# CVEs published 2018-01-16

45 CVEs were published on January 16, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-5728](https://cve.now/CVE-2018-5728.md): Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information via a /cgi-bin/getSysStatus reque (no CVSS)
- [CVE-2018-5299](https://cve.now/CVE-2018-5299.md): A stack-based Buffer Overflow Vulnerability exists in the web server in Pulse Secure Pulse Connect Secure (PCS) before 8.3R4 and Pulse Polic (no CVSS)
- [CVE-2018-5723](https://cve.now/CVE-2018-5723.md): MASTER IPCAMERA01 3.3.4.2103 devices have a hardcoded password of cat1029 for the root account. (no CVSS)
- [CVE-2018-5724](https://cve.now/CVE-2018-5724.md): MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Download and Upload, as demonstrated by restore.cgi. (no CVSS)
- [CVE-2018-5725](https://cve.now/CVE-2018-5725.md): MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Change, as demonstrated by the port number of the web server. (no CVSS)
- [CVE-2018-5726](https://cve.now/CVE-2018-5726.md): MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers to obtain sensitive information via a crafted HTTP request, as demonstrated by t (no CVSS)
- [CVE-2018-5727](https://cve.now/CVE-2018-5727.md): In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opj\_t1\_encode\_cblks function (openjp2/t1.c). (no CVSS)
- [CVE-2017-17947](https://cve.now/CVE-2017-17947.md): A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure (PCS) before 8.0R17.0, 8.1.x before 8.1R1 (no CVSS)
- [CVE-2018-1000004](https://cve.now/CVE-2018-1000004.md): In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead t (no CVSS)
- [CVE-2018-5715](https://cve.now/CVE-2018-5715.md): phprint.php in SugarCRM 3.5.1 has XSS via a parameter name in the query string (aka a $key variable). (no CVSS)
- [CVE-2014-6027](https://cve.now/CVE-2014-6027.md): Multiple cross-site scripting (XSS) vulnerabilities in TorrentFlux 2.4 allow (1) remote attackers to inject arbitrary web script or HTML by (no CVSS)
- [CVE-2014-6071](https://cve.now/CVE-2014-6071.md): jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside afte (no CVSS)
- [CVE-2014-9482](https://cve.now/CVE-2014-9482.md): Use-after-free vulnerability in dwarfdump in libdwarf 20130126 through 20140805 might allow remote attackers to cause a denial of service (p (no CVSS)
- [CVE-2015-7474](https://cve.now/CVE-2015-7474.md): Cross-site scripting (XSS) vulnerability in Jazz Foundation in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim F (no CVSS)
- [CVE-2015-7484](https://cve.now/CVE-2015-7484.md): IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1 and 4.0 before 4.0.7 iFix10 allow remote authenticated use (no CVSS)
- [CVE-2015-7485](https://cve.now/CVE-2015-7485.md): Cross-site scripting (XSS) vulnerability in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4. (no CVSS)
- [CVE-2015-7486](https://cve.now/CVE-2015-7486.md): Cross-site scripting (XSS) vulnerability in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4. (no CVSS)
- [CVE-2016-0207](https://cve.now/CVE-2016-0207.md): IBM Algorithmics One-Algo Risk Application (ARA) 4.9.1 through 5.1.0 allows remote authenticated users to conduct clickjacking attacks via u (no CVSS)
- [CVE-2016-0215](https://cve.now/CVE-2016-0215.md): IBM DB2 9.7, 10.1 before FP6, and 10.5 before FP8 on AIX, Linux, HP, Solaris and Windows allow remote authenticated users to cause a denial (no CVSS)
- [CVE-2016-0219](https://cve.now/CVE-2016-0219.md): XML external entity (XXE) vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 be (no CVSS)
- [CVE-2017-16549](https://cve.now/CVE-2017-16549.md): K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a spe (no CVSS)
- [CVE-2017-16550](https://cve.now/CVE-2017-16550.md): K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a spe (no CVSS)
- [CVE-2017-16551](https://cve.now/CVE-2017-16551.md): K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a partic (no CVSS)
- [CVE-2017-16552](https://cve.now/CVE-2017-16552.md): K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a spe (no CVSS)
- [CVE-2017-16553](https://cve.now/CVE-2017-16553.md): K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a partic (no CVSS)
- [CVE-2017-16554](https://cve.now/CVE-2017-16554.md): K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a spe (no CVSS)
- [CVE-2017-16555](https://cve.now/CVE-2017-16555.md): K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a partic (no CVSS)
- [CVE-2017-16556](https://cve.now/CVE-2017-16556.md): In K7 Antivirus Premium before 15.1.0.53, user-controlled input can be used to allow local users to write to arbitrary memory locations. (no CVSS)
- [CVE-2017-16557](https://cve.now/CVE-2017-16557.md): K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a partic (no CVSS)
- [CVE-2017-17429](https://cve.now/CVE-2017-17429.md): In K7 Antivirus Premium before 15.1.0.53, user-controlled input to the K7Sentry device is not sufficiently authenticated: a local user with (no CVSS)
- [CVE-2017-8802](https://cve.now/CVE-2017-8802.md): Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.8.0 Beta2 might allow remote attackers to inject a (no CVSS)
- [CVE-2018-5330](https://cve.now/CVE-2018-5330.md): ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (router unreachable/unresponsive) via a flood of fragmented UDP (no CVSS)
- [CVE-2018-5370](https://cve.now/CVE-2018-5370.md): BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI. (no CVSS)
- [CVE-2018-5713](https://cve.now/CVE-2018-5713.md): In Malwarefox Anti-Malware 2.72.169, the driver file (zam64.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-5714](https://cve.now/CVE-2018-5714.md): In Malwarefox Anti-Malware 2.72.169, the driver file (zam64.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2017-11072](https://cve.now/CVE-2017-11072.md): In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while calculating CRC for GP (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-5706](https://cve.now/CVE-2018-5706.md): An issue was discovered in Octopus Deploy before 4.1.9. (no CVSS)
- [CVE-2017-18032](https://cve.now/CVE-2017-18032.md): The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm\_generate\_password action to wp-admin/admin-aj (no CVSS)
- [CVE-2018-5703](https://cve.now/CVE-2018-5703.md): The tcp\_v6\_syn\_recv\_sock function in net/ipv6/tcp\_ipv6.c in the Linux kernel through 4.14.11 allows attackers to cause a denial of service ( (no CVSS)
- [CVE-2018-5704](https://cve.now/CVE-2018-5704.md): Open On-Chip Debugger (OpenOCD) 0.10.0 does not block attempts to use HTTP POST for sending data to 127.0.0.1 port 4444, which allows remote (no CVSS)
- [CVE-2018-5709](https://cve.now/CVE-2018-5709.md): An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. (no CVSS)
- [CVE-2018-5710](https://cve.now/CVE-2018-5710.md): An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. (no CVSS)
- [CVE-2018-5711](https://cve.now/CVE-2018-5711.md): gd\_gif\_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before (no CVSS)
- [CVE-2018-5712](https://cve.now/CVE-2018-5712.md): An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. (no CVSS)
- [CVE-2014-9485](https://cve.now/CVE-2014-9485.md): Directory traversal vulnerability in the do\_extract\_currentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remot (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.