVE-2014-4995.md): Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by re (no CVSS, VladTheEnterprising)
- [CVE-2014-4996](https://cve.now/CVE-2014-4996.md): lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary files via a symlink attack on /tm (no CVSS, VladTheEnterprising)
- [CVE-2014-4997](https://cve.now/CVE-2014-4997.md): lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain se (no CVSS, point-cli)
- [CVE-2014-4998](https://cve.now/CVE-2014-4998.md): test/tc\_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local u (no CVSS, lean-ruport)
- [CVE-2014-4999](https://cve.now/CVE-2014-4999.md): vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump (no CVSS, kajam)
- [CVE-2014-5000](https://cve.now/CVE-2014-5000.md): The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users (no CVSS, lawn-login)
- [CVE-2014-5001](https://cve.now/CVE-2014-5001.md): lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg\_dump, (3) mysql, and (4) ps (no CVSS, kcapifony)
- [CVE-2014-5002](https://cve.now/CVE-2014-5002.md): The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information (no CVSS, lynx)
- [CVE-2014-5003](https://cve.now/CVE-2014-5003.md): chef/travis-cookbooks/ci\_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary f (no CVSS, ciborg)
- [CVE-2014-5004](https://cve.now/CVE-2014-5004.md): lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtai (no CVSS, brbackup)
- [CVE-2017-15662](https://cve.now/CVE-2017-15662.md): In Flexense VX Search Enterprise v10.1.12, the Control Protocol suffers from a denial of service vulnerability. (no CVSS)
- [CVE-2017-15663](https://cve.now/CVE-2017-15663.md): In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability. (no CVSS)
- [CVE-2017-15664](https://cve.now/CVE-2017-15664.md): In Flexense Sync Breeze Enterprise v10.1.16, the Control Protocol suffers from a denial of service vulnerability. (no CVSS)
- [CVE-2017-15665](https://cve.now/CVE-2017-15665.md): In Flexense DiskBoss Enterprise 8.5.12, the Control Protocol suffers from a denial of service vulnerability. (no CVSS)
- [CVE-2017-15941](https://cve.now/CVE-2017-15941.md): Cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x bef (no CVSS)
- [CVE-2017-16878](https://cve.now/CVE-2017-16878.md): Cross-site scripting (XSS) vulnerability in the Captive Portal function in Palo Alto Networks PAN-OS before 8.0.7 allows remote attackers to (no CVSS)
- [CVE-2017-17485](https://cve.now/CVE-2017-17485.md): FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix (CVSS 9.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2017-17662](https://cve.now/CVE-2017-17662.md): Directory traversal in the HTTP server on Yawcam 0.2.6 through 0.6.0 devices allows attackers to read arbitrary files through a sequence of (no CVSS)
- [CVE-2017-17841](https://cve.now/CVE-2017-17841.md): Palo Alto Networks PAN-OS 6.1, 7.1, and 8.0.x before 8.0.7, when an interface implements SSL decryption with RSA enabled or hosts a GlobalPr (no CVSS)
- [CVE-2017-18023](https://cve.now/CVE-2017-18023.md): Office Tracker 11.2.5 has XSS via the logincount parameter to the /otweb/OTPClientLogin URI. (no CVSS)
- [CVE-2017-18024](https://cve.now/CVE-2017-18024.md): AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT eleme (no CVSS)
- [CVE-2017-3765](https://cve.now/CVE-2017-3765.md): In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "H (no CVSS, Lenovo Group Enterprise Network Operating System affecting…)
- [CVE-2016-9722](https://cve.now/CVE-2016-9722.md): IBM QRadar 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by u (no CVSS, IBM Security QRadar SIEM)
- [CVE-2017-1459](https://cve.now/CVE-2017-1459.md): IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specifies permissions for a security-critical resource in a way that allows that resou (no CVSS, IBM Security Access Manager)
- [CVE-2017-1533](https://cve.now/CVE-2017-1533.md): IBM Security Access Manager Appliance 9.0.3 is vulnerable to cross-site scripting. (no CVSS, IBM Security Access Manager)
- [CVE-2017-1534](https://cve.now/CVE-2017-1534.md): IBM Security Access Manager Appliance 8.0.0 and 9.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect atta (no CVSS, IBM Security Access Manager)
- [CVE-2017-1623](https://cve.now/CVE-2017-1623.md): IBM QRadar 7.2 and 7.3 is vulnerable to cross-site scripting. (no CVSS, IBM Security QRadar SIEM)
- [CVE-2017-16514](https://cve.now/CVE-2017-16514.md): Multiple persistent stored Cross-Site-Scripting (XSS) vulnerabilities in the files /wb/admin/admintools/tool.php (Droplet Description) and / (no CVSS)
- [CVE-2016-6810](https://cve.now/CVE-2016-6810.md): In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based admi (no CVSS, Apache Software Foundation Apache ActiveMQ · org.apache.act…)
- [CVE-2017-12169](https://cve.now/CVE-2017-12169.md): It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. (no CVSS, FreeIPA ipa)
- [CVE-2017-7536](https://cve.now/CVE-2017-7536.md): In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, whi (no CVSS, Red Hat hibernate-validator · org.hibernate:hibernate-valid…)
- [CVE-2017-7559](https://cve.now/CVE-2017-7559.md): In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 w (no CVSS, Red Hat undertow · io.undertow:undertow-core)
- [CVE-2017-15717](https://cve.now/CVE-2017-15717.md): A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFil (no CVSS, Apache Software Foundation Apache Sling · org.apache.sli… +1)
- [CVE-2017-18026](https://cve.now/CVE-2017-18026.md): Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg progra (no CVSS)
- [CVE-2018-5331](https://cve.now/CVE-2018-5331.md): Discuz! DiscuzX X3.4 has XSS via the view parameter to include/space/space\_poll.php, as demonstrated by a mod=space do=poll request to home. (no CVSS)
- [CVE-2017-12622](https://cve.now/CVE-2017-12622.md): When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh (no CVSS, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2017-9795](https://cve.now/CVE-2017-9795.md): When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster m (no CVSS, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2017-9796](https://cve.now/CVE-2017-9796.md): When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster m (no CVSS, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2016-10256](https://cve.now/CVE-2016-10256.md): The Symantec ProxySG 6.5 (prior to 6.5.10.6), 6.6, and 6.7 (prior to 6.7.2.1) management console is susceptible to a reflected XSS vulnerabi (no CVSS, Symantec ProxySG)
- [CVE-2016-10257](https://cve.now/CVE-2016-10257.md): The Symantec Advanced Secure Gateway (ASG) 6.6, ASG 6.7 (prior to 6.7.2.1), ProxySG 6.5 (prior to 6.5.10.6), ProxySG 6.6, and ProxySG 6.7 (p (no CVSS, Symantec ASG · Symantec ProxySG)
- [CVE-2017-1000428](https://cve.now/CVE-2017-1000428.md): flatCore-CMS 1.4.6 is vulnerable to reflected XSS in user\_management.php due to the use of $\_SERVER\['PHP\_SELF'\] to build links and a stored (no CVSS)
- [CVE-2018-0764](https://cve.now/CVE-2018-0764.md): Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. (no CVSS, Microsoft .NET Framework and .NET Core · System.Security.Cr…)
- [CVE-2018-0784](https://cve.now/CVE-2018-0784.md): ASP.NET Core 1.0. (no CVSS, Microsoft ASP.NET Core)
- [CVE-2018-0785](https://cve.now/CVE-2018-0785.md): ASP.NET Core 1.0. (no CVSS, Microsoft ASP.NET Core)
- [CVE-2018-0786](https://cve.now/CVE-2018-0786.md): Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0. (no CVSS, Microsoft .NET Framework, .NET Core, and PowerShell Core… +6)
- [CVE-2018-0789](https://cve.now/CVE-2018-0789.md): Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 and Microsoft SharePoint Server 2016 allow an elevation of privilege (no CVSS, Microsoft SharePoint Server)
- [CVE-2018-0790](https://cve.now/CVE-2018-0790.md): Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 and Microsoft SharePoint Server 2016 allow an elevation of privilege (no CVSS, Microsoft SharePoint)
- [CVE-2018-0791](https://cve.now/CVE-2018-0791.md): Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, and Microsoft Outlook 2016 allow a remote code execution vulnerabili (no CVSS, Microsoft Outlook)
- [CVE-2018-0792](https://cve.now/CVE-2018-0792.md): Microsoft Word 2016 in Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka (no CVSS, Microsoft Word)
- [CVE-2018-0793](https://cve.now/CVE-2018-0793.md): Microsoft Outlook 2007, Microsoft Outlook 2010 and Microsoft Outlook 2013 allow a remote code execution vulnerability due to the way email m (no CVSS, Microsoft Outlook)
- [CVE-2018-0794](https://cve.now/CVE-2018-0794.md): Microsoft Word in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execut (no CVSS, Microsoft Word)
- [CVE-2018-0795](https://cve.now/CVE-2018-0795.md): Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects a (no CVSS, Microsoft Office)
- [CVE-2018-0796](https://cve.now/CVE-2018-0796.md): Microsoft Excel in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execu (no CVSS, Microsoft Excel)
- [CVE-2018-0797](https://cve.now/CVE-2018-0797.md): Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way RTF conte (no CVSS, Microsoft Office)
- [CVE-2018-0798](https://cve.now/CVE-2018-0798.md): Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execu (CVSS 8.8, KEV, Microsoft Equation Editor)
- [CVE-2018-0799](https://cve.now/CVE-2018-0799.md): Microsoft Access in Microsoft SharePoint Enterprise Server 2013 and Microsoft SharePoint Enterprise Server 2016 allows a cross-site-scriptin (no CVSS, Microsoft Access)
- [CVE-2018-0801](https://cve.now/CVE-2018-0801.md): Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execu (no CVSS, Microsoft Equation Editor)
- [CVE-2018-0802](https://cve.now/CVE-2018-0802.md): Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execut (CVSS 7.8, KEV, Microsoft Equation Editor)
- [CVE-2018-0804](https://cve.now/CVE-2018-0804.md): Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all (no CVSS, Microsoft Equation Editor)
- [CVE-2018-0805](https://cve.now/CVE-2018-0805.md): Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all (no CVSS, Microsoft Equation Editor)
- [CVE-2018-0806](https://cve.now/CVE-2018-0806.md): Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all (no CVSS, Microsoft Equation Editor)
- [CVE-2018-0807](https://cve.now/CVE-2018-0807.md): Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all (no CVSS, Microsoft Equation Editor)
- [CVE-2018-0812](https://cve.now/CVE-2018-0812.md): Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all (no CVSS, Microsoft Equation Editor)
- [CVE-2018-0818](https://cve.now/CVE-2018-0818.md): Microsoft ChakraCore allows an attacker to bypass Control Flow Guard (CFG) in conjunction with another vulnerability to run arbitrary code o (no CVSS, Microsoft ChakraCore · Microsoft.ChakraCore)
- [CVE-2018-0819](https://cve.now/CVE-2018-0819.md): Microsoft Office 2016 for Mac allows an attacker to send a specially crafted email attachment to a user in an attempt to launch a social eng (no CVSS, Microsoft Office 2016 for Mac)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.