CVEs published January 19, 2018
32 CVEs were published on January 19, 2018: 0 critical, 3 high.
- Published
- 32
- Critical
- 0
- High
- 3
- Medium
- 9
- Low
- 0
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Talos CPP-Ethereum
- 9
- Trend Micro Smart Protection Server
- 5
- Apache Software Foundation Apache Hadoop · org.apache.hadoo…
- 1
- F5 Networks BIG-IP AFM
- 1
- IBM Cram Social Program Management
- 1
- IBM Integration Bus
- 1
- oxid-esales/oxideshop-ce
- 1
- rails_admin
- 1
- Talos delayed_job_web rails gem · delayed_job_web
- 1
- Talos Parity
- 1
High 3
- CVE-2017-12119An exploitable unhandled exception vulnerability exists in multiple APIs of CPP-Ethereum JSON-RPC.Talos CPP-Ethereum
- CVE-2017-14457An exploitable information leak/denial of service vulnerability exists in the libevm (Ethereum Virtual Machine) `create2` opcode handler of Talos CPP-Ethereum
- CVE-2017-14460An exploitable overly permissive cross-domain (CORS) whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8.Talos Parity
Medium, low and unrated 29
- CVE-2017-12113An exploitable improper authorization vulnerability exists in admin_nodeInfo API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d00161Talos CPP-Ethereum
- CVE-2017-12116An exploitable improper authorization vulnerability exists in miner_setGasPrice API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d00Talos CPP-Ethereum
- CVE-2017-12118An exploitable improper authorization vulnerability exists in miner_stop API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7cTalos CPP-Ethereum
- CVE-2017-12112An exploitable improper authorization vulnerability exists in admin_addPeer API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618Talos CPP-Ethereum
- CVE-2017-12114An exploitable improper authorization vulnerability exists in admin_peers API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7Talos CPP-Ethereum
- CVE-2017-12115An exploitable improper authorization vulnerability exists in miner_setEtherbase API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d0Talos CPP-Ethereum
- CVE-2017-12117An exploitable improper authorization vulnerability exists in miner_start API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7Talos CPP-Ethereum
- CVE-2017-12097An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem version 1.4.Talos delayed_job_web rails gem · delayed_job_web
- CVE-2017-11398A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow Trend Micro Smart Protection Server
- CVE-2017-12098An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0.rails_admin
- CVE-2017-14082An uninitialized pointer information disclosure vulnerability in Trend Micro Mobile Security (Enterprise) versions 9.7 and below could allowTrend Micro Mobile Security
- CVE-2017-14094A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote commandTrend Micro Smart Protection Server
- CVE-2017-14095A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote commandTrend Micro Smart Protection Server
- CVE-2017-14096A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an Trend Micro Smart Protection Server
- CVE-2017-14097An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker Trend Micro Smart Protection Server
- CVE-2017-15713Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to exApache Software Foundation Apache Hadoop · org.apache.hadoo…
- CVE-2017-18044A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6.
- CVE-2017-7325Yandex Browser before 16.9.0 allows remote attackers to spoof the address bar via window.open.Yandex N.V. Yandex Browser
- CVE-2017-7326Race condition issue in Yandex Browser for Android before 17.4.0.16 allowed a remote attacker to potentially exploit memory corruption via aYandex N.V. Yandex Browser for Android
- CVE-2017-7327Yandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path is used for dnsapi.dllYandex N.V. Yandex Browser for Desktop
- CVE-2014-4919OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition before 5.0.13 and 5.1.x before 5.1.7, and Community
- CVE-2015-6926The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the emailoxid-esales/oxideshop-ce
- CVE-2017-1693IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users session during a smallIBM Integration Bus
- CVE-2017-6142X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall ManagerF5 Networks BIG-IP AFM
- CVE-2018-1362IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow an authenticated user to withdraw otherIBM Cram Social Program Management
- CVE-2018-5783In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function (base/PdfVecObjects.h).
- CVE-2018-5784In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c.
- CVE-2018-5785In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder function (openjp2/j2k.c).
- CVE-2018-5786In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the get_fileinfo function (lrzip.c).