# CVEs published 2018-01-12

118 CVEs were published on January 12, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2017-0846](https://cve.now/CVE-2017-0846.md): An information disclosure vulnerability in the Android framework (clipboardservice). (no CVSS, Google Android)
- [CVE-2017-0855](https://cve.now/CVE-2017-0855.md): In MPEG4Extractor.cpp, there are several places where functions return early without cleaning up internal buffers which could lead to memory (no CVSS, Google Android)
- [CVE-2017-13176](https://cve.now/CVE-2017-13176.md): In the parseURL function of URLStreamHandler, there is improper input validation of the host field. (no CVSS, Google Android)
- [CVE-2017-13177](https://cve.now/CVE-2017-13177.md): In several functions of libhevc, NEON registers are not preserved. (no CVSS, Google Android)
- [CVE-2017-13178](https://cve.now/CVE-2017-13178.md): In the initDecoder function of SoftAVCDec, there is a possible out-of-bounds write to mCodecCtx due to a use after free when buffer allocati (no CVSS, Google Android)
- [CVE-2017-13179](https://cve.now/CVE-2017-13179.md): In the ihevcd\_allocate\_static\_bufs and ihevcd\_create functions of SoftHEVC, there is a possible out-of-bounds write due to a use after free. (no CVSS, Google Android)
- [CVE-2017-13180](https://cve.now/CVE-2017-13180.md): In the onQueueFilled function of SoftAVCDec, there is a possible out-of-bounds write due to a use after free if a bad header causes the deco (no CVSS, Google Android)
- [CVE-2017-13181](https://cve.now/CVE-2017-13181.md): In the doGetThumb and getThumbnail functions of MtpServer, there is a possible double free due to not NULLing out a freed pointer. (no CVSS, Google Android)
- [CVE-2017-13182](https://cve.now/CVE-2017-13182.md): In the sendFormatChange function of ACodec, there is a possible integer overflow which could lead to an out-of-bounds write. (no CVSS, Google Android)
- [CVE-2017-13183](https://cve.now/CVE-2017-13183.md): In the OMXNodeInstance::useBuffer and IOMX::freeBuffer functions, there is a possible use after free due to a race condition if the user fre (no CVSS, Google Android)
- [CVE-2017-13184](https://cve.now/CVE-2017-13184.md): In the enableVSyncInjections function of SurfaceFlinger, there is a possible use after free of mVSyncInjector. (no CVSS, Google Android)
- [CVE-2017-13185](https://cve.now/CVE-2017-13185.md): An information disclosure vulnerability in the Android media framework (libhevc). (no CVSS, Google Android)
- [CVE-2017-13186](https://cve.now/CVE-2017-13186.md): A vulnerability in the Android media framework (libavc) related to incorrect use of mmco parameters. (no CVSS, Google Android)
- [CVE-2017-13187](https://cve.now/CVE-2017-13187.md): An information disclosure vulnerability in the Android media framework (libhevc). (no CVSS, Google Android)
- [CVE-2017-13188](https://cve.now/CVE-2017-13188.md): An information disclosure vulnerability in the Android media framework (aac). (no CVSS, Google Android)
- [CVE-2017-13189](https://cve.now/CVE-2017-13189.md): A vulnerability in the Android media framework (libavc) related to handling dec\_hdl memory allocation failures. (no CVSS, Google Android)
- [CVE-2017-13190](https://cve.now/CVE-2017-13190.md): A vulnerability in the Android media framework (libhevc) related to handling ps\_codec\_obj memory allocation failures. (no CVSS, Google Android)
- [CVE-2017-13191](https://cve.now/CVE-2017-13191.md): In the ihevcd\_decode function of ihevcd\_decode.c, there is an infinite loop due to an incomplete frame error. (no CVSS, Google Android)
- [CVE-2017-13192](https://cve.now/CVE-2017-13192.md): In the ihevcd\_parse\_slice\_header function of ihevcd\_parse\_slice\_header.c a slice address of zero after the first slice could result in an in (no CVSS, Google Android)
- [CVE-2017-13193](https://cve.now/CVE-2017-13193.md): In ihevcd\_decode.c there is a possible infinite loop due to bytes for an sps of unsupported resolution resulting in the same sps being fed i (no CVSS, Google Android)
- [CVE-2017-13194](https://cve.now/CVE-2017-13194.md): A vulnerability in the Android media framework (libvpx) related to odd frame width. (no CVSS, Google Android)
- [CVE-2017-13195](https://cve.now/CVE-2017-13195.md): In the ihevcd\_parse\_sps function of ihevcd\_parse\_headers.c, several parameter values could be negative which could lead to negative indexes (no CVSS, Google Android)
- [CVE-2017-13196](https://cve.now/CVE-2017-13196.md): In several places in ihevcd\_decode.c, a dead loop could occur due to incomplete frames which could lead to memory leaks. (no CVSS, Google Android)
- [CVE-2017-13197](https://cve.now/CVE-2017-13197.md): In the ihevcd\_parse\_slice.c function, slave threads are not joined if there is an error. (no CVSS, Google Android)
- [CVE-2017-13198](https://cve.now/CVE-2017-13198.md): A vulnerability in the Android media framework (ex) related to composition of frames lacking a color map. (no CVSS, Google Android)
- [CVE-2017-13199](https://cve.now/CVE-2017-13199.md): In Bitmap.ccp if Bitmap.nativeCreate fails an out of memory exception is not thrown leading to a java.io.IOException later on. (no CVSS, Google Android)
- [CVE-2017-13200](https://cve.now/CVE-2017-13200.md): An information disclosure vulnerability in the Android media framework (av) related to id3 unsynchronization. (no CVSS, Google Android)
- [CVE-2017-13201](https://cve.now/CVE-2017-13201.md): An information disclosure vulnerability in the Android media framework (mediadrm). (no CVSS, Google Android)
- [CVE-2017-13202](https://cve.now/CVE-2017-13202.md): An information disclosure vulnerability in the Android media framework (libeffects). (no CVSS, Google Android)
- [CVE-2017-13203](https://cve.now/CVE-2017-13203.md): An information disclosure vulnerability in the Android media framework (libavc). (no CVSS, Google Android)
- [CVE-2017-13204](https://cve.now/CVE-2017-13204.md): An information disclosure vulnerability in the Android media framework (libavc). (no CVSS, Google Android)
- [CVE-2017-13205](https://cve.now/CVE-2017-13205.md): An information disclosure vulnerability in the Android media framework (libmpeg2). (no CVSS, Google Android)
- [CVE-2017-13206](https://cve.now/CVE-2017-13206.md): An information disclosure vulnerability in the Android media framework (aacdec). (no CVSS, Google Android)
- [CVE-2017-13207](https://cve.now/CVE-2017-13207.md): An information disclosure vulnerability in the Android media framework (stagefright mpeg4writer). (no CVSS, Google Android)
- [CVE-2017-13208](https://cve.now/CVE-2017-13208.md): In receive\_packet of libnetutils/packet.c, there is a possible out-of-bounds write due to a missing bounds check on the DHCP response. (no CVSS, Google Android)
- [CVE-2017-13209](https://cve.now/CVE-2017-13209.md): In the ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the PID of the caller w (no CVSS, Google Android)
- [CVE-2017-13210](https://cve.now/CVE-2017-13210.md): In CameraDeviceClient::submitRequestList of CameraDeviceClient.cpp, there is an out-of-bounds write if metadataSize is too small. (no CVSS, Google Android)
- [CVE-2017-13211](https://cve.now/CVE-2017-13211.md): In bta\_scan\_results\_cb\_impl of btif\_ble\_scanner.cc, there is possible resource exhaustion if a large number of repeated BLE scan results are (no CVSS, Google Android)
- [CVE-2017-13212](https://cve.now/CVE-2017-13212.md): An elevation of privilege vulnerability in the Android system (systemui). (no CVSS, Google Android)
- [CVE-2017-13213](https://cve.now/CVE-2017-13213.md): An elevation of privilege vulnerability in the Broadcom bcmdhd driver. (no CVSS, Google Android)
- [CVE-2017-13214](https://cve.now/CVE-2017-13214.md): In the hardware HEVC decoder, some media files could cause a page fault. (no CVSS, Google Android)
- [CVE-2017-13215](https://cve.now/CVE-2017-13215.md): A elevation of privilege vulnerability in the Upstream kernel skcipher. (no CVSS, Google Android)
- [CVE-2017-13216](https://cve.now/CVE-2017-13216.md): In ashmem\_ioctl of ashmem.c, there is an out-of-bounds write due to insufficient locking when accessing asma. (no CVSS, Google Android)
- [CVE-2017-13217](https://cve.now/CVE-2017-13217.md): In DisplayFtmItem in the bootloader, there is an out-of-bounds write due to reading a string without verifying that it's null-terminated. (no CVSS, Google Android)
- [CVE-2017-13218](https://cve.now/CVE-2017-13218.md): Access to CNTVCT\_EL0 in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear could be used for side channel attacks (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-13219](https://cve.now/CVE-2017-13219.md): A denial of service vulnerability in the Upstream kernel synaptics touchscreen controller. (no CVSS, Google Android)
- [CVE-2017-13220](https://cve.now/CVE-2017-13220.md): An elevation of privilege vulnerability in the Upstream kernel bluez. (no CVSS, Google Android)
- [CVE-2017-13221](https://cve.now/CVE-2017-13221.md): An elevation of privilege vulnerability in the Upstream kernel wifi driver. (no CVSS, Google Android)
- [CVE-2017-13222](https://cve.now/CVE-2017-13222.md): An information disclosure vulnerability in the Upstream kernel kernel. (no CVSS, Google Android)
- [CVE-2017-13225](https://cve.now/CVE-2017-13225.md): In libMtkOmxVdec.so there is a possible heap buffer overflow. (no CVSS, Google Android)
- [CVE-2017-13226](https://cve.now/CVE-2017-13226.md): An elevation of privilege vulnerability in the MediaTek mtk. (no CVSS, Google Android)
- [CVE-2015-9246](https://cve.now/CVE-2015-9246.md): An issue was discovered in Skybox Platform before 7.5.201. (no CVSS)
- [CVE-2015-9247](https://cve.now/CVE-2015-9247.md): An issue was discovered in Skybox Platform before 7.5.401. (no CVSS)
- [CVE-2015-9248](https://cve.now/CVE-2015-9248.md): An issue was discovered in Skybox Platform before 7.5.201. (no CVSS)
- [CVE-2015-9249](https://cve.now/CVE-2015-9249.md): An issue was discovered in Skybox Platform before 7.5.201. (no CVSS)
- [CVE-2015-9250](https://cve.now/CVE-2015-9250.md): An issue was discovered in Skybox Platform before 7.5.201. (no CVSS)
- [CVE-2018-5650](https://cve.now/CVE-2018-5650.md): In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the unzip\_match function in runzip.c. (no CVSS)
- [CVE-2017-14030](https://cve.now/CVE-2017-14030.md): An issue was discovered in Moxa MXview v2.8 and prior. (no CVSS, Moxa MXview)
- [CVE-2017-16737](https://cve.now/CVE-2017-16737.md): An issue was discovered in WECON Technology LEVI Studio HMI Editor v1.8.29 and prior. (no CVSS, WECON Technology Co., Ltd. LeviStudio HMI Editor)
- [CVE-2017-16739](https://cve.now/CVE-2017-16739.md): An issue was discovered in WECON Technology LEVI Studio HMI Editor v1.8.29 and prior. (no CVSS, WECON Technology Co., Ltd. LeviStudio HMI Editor)
- [CVE-2017-16741](https://cve.now/CVE-2017-16741.md): An Information Exposure issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 (no CVSS, PHOENIX CONTACT FL SWITCH)
- [CVE-2017-16743](https://cve.now/CVE-2017-16743.md): An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1 (no CVSS, PHOENIX CONTACT FL SWITCH)
- [CVE-2017-18027](https://cve.now/CVE-2017-18027.md): In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allow remote attackers (no CVSS)
- [CVE-2017-18028](https://cve.now/CVE-2017-18028.md): In ImageMagick 7.0.7-1 Q16, a memory exhaustion vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allow remote a (no CVSS)
- [CVE-2017-18029](https://cve.now/CVE-2017-18029.md): In ImageMagick 7.0.6-10 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allow remote attacker (no CVSS)
- [CVE-2016-10705](https://cve.now/CVE-2016-10705.md): The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module. (no CVSS)
- [CVE-2016-10706](https://cve.now/CVE-2016-10706.md): The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link. (no CVSS)
- [CVE-2014-3471](https://cve.now/CVE-2014-3471.md): Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU in (no CVSS)
- [CVE-2014-6435](https://cve.now/CVE-2014-6435.md): cgi-bin/AZ\_Retrain.cgi in Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices does not check for authentication, which allows remote (no CVSS)
- [CVE-2014-6436](https://cve.now/CVE-2014-6436.md): Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices improperly manage sessions, which allows remote attackers to bypass authenticati (no CVSS)
- [CVE-2014-6437](https://cve.now/CVE-2014-6437.md): Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices allow remote attackers to obtain sensitive device configuration information via (no CVSS)
- [CVE-2014-7952](https://cve.now/CVE-2014-7952.md): The backup mechanism in the adb tool in Android might allow attackers to inject additional applications (APKs) and execute arbitrary code by (no CVSS)
- [CVE-2014-8166](https://cve.now/CVE-2014-8166.md): The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attacke (no CVSS)
- [CVE-2015-2298](https://cve.now/CVE-2015-2298.md): node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an im (no CVSS)
- [CVE-2015-2981](https://cve.now/CVE-2015-2981.md): The Yodobashi App for Android 1.2.1.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attack (no CVSS)
- [CVE-2015-3888](https://cve.now/CVE-2015-3888.md): Jolla Sailfish OS before 1.1.2.16 allows remote attackers to spoof phone numbers and trigger calls to arbitrary numbers via spaces in a tel: (no CVSS)
- [CVE-2016-0324](https://cve.now/CVE-2016-0324.md): IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users (no CVSS)
- [CVE-2016-0327](https://cve.now/CVE-2016-0327.md): IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows local users to gain admini (no CVSS)
- [CVE-2016-0332](https://cve.now/CVE-2016-0332.md): IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 do not properly restrict failed l (no CVSS)
- [CVE-2016-0335](https://cve.now/CVE-2016-0335.md): Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0 (no CVSS)
- [CVE-2016-0336](https://cve.now/CVE-2016-0336.md): Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS- (no CVSS)
- [CVE-2017-16885](https://cve.now/CVE-2017-16885.md): Improper Permissions Handling in the Portal on FiberHome LM53Q1 VH519R05C01S38 devices (intended for obtaining information about Internet Us (no CVSS)
- [CVE-2017-16886](https://cve.now/CVE-2017-16886.md): The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. (no CVSS)
- [CVE-2017-16887](https://cve.now/CVE-2017-16887.md): The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. (no CVSS)
- [CVE-2017-17970](https://cve.now/CVE-2017-17970.md): Multiple SQL injection vulnerabilities in Muviko 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to (no CVSS)
- [CVE-2017-18014](https://cve.now/CVE-2017-18014.md): An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. (no CVSS)
- [CVE-2018-5262](https://cve.now/CVE-2018-5262.md): A stack-based buffer overflow in Flexense DiskBoss 8.8.16 and earlier allows unauthenticated remote attackers to execute arbitrary code in t (no CVSS)
- [CVE-2018-5315](https://cve.now/CVE-2018-5315.md): The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event\_id parameter to event.php. (no CVSS)
- [CVE-2017-0869](https://cve.now/CVE-2017-0869.md): NVIDIA driver contains an integer overflow vulnerability which could cause a use after free and possibly lead to an elevation of privilege e (no CVSS, Google Android)
- [CVE-2017-14594](https://cve.now/CVE-2017-14594.md): The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attacke (no CVSS, Atlassian Jira)
- [CVE-2017-16862](https://cve.now/CVE-2017-16862.md): The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist sett (no CVSS, Atlassian Jira)
- [CVE-2017-16864](https://cve.now/CVE-2017-16864.md): The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross (no CVSS, Atlassian Jira)
- [CVE-2017-2158](https://cve.now/CVE-2017-2158.md): Improper verification when expanding ZIP64 archives in Lhaplus versions 1.73 and earlier may lead to unintended contents to be extracted fro (no CVSS, Schezo Lhaplus)
- [CVE-2018-5344](https://cve.now/CVE-2018-5344.md): In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo\_release serialization, which allows attackers to cause a denial of s (no CVSS)
- [CVE-2018-5357](https://cve.now/CVE-2018-5357.md): ImageMagick 7.0.7-22 Q16 has memory leaks in the ReadDCMImage function in coders/dcm.c. (no CVSS)
- [CVE-2018-5358](https://cve.now/CVE-2018-5358.md): ImageMagick 7.0.7-22 Q16 has memory leaks in the EncodeImageAttributes function in coders/json.c, as demonstrated by the ReadPSDLayersIntern (no CVSS)
- [CVE-2018-5361](https://cve.now/CVE-2018-5361.md): The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php. (no CVSS, wpglobus/wpglobus)
- [CVE-2018-5362](https://cve.now/CVE-2018-5362.md): The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus\_option\[post\_type\]\[page\] parameter to wp-admin/options.php. (no CVSS, wpglobus/wpglobus)
- [CVE-2018-5363](https://cve.now/CVE-2018-5363.md): The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus\_option\[enabled\_languages\]\[en\] or wpglobus\_option\[enabled\_languages\]\[fr\] (or (no CVSS, wpglobus/wpglobus)
- [CVE-2018-5364](https://cve.now/CVE-2018-5364.md): The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus\_option\[browser\_redirect\]\[redirect\_by\_language\] parameter to wp-admin/option (no CVSS, wpglobus/wpglobus)
- [CVE-2018-5365](https://cve.now/CVE-2018-5365.md): The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus\_option\[selector\_wp\_list\_pages\]\[show\_selector\] parameter to wp-admin/options (no CVSS, wpglobus/wpglobus)
- [CVE-2018-5366](https://cve.now/CVE-2018-5366.md): The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus\_option\[more\_languages\] parameter to wp-admin/options.php. (no CVSS, wpglobus/wpglobus)
- [CVE-2018-5367](https://cve.now/CVE-2018-5367.md): The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus\_option\[post\_type\]\[post\] parameter to wp-admin/options.php. (no CVSS, wpglobus/wpglobus)
- [CVE-2018-5368](https://cve.now/CVE-2018-5368.md): The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php. (no CVSS)
- [CVE-2018-5369](https://cve.now/CVE-2018-5369.md): The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang\_identificat (no CVSS)
- [CVE-2018-5371](https://cve.now/CVE-2018-5371.md): diag\_ping.cmd on D-Link DSL-2640U devices with firmware IM\_1.00 and ME\_1.00, and DSL-2540U devices with firmware ME\_1.00, allows authenticat (no CVSS)
- [CVE-2018-5372](https://cve.now/CVE-2018-5372.md): The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\\sliders.php (current\_slider\_id parameter). (no CVSS)
- [CVE-2018-5373](https://cve.now/CVE-2018-5373.md): The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php (trid parameter). (no CVSS)
- [CVE-2018-5374](https://cve.now/CVE-2018-5374.md): The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\\sliders.php (current\_slider\_id parameter). (no CVSS)
- [CVE-2018-5375](https://cve.now/CVE-2018-5375.md): Discuz! DiscuzX X3.4 has XSS via the include\\spacecp\\spacecp\_space.php appid parameter in a delete action. (no CVSS)
- [CVE-2018-5376](https://cve.now/CVE-2018-5376.md): Discuz! DiscuzX X3.4 has XSS via the include\\spacecp\\spacecp\_upload.php op parameter. (no CVSS)
- [CVE-2018-5377](https://cve.now/CVE-2018-5377.md): Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\\index.php action parameter. (no CVSS)
- [CVE-2017-16732](https://cve.now/CVE-2017-16732.md): A use-after-free issue was discovered in Advantech WebAccess versions prior to 8.3. (no CVSS, Advantech WebAccess)
- [CVE-2017-16736](https://cve.now/CVE-2017-16736.md): An Unrestricted Upload Of File With Dangerous Type issue was discovered in Advantech WebAccess versions prior to 8.3. (no CVSS, Advantech WebAccess)
- [CVE-2018-5326](https://cve.now/CVE-2018-5326.md): Cheetah Mobile CM Browser 5.22.06.0012, when installed on unspecified "older" Android platforms, allows Same Origin Policy Bypass. (no CVSS)
- [CVE-2018-5327](https://cve.now/CVE-2018-5327.md): Cheetah Mobile Armorfly Browser & Downloader 1.1.05.0010, when installed on unspecified "older" Android platforms, allows Same Origin Policy (no CVSS)
- [CVE-2018-5347](https://cve.now/CVE-2018-5347.md): Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.p (no CVSS)
- [CVE-2018-5345](https://cve.now/CVE-2018-5345.md): A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, exec (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.