# CVEs published 2018-01-11

49 CVEs were published on January 11, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-5334](https://cve.now/CVE-2018-5334.md): In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the IxVeriWave file parser could crash. (no CVSS)
- [CVE-2018-5335](https://cve.now/CVE-2018-5335.md): In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the WCP dissector could crash. (no CVSS)
- [CVE-2018-5336](https://cve.now/CVE-2018-5336.md): In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the JSON, XML, NTP, XMPP, and GDB dissectors could crash. (no CVSS)
- [CVE-2012-0699](https://cve.now/CVE-2012-0699.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hi (no CVSS)
- [CVE-2012-6668](https://cve.now/CVE-2012-6668.md): Multiple cross-site scripting (XSS) vulnerabilities in the Shout Reports in the DragonByte Technologies vBShout module before 6.0.6 for vBul (no CVSS)
- [CVE-2012-6670](https://cve.now/CVE-2012-6670.md): Multiple cross-site scripting (XSS) vulnerabilities in the DragonByte Technologies vbActivity module before 3.0.1 for vBulletin allow remote (no CVSS)
- [CVE-2012-6671](https://cve.now/CVE-2012-6671.md): Multiple cross-site scripting (XSS) vulnerabilities in actions/main.php in the DragonByte Technologies Forumon RPG module before 1.0.8 for v (no CVSS)
- [CVE-2012-6682](https://cve.now/CVE-2012-6682.md): Cross-site scripting (XSS) vulnerability in downloads/actions/editdownload.php in the DragonByte Technologies vBDownloads module 1.3.2 and e (no CVSS)
- [CVE-2017-1478](https://cve.now/CVE-2017-1478.md): IBM Security Access Manager Appliance 9.0.0 allows web pages to be stored locally which can be read by another user on the system. (no CVSS, IBM Security Access Manager)
- [CVE-2017-1681](https://cve.now/CVE-2017-1681.md): IBM WebSphere Application Server (IBM Liberty for Java for Bluemix 3.15) could allow a local attacker to obtain sensitive information, cause (no CVSS, IBM Liberty for Java for Bluemix)
- [CVE-2017-1739](https://cve.now/CVE-2017-1739.md): IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 is vulnerable to cross-site scripting. (no CVSS, IBM Cram Social Program Management)
- [CVE-2017-1740](https://cve.now/CVE-2017-1740.md): IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. (no CVSS, IBM Cram Social Program Management)
- [CVE-2018-1361](https://cve.now/CVE-2018-1361.md): IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. (no CVSS, IBM WebSphere Portal)
- [CVE-2012-6667](https://cve.now/CVE-2012-6667.md): Cross-site scripting (XSS) vulnerability in vbshout.php in DragonByte Technologies vBShout module for vBulletin allows remote attackers to i (no CVSS)
- [CVE-2014-0087](https://cve.now/CVE-2014-0087.md): The check\_privileges method in vmdb/app/controllers/application\_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine ( (no CVSS)
- [CVE-2014-5068](https://cve.now/CVE-2014-5068.md): Directory traversal vulnerability in the web application in Symmetricom s350i 2.70.15 allows remote attackers to read arbitrary files via a (no CVSS)
- [CVE-2014-5070](https://cve.now/CVE-2014-5070.md): Symmetricom s350i 2.70.15 allows remote authenticated users to gain privileges via vectors related to pushing unauthenticated users to the l (no CVSS)
- [CVE-2017-15613](https://cve.now/CVE-2017-15613.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-int (no CVSS)
- [CVE-2017-15614](https://cve.now/CVE-2017-15614.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-out (no CVSS)
- [CVE-2017-15615](https://cve.now/CVE-2017-15615.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the lcpecho (no CVSS)
- [CVE-2017-15616](https://cve.now/CVE-2017-15616.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-int (no CVSS)
- [CVE-2017-15617](https://cve.now/CVE-2017-15617.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the iface v (no CVSS)
- [CVE-2017-15618](https://cve.now/CVE-2017-15618.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-ena (no CVSS)
- [CVE-2017-15619](https://cve.now/CVE-2017-15619.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphel (no CVSS)
- [CVE-2017-15620](https://cve.now/CVE-2017-15620.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-zon (no CVSS)
- [CVE-2017-15621](https://cve.now/CVE-2017-15621.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the olmode (no CVSS)
- [CVE-2017-15622](https://cve.now/CVE-2017-15622.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mpp (no CVSS)
- [CVE-2017-15623](https://cve.now/CVE-2017-15623.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-ena (no CVSS)
- [CVE-2017-15624](https://cve.now/CVE-2017-15624.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-aut (no CVSS)
- [CVE-2017-15625](https://cve.now/CVE-2017-15625.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-olm (no CVSS)
- [CVE-2017-15626](https://cve.now/CVE-2017-15626.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-bin (no CVSS)
- [CVE-2017-15627](https://cve.now/CVE-2017-15627.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-pns (no CVSS)
- [CVE-2017-15628](https://cve.now/CVE-2017-15628.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the lcpecho (no CVSS)
- [CVE-2017-15629](https://cve.now/CVE-2017-15629.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-tun (no CVSS)
- [CVE-2017-15630](https://cve.now/CVE-2017-15630.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-rem (no CVSS)
- [CVE-2017-15631](https://cve.now/CVE-2017-15631.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-wor (no CVSS)
- [CVE-2017-15632](https://cve.now/CVE-2017-15632.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mpp (no CVSS)
- [CVE-2017-15633](https://cve.now/CVE-2017-15633.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-ipg (no CVSS)
- [CVE-2017-15634](https://cve.now/CVE-2017-15634.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the name va (no CVSS)
- [CVE-2017-15635](https://cve.now/CVE-2017-15635.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the max\_con (no CVSS)
- [CVE-2017-15636](https://cve.now/CVE-2017-15636.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-tim (no CVSS)
- [CVE-2017-15637](https://cve.now/CVE-2017-15637.md): TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphel (no CVSS)
- [CVE-2017-18016](https://cve.now/CVE-2017-18016.md): Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting ot (no CVSS)
- [CVE-2018-5189](https://cve.now/CVE-2018-5189.md): Race condition in Jungo Windriver 12.5.1 allows local users to cause a denial of service (buffer overflow) or gain system privileges by flip (no CVSS)
- [CVE-2017-4949](https://cve.now/CVE-2017-4949.md): VMware Workstation and Fusion contain a use-after-free vulnerability in VMware NAT service when IPv6 mode is enabled. (no CVSS, VMware Workstation Pro / Player · VMware Fusion)
- [CVE-2017-4950](https://cve.now/CVE-2017-4950.md): VMware Workstation and Fusion contain an integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled. (no CVSS, VMware Workstation Pro / Player · VMware Fusion)
- [CVE-2018-0118](https://cve.now/CVE-2018-0118.md): A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacke (no CVSS, Cisco Unified Communications Manager)
- [CVE-2018-5332](https://cve.now/CVE-2018-5332.md): In the Linux kernel through 3.2, the rds\_message\_alloc\_sgs() function does not validate a value that is used during DMA page allocation, lea (no CVSS)
- [CVE-2018-5333](https://cve.now/CVE-2018-5333.md): In the Linux kernel through 4.14.13, the rds\_cmsg\_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.