# CVEs published 2018-01-19

32 CVEs were published on January 19, 2018: 0 critical, 3 high. Days are UTC.

- [CVE-2017-12113](https://cve.now/CVE-2017-12113.md): An exploitable improper authorization vulnerability exists in admin\_nodeInfo API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d00161 (CVSS 4.0, Talos CPP-Ethereum)
- [CVE-2017-12116](https://cve.now/CVE-2017-12116.md): An exploitable improper authorization vulnerability exists in miner\_setGasPrice API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d00 (CVSS 6.8, Talos CPP-Ethereum)
- [CVE-2017-12118](https://cve.now/CVE-2017-12118.md): An exploitable improper authorization vulnerability exists in miner\_stop API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7c (CVSS 4.0, Talos CPP-Ethereum)
- [CVE-2017-12119](https://cve.now/CVE-2017-12119.md): An exploitable unhandled exception vulnerability exists in multiple APIs of CPP-Ethereum JSON-RPC. (CVSS 7.5, Talos CPP-Ethereum)
- [CVE-2017-14457](https://cve.now/CVE-2017-14457.md): An exploitable information leak/denial of service vulnerability exists in the libevm (Ethereum Virtual Machine) \`create2\` opcode handler of (CVSS 8.2, Talos CPP-Ethereum)
- [CVE-2017-14460](https://cve.now/CVE-2017-14460.md): An exploitable overly permissive cross-domain (CORS) whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8. (CVSS 7.5, Talos Parity)
- [CVE-2017-12112](https://cve.now/CVE-2017-12112.md): An exploitable improper authorization vulnerability exists in admin\_addPeer API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618 (CVSS 4.0, Talos CPP-Ethereum)
- [CVE-2017-12114](https://cve.now/CVE-2017-12114.md): An exploitable improper authorization vulnerability exists in admin\_peers API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7 (CVSS 4.0, Talos CPP-Ethereum)
- [CVE-2017-12115](https://cve.now/CVE-2017-12115.md): An exploitable improper authorization vulnerability exists in miner\_setEtherbase API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d0 (CVSS 6.8, Talos CPP-Ethereum)
- [CVE-2017-12117](https://cve.now/CVE-2017-12117.md): An exploitable improper authorization vulnerability exists in miner\_start API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7 (CVSS 4.0, Talos CPP-Ethereum)
- [CVE-2017-12097](https://cve.now/CVE-2017-12097.md): An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed\_job\_web rails gem version 1.4. (CVSS 6.1, Talos delayed\_job\_web rails gem · delayed\_job\_web)
- [CVE-2017-11398](https://cve.now/CVE-2017-11398.md): A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow (no CVSS, Trend Micro Smart Protection Server)
- [CVE-2017-12098](https://cve.now/CVE-2017-12098.md): An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails\_admin rails gem version 1.2.0. (CVSS 6.1, rails\_admin)
- [CVE-2017-14082](https://cve.now/CVE-2017-14082.md): An uninitialized pointer information disclosure vulnerability in Trend Micro Mobile Security (Enterprise) versions 9.7 and below could allow (no CVSS, Trend Micro Mobile Security)
- [CVE-2017-14094](https://cve.now/CVE-2017-14094.md): A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command (no CVSS, Trend Micro Smart Protection Server)
- [CVE-2017-14095](https://cve.now/CVE-2017-14095.md): A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command (no CVSS, Trend Micro Smart Protection Server)
- [CVE-2017-14096](https://cve.now/CVE-2017-14096.md): A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an (no CVSS, Trend Micro Smart Protection Server)
- [CVE-2017-14097](https://cve.now/CVE-2017-14097.md): An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker (no CVSS, Trend Micro Smart Protection Server)
- [CVE-2017-15713](https://cve.now/CVE-2017-15713.md): Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to ex (no CVSS, Apache Software Foundation Apache Hadoop · org.apache.hadoo…)
- [CVE-2017-18044](https://cve.now/CVE-2017-18044.md): A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. (no CVSS)
- [CVE-2017-7325](https://cve.now/CVE-2017-7325.md): Yandex Browser before 16.9.0 allows remote attackers to spoof the address bar via window.open. (no CVSS, Yandex N.V. Yandex Browser)
- [CVE-2017-7326](https://cve.now/CVE-2017-7326.md): Race condition issue in Yandex Browser for Android before 17.4.0.16 allowed a remote attacker to potentially exploit memory corruption via a (no CVSS, Yandex N.V. Yandex Browser for Android)
- [CVE-2017-7327](https://cve.now/CVE-2017-7327.md): Yandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path is used for dnsapi.dll (no CVSS, Yandex N.V. Yandex Browser for Desktop)
- [CVE-2014-4919](https://cve.now/CVE-2014-4919.md): OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition before 5.0.13 and 5.1.x before 5.1.7, and Community (no CVSS)
- [CVE-2015-6926](https://cve.now/CVE-2015-6926.md): The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email (no CVSS, oxid-esales/oxideshop-ce)
- [CVE-2017-1693](https://cve.now/CVE-2017-1693.md): IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users session during a small (no CVSS, IBM Integration Bus)
- [CVE-2017-6142](https://cve.now/CVE-2017-6142.md): X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall Manager (no CVSS, F5 Networks BIG-IP AFM)
- [CVE-2018-1362](https://cve.now/CVE-2018-1362.md): IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow an authenticated user to withdraw other (no CVSS, IBM Cram Social Program Management)
- [CVE-2018-5783](https://cve.now/CVE-2018-5783.md): In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function (base/PdfVecObjects.h). (no CVSS)
- [CVE-2018-5784](https://cve.now/CVE-2018-5784.md): In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif\_dir.c. (no CVSS)
- [CVE-2018-5785](https://cve.now/CVE-2018-5785.md): In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj\_j2k\_setup\_encoder function (openjp2/j2k.c). (no CVSS)
- [CVE-2018-5786](https://cve.now/CVE-2018-5786.md): In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the get\_fileinfo function (lrzip.c). (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.