# CVEs published 2018-01-20

5 CVEs were published on January 20, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2017-12130](https://cve.now/CVE-2017-12130.md): An exploitable NULL pointer dereference vulnerability exists in the tinysvcmdns library version 2017-11-05. (CVSS 7.5, Talos Tinysvcmdns)
- [CVE-2017-14803](https://cve.now/CVE-2017-14803.md): In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO conne (no CVSS, Micro Focus NetIQ Access Manager)
- [CVE-2017-15108](https://cve.now/CVE-2017-15108.md): spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with acces (no CVSS, Red Hat spice-vdagent)
- [CVE-2017-15111](https://cve.now/CVE-2017-15111.md): keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via sy (no CVSS, jdennis keycloak-httpd-client-install · keycloak-httpd-clie…)
- [CVE-2017-15112](https://cve.now/CVE-2017-15112.md): keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command histo (no CVSS, jdennis keycloak-httpd-client-install · keycloak-httpd-clie…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.