# CVEs published 2018-01-23

64 CVEs were published on January 23, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2017-12632](https://cve.now/CVE-2017-12632.md): A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. (no CVSS, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2017-15697](https://cve.now/CVE-2017-15697.md): A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code executio (no CVSS, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2017-15531](https://cve.now/CVE-2017-15531.md): Symantec Reporter 9.5 prior to 9.5.4.1 and 10.1 prior to 10.1.5.5 does not restrict excessive authentication attempts for management interfa (no CVSS, Symantec Reporter)
- [CVE-2018-5749](https://cve.now/CVE-2018-5749.md): install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input bef (no CVSS)
- [CVE-2017-17999](https://cve.now/CVE-2017-17999.md): SQL injection vulnerability in RISE Ultimate Project Manager 1.9 allows remote attackers to execute arbitrary SQL commands via the search pa (no CVSS)
- [CVE-2017-18030](https://cve.now/CVE-2017-18030.md): The cirrus\_invalidate\_region function in hw/display/cirrus\_vga.c in Qemu allows local OS guest privileged users to cause a denial of service (no CVSS)
- [CVE-2018-5359](https://cve.now/CVE-2018-5359.md): The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining system-level access becaus (no CVSS)
- [CVE-2018-5683](https://cve.now/CVE-2018-5683.md): The vga\_draw\_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process (no CVSS)
- [CVE-2017-15105](https://cve.now/CVE-2017-15105.md): A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. (no CVSS, NLnet Labs unbound)
- [CVE-2017-15107](https://cve.now/CVE-2017-15107.md): A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. (no CVSS, Simon Kelley dnsmasq)
- [CVE-2017-2740](https://cve.now/CVE-2017-2740.md): A potential security vulnerability has been identified with the command line shell of the HP ThinPro operating system 6.1, 5.2.1, 5.2, 5.1, (no CVSS, HP ThinPro)
- [CVE-2017-2741](https://cve.now/CVE-2017-2741.md): A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmware before 1708D. (no CVSS, HP PageWide Printers; HP OfficeJet Pro Printers)
- [CVE-2017-2742](https://cve.now/CVE-2017-2742.md): A potential security vulnerability has been identified with HP Web Jetadmin before 10.4 SR2. (no CVSS, HP Web Jetadmin)
- [CVE-2017-2743](https://cve.now/CVE-2017-2743.md): HP has identified a potential security vulnerability with HP Enterprise LaserJet Printers and MFPs, HP OfficeJet Enterprise Color Printers a (no CVSS, HP Enterprise LaserJet Printers and MFPs; HP OfficeJet Ente…)
- [CVE-2017-2744](https://cve.now/CVE-2017-2744.md): The vulnerability allows attacker to extract binaries into protected file system locations in HP Support Assistant before 12.7.26.1. (no CVSS, HP Support Assistant)
- [CVE-2017-2745](https://cve.now/CVE-2017-2745.md): Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1. (no CVSS, HP JetAdvantage Security Manager)
- [CVE-2017-2746](https://cve.now/CVE-2017-2746.md): Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1. (no CVSS, HP JetAdvantage Security Manager)
- [CVE-2017-2747](https://cve.now/CVE-2017-2747.md): HP has identified a potential security vulnerability before IG\_11\_00\_00.10 for DesignJet T790, T795, T1300, T2300, before MRY\_04\_05\_00.5 for (no CVSS, HP Designjet printers; HP Latex printers)
- [CVE-2017-2750](https://cve.now/CVE-2017-2750.md): Insufficient Solution DLL Signature Validation allows potential execution of arbitrary code in HP LaserJet Enterprise printers, HP PageWide (no CVSS, HP LaserJet Enterprise printers, HP PageWide Enterprise pri…)
- [CVE-2018-5950](https://cve.now/CVE-2018-5950.md): Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2017-15090](https://cve.now/CVE-2017-15090.md): An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatur (no CVSS, PowerDNS)
- [CVE-2017-15091](https://cve.now/CVE-2017-15091.md): An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, whe (no CVSS, PowerDNS Authoritative)
- [CVE-2017-15092](https://cve.now/CVE-2017-15092.md): A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname (no CVSS, PowerDNS Recursor)
- [CVE-2017-15093](https://cve.now/CVE-2017-15093.md): When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0. (no CVSS, PowerDNS Recursor)
- [CVE-2017-15094](https://cve.now/CVE-2017-15094.md): An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when p (no CVSS, PowerDNS Recursor)
- [CVE-2015-1142857](https://cve.now/CVE-2015-1142857.md): On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF. (no CVSS)
- [CVE-2018-1000008](https://cve.now/CVE-2018-1000008.md): Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with (no CVSS, org.jvnet.hudson.plugins:pmd)
- [CVE-2018-1000009](https://cve.now/CVE-2018-1000009.md): Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attacke (no CVSS, org.jvnet.hudson.plugins:checkstyle)
- [CVE-2018-1000010](https://cve.now/CVE-2018-1000010.md): Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with (no CVSS, org.jvnet.hudson.plugins:dry)
- [CVE-2018-1000011](https://cve.now/CVE-2018-1000011.md): Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers (no CVSS, org.jvnet.hudson.plugins.findbugs:library)
- [CVE-2018-1000012](https://cve.now/CVE-2018-1000012.md): Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers (no CVSS, org.jvnet.hudson.plugins:warnings)
- [CVE-2018-1000013](https://cve.now/CVE-2018-1000013.md): Jenkins Release Plugin 2.9 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing (no CVSS, org.jenkins-ci.plugins:release)
- [CVE-2018-1000014](https://cve.now/CVE-2018-1000014.md): Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulner (no CVSS, org.jenkins-ci.plugins:translation)
- [CVE-2018-1000015](https://cve.now/CVE-2018-1000015.md): On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on som (no CVSS, org.jenkins-ci.plugins.workflow:workflow-durable-task-step)
- [CVE-2017-18048](https://cve.now/CVE-2017-18048.md): Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (l (no CVSS)
- [CVE-2017-18049](https://cve.now/CVE-2017-18049.md): In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain ma (no CVSS, silverstripe/framework)
- [CVE-2018-6022](https://cve.now/CVE-2018-6022.md): Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to del (no CVSS)
- [CVE-2018-6029](https://cve.now/CVE-2018-6029.md): The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and (no CVSS)
- [CVE-2016-5345](https://cve.now/CVE-2016-5345.md): Buffer overflow in the Qualcomm radio driver in Android before 2017-01-05 on Android One devices allows local users to gain privileges via a (no CVSS)
- [CVE-2017-16590](https://cve.now/CVE-2017-16590.md): This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Enterprise Manager 7.2.69 (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16591](https://cve.now/CVE-2017-16591.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manag (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16592](https://cve.now/CVE-2017-16592.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manag (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16593](https://cve.now/CVE-2017-16593.md): This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7 (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16594](https://cve.now/CVE-2017-16594.md): This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7 (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16595](https://cve.now/CVE-2017-16595.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manag (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16596](https://cve.now/CVE-2017-16596.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manag (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16597](https://cve.now/CVE-2017-16597.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7 (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16598](https://cve.now/CVE-2017-16598.md): This vulnerability allows remote attackers to execute code by overwriting arbitrary files on vulnerable installations of NetGain Systems Ent (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16599](https://cve.now/CVE-2017-16599.md): This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7 (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16600](https://cve.now/CVE-2017-16600.md): This vulnerability allows remote attackers to overwrite files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 buil (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16601](https://cve.now/CVE-2017-16601.md): This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7. (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16602](https://cve.now/CVE-2017-16602.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7 (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16603](https://cve.now/CVE-2017-16603.md): This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterp (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16604](https://cve.now/CVE-2017-16604.md): This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7. (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16605](https://cve.now/CVE-2017-16605.md): This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7. (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16606](https://cve.now/CVE-2017-16606.md): This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterp (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16607](https://cve.now/CVE-2017-16607.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Enterprise Manager. (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16608](https://cve.now/CVE-2017-16608.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16609](https://cve.now/CVE-2017-16609.md): This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Enterprise Manager. (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-16610](https://cve.now/CVE-2017-16610.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-17406](https://cve.now/CVE-2017-17406.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2017-17407](https://cve.now/CVE-2017-17407.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager v7.2. (no CVSS, NetGain Systems Enterprise Manager)
- [CVE-2018-6013](https://cve.now/CVE-2018-6013.md): Cross-site scripting (XSS) in BigTree 4.2.19 allows any remote users to inject arbitrary web script or HTML via the directory parameter. (no CVSS)
- [CVE-2018-6014](https://cve.now/CVE-2018-6014.md): Subsonic v6.1.3 has an insecure allow-access-from domain="\*" Flash cross-domain policy that allows an attacker to retrieve sensitive user in (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.