CVEs published January 22, 2018
27 CVEs were published on January 22, 2018: 0 critical, 0 high.
- Published
- 27
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Microsoft Equation Editor
- 4
- Moodle 3.x · moodle/moodle
- 4
- com.fasterxml.jackson.core:jackson-databind
- 1
- tribalsystems/zenario
- 1
- yiisoft/yii2
- 1
- yiisoft/yii2 · yiisoft/yii2-dev
- 1
Medium, low and unrated 27
- CVE-2017-1000416axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year (19)50 of UTCTime being misinterpreted as 2050.
- CVE-2017-1000417MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs (e.g.
- CVE-2018-0845Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allMicrosoft Equation Editor
- CVE-2018-0848Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allMicrosoft Equation Editor
- CVE-2018-0849Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allMicrosoft Equation Editor
- CVE-2018-0862Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allMicrosoft Equation Editor
- CVE-2018-6009In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.yiisoft/yii2 · yiisoft/yii2-dev
- CVE-2018-6010In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflyiisoft/yii2
- CVE-2018-5999An issue was discovered in AsusWRT before 3.0.0.4.384_10007.
- CVE-2018-6000An issue was discovered in AsusWRT before 3.0.0.4.384_10007.
- CVE-2018-6001The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war
- CVE-2018-6002The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php
- CVE-2018-6003An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13.
- CVE-2018-1000002Improper input validation bugs in DNSSEC validators components in Knot Resolver (prior version 1.5.2) allow attacker in man-in-the-middle po
- CVE-2018-1000003Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to den
- CVE-2018-5761A man-in-the-middle vulnerability related to vCenter access was found in Rubrik CDM 3.x and 4.x before 4.0.4-p2.
- CVE-2017-17858Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote attacker to potential
- CVE-2018-1042Moodle 3.x has Server Side Request Forgery in the filepicker.Moodle 3.x · moodle/moodle
- CVE-2018-1043In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.Moodle 3.x · moodle/moodle
- CVE-2018-1044In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.Moodle 3.x · moodle/moodle
- CVE-2018-1045In Moodle 3.x, there is XSS via a calendar event name.Moodle 3.x · moodle/moodle
- CVE-2016-10709pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php gr
- CVE-2017-18047Buffer Overflow in the FTP client in LabF nfsAxe 3.7 allows remote FTP servers to execute arbitrary code via a long reply.
- CVE-2018-5968FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix com.fasterxml.jackson.core:jackson-databind
- CVE-2018-5960Zenario v7.1 - v7.6 has SQL injection via the `Name` input field of organizer.php or admin_boxes.ajax.php in the `Categories - Edit` module.tribalsystems/zenario
- CVE-2018-5961CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the `module` value of the `index.php` file.
- CVE-2018-5962index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini_editor module or th