# CVEs published 2018-01-22 27 CVEs were published on January 22, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2017-1000416](https://cve.now/CVE-2017-1000416.md): axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year (19)50 of UTCTime being misinterpreted as 2050. (no CVSS) - [CVE-2017-1000417](https://cve.now/CVE-2017-1000417.md): MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs (e.g. (no CVSS) - [CVE-2018-0845](https://cve.now/CVE-2018-0845.md): Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all (no CVSS, Microsoft Equation Editor) - [CVE-2018-0848](https://cve.now/CVE-2018-0848.md): Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all (no CVSS, Microsoft Equation Editor) - [CVE-2018-0849](https://cve.now/CVE-2018-0849.md): Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all (no CVSS, Microsoft Equation Editor) - [CVE-2018-0862](https://cve.now/CVE-2018-0862.md): Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 all (no CVSS, Microsoft Equation Editor) - [CVE-2018-6009](https://cve.now/CVE-2018-6009.md): In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity. (no CVSS, yiisoft/yii2 · yiisoft/yii2-dev) - [CVE-2018-6010](https://cve.now/CVE-2018-6010.md): In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit refl (no CVSS, yiisoft/yii2) - [CVE-2018-5999](https://cve.now/CVE-2018-5999.md): An issue was discovered in AsusWRT before 3.0.0.4.384\_10007. (no CVSS) - [CVE-2018-6000](https://cve.now/CVE-2018-6000.md): An issue was discovered in AsusWRT before 3.0.0.4.384\_10007. (no CVSS) - [CVE-2018-6001](https://cve.now/CVE-2018-6001.md): The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\\templates\\front-end.php (war (no CVSS) - [CVE-2018-6002](https://cve.now/CVE-2018-6002.md): The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\\templates\\front-end.php (no CVSS) - [CVE-2018-6003](https://cve.now/CVE-2018-6003.md): An issue was discovered in the \_asn1\_decode\_simple\_ber function in decoding.c in GNU Libtasn1 before 4.13. (no CVSS) - [CVE-2018-1000002](https://cve.now/CVE-2018-1000002.md): Improper input validation bugs in DNSSEC validators components in Knot Resolver (prior version 1.5.2) allow attacker in man-in-the-middle po (no CVSS) - [CVE-2018-1000003](https://cve.now/CVE-2018-1000003.md): Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to den (no CVSS) - [CVE-2018-5761](https://cve.now/CVE-2018-5761.md): A man-in-the-middle vulnerability related to vCenter access was found in Rubrik CDM 3.x and 4.x before 4.0.4-p2. (no CVSS) - [CVE-2017-17858](https://cve.now/CVE-2017-17858.md): Heap-based buffer overflow in the ensure\_solid\_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote attacker to potential (no CVSS) - [CVE-2018-1042](https://cve.now/CVE-2018-1042.md): Moodle 3.x has Server Side Request Forgery in the filepicker. (no CVSS, Moodle 3.x · moodle/moodle) - [CVE-2018-1043](https://cve.now/CVE-2018-1043.md): In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames. (no CVSS, Moodle 3.x · moodle/moodle) - [CVE-2018-1044](https://cve.now/CVE-2018-1044.md): In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings. (no CVSS, Moodle 3.x · moodle/moodle) - [CVE-2018-1045](https://cve.now/CVE-2018-1045.md): In Moodle 3.x, there is XSS via a calendar event name. (no CVSS, Moodle 3.x · moodle/moodle) - [CVE-2016-10709](https://cve.now/CVE-2016-10709.md): pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status\_rrd\_graph\_img.php gr (no CVSS) - [CVE-2017-18047](https://cve.now/CVE-2017-18047.md): Buffer Overflow in the FTP client in LabF nfsAxe 3.7 allows remote FTP servers to execute arbitrary code via a long reply. (no CVSS) - [CVE-2018-5968](https://cve.now/CVE-2018-5968.md): FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix (no CVSS, com.fasterxml.jackson.core:jackson-databind) - [CVE-2018-5960](https://cve.now/CVE-2018-5960.md): Zenario v7.1 - v7.6 has SQL injection via the \`Name\` input field of organizer.php or admin\_boxes.ajax.php in the \`Categories - Edit\` module. (no CVSS, tribalsystems/zenario) - [CVE-2018-5961](https://cve.now/CVE-2018-5961.md): CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the \`module\` value of the \`index.php\` file. (no CVSS) - [CVE-2018-5962](https://cve.now/CVE-2018-5962.md): index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini\_editor module or th (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-01-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.