CVEs published January 23, 2018
64 CVEs were published on January 23, 2018: 0 critical, 0 high.
- Published
- 64
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 64
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- NetGain Systems Enterprise Manager
- 23
- PowerDNS Recursor
- 3
- Apache Software Foundation Apache NiFi · org.apache.nifi:ni…
- 2
- HP JetAdvantage Security Manager
- 2
- HP Designjet printers; HP Latex printers
- 1
- HP Enterprise LaserJet Printers and MFPs; HP OfficeJet Ente…
- 1
- HP LaserJet Enterprise printers, HP PageWide Enterprise pri…
- 1
- HP PageWide Printers; HP OfficeJet Pro Printers
- 1
- HP Support Assistant
- 1
- HP ThinPro
- 1
Medium, low and unrated 64
- CVE-2017-12632A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server.Apache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2017-15697A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code executioApache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2017-15531Symantec Reporter 9.5 prior to 9.5.4.1 and 10.1 prior to 10.1.5.5 does not restrict excessive authentication attempts for management interfaSymantec Reporter
- CVE-2018-5749install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input bef
- CVE-2017-17999SQL injection vulnerability in RISE Ultimate Project Manager 1.9 allows remote attackers to execute arbitrary SQL commands via the search pa
- CVE-2017-18030The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged users to cause a denial of service
- CVE-2018-5359The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining system-level access becaus
- CVE-2018-5683The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process
- CVE-2017-15105A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records.NLnet Labs unbound
- CVE-2017-15107A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78.Simon Kelley dnsmasq
- CVE-2017-2740A potential security vulnerability has been identified with the command line shell of the HP ThinPro operating system 6.1, 5.2.1, 5.2, 5.1, HP ThinPro
- CVE-2017-2741A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmware before 1708D.HP PageWide Printers; HP OfficeJet Pro Printers
- CVE-2017-2742A potential security vulnerability has been identified with HP Web Jetadmin before 10.4 SR2.HP Web Jetadmin
- CVE-2017-2743HP has identified a potential security vulnerability with HP Enterprise LaserJet Printers and MFPs, HP OfficeJet Enterprise Color Printers aHP Enterprise LaserJet Printers and MFPs; HP OfficeJet Ente…
- CVE-2017-2744The vulnerability allows attacker to extract binaries into protected file system locations in HP Support Assistant before 12.7.26.1.HP Support Assistant
- CVE-2017-2745Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1.HP JetAdvantage Security Manager
- CVE-2017-2746Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1.HP JetAdvantage Security Manager
- CVE-2017-2747HP has identified a potential security vulnerability before IG_11_00_00.10 for DesignJet T790, T795, T1300, T2300, before MRY_04_05_00.5 forHP Designjet printers; HP Latex printers
- CVE-2017-2750Insufficient Solution DLL Signature Validation allows potential execution of arbitrary code in HP LaserJet Enterprise printers, HP PageWide HP LaserJet Enterprise printers, HP PageWide Enterprise pri…
- CVE-2018-5950Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HT
- CVE-2017-15090An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signaturPowerDNS
- CVE-2017-15091An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, whePowerDNS Authoritative
- CVE-2017-15092A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname PowerDNS Recursor
- CVE-2017-15093When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.PowerDNS Recursor
- CVE-2017-15094An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when pPowerDNS Recursor
- CVE-2015-1142857On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF.
- CVE-2018-1000008Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers withorg.jvnet.hudson.plugins:pmd
- CVE-2018-1000009Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackeorg.jvnet.hudson.plugins:checkstyle
- CVE-2018-1000010Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers withorg.jvnet.hudson.plugins:dry
- CVE-2018-1000011Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackersorg.jvnet.hudson.plugins.findbugs:library
- CVE-2018-1000012Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackersorg.jvnet.hudson.plugins:warnings
- CVE-2018-1000013Jenkins Release Plugin 2.9 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowingorg.jenkins-ci.plugins:release
- CVE-2018-1000014Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerorg.jenkins-ci.plugins:translation
- CVE-2018-1000015On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on somorg.jenkins-ci.plugins.workflow:workflow-durable-task-step
- CVE-2017-18048Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (l
- CVE-2017-18049In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain masilverstripe/framework
- CVE-2018-6022Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to del
- CVE-2018-6029The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and
- CVE-2016-5345Buffer overflow in the Qualcomm radio driver in Android before 2017-01-05 on Android One devices allows local users to gain privileges via a
- CVE-2017-16590This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Enterprise Manager 7.2.69NetGain Systems Enterprise Manager
- CVE-2017-16591This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise ManagNetGain Systems Enterprise Manager
- CVE-2017-16592This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise ManagNetGain Systems Enterprise Manager
- CVE-2017-16593This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7NetGain Systems Enterprise Manager
- CVE-2017-16594This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7NetGain Systems Enterprise Manager
- CVE-2017-16595This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise ManagNetGain Systems Enterprise Manager
- CVE-2017-16596This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise ManagNetGain Systems Enterprise Manager
- CVE-2017-16597This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7NetGain Systems Enterprise Manager
- CVE-2017-16598This vulnerability allows remote attackers to execute code by overwriting arbitrary files on vulnerable installations of NetGain Systems EntNetGain Systems Enterprise Manager
- CVE-2017-16599This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7NetGain Systems Enterprise Manager
- CVE-2017-16600This vulnerability allows remote attackers to overwrite files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 builNetGain Systems Enterprise Manager
- CVE-2017-16601This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.NetGain Systems Enterprise Manager
- CVE-2017-16602This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7NetGain Systems Enterprise Manager
- CVE-2017-16603This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems EnterpNetGain Systems Enterprise Manager
- CVE-2017-16604This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.NetGain Systems Enterprise Manager
- CVE-2017-16605This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.NetGain Systems Enterprise Manager
- CVE-2017-16606This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems EnterpNetGain Systems Enterprise Manager
- CVE-2017-16607This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Enterprise Manager.NetGain Systems Enterprise Manager
- CVE-2017-16608This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager.NetGain Systems Enterprise Manager
- CVE-2017-16609This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Enterprise Manager.NetGain Systems Enterprise Manager
- CVE-2017-16610This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager.NetGain Systems Enterprise Manager
- CVE-2017-17406This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager.NetGain Systems Enterprise Manager
- CVE-2017-17407This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager v7.2.NetGain Systems Enterprise Manager
- CVE-2018-6013Cross-site scripting (XSS) in BigTree 4.2.19 allows any remote users to inject arbitrary web script or HTML via the directory parameter.
- CVE-2018-6014Subsonic v6.1.3 has an insecure allow-access-from domain="*" Flash cross-domain policy that allows an attacker to retrieve sensitive user in