CVEs published January 24, 2018
52 CVEs were published on January 24, 2018: 1 critical, 0 high.
- Published
- 52
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 51
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- The X.Org Foundation xorg-x11-server
- 11
- org.jenkins-ci.main:jenkins-core
- 2
- Apache Software Foundation Apache Hadoop · org.apache.hadoo…
- 1
- electron
- 1
- IBM Business Process Manager
- 1
- next
- 1
- org.jenkins-ci.plugins:ec2
- 1
- Red Hat 389-ds-base
- 1
- Red Hat undertow as shipped in Jboss EAP 7.1.0.GA · org.jbo…
- 1
- Red Hat Wildfly · org.wildfly:wildfly-undertow
- 1
Critical 1
Medium, low and unrated 51
- CVE-2017-1000502Users with permission to create or configure agents in Jenkins 1.37 and earlier could configure an EC2 agent to run arbitrary shell commandsorg.jenkins-ci.plugins:ec2
- CVE-2017-1000503A race condition during Jenkins 2.81 through 2.94 (inclusive); 2.89.1 startup could result in the wrong order of execution of commands durinorg.jenkins-ci.main:jenkins-core
- CVE-2017-1000504A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands duringorg.jenkins-ci.main:jenkins-core
- CVE-2018-1000006GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specielectron
- CVE-2018-1047A flaw was found in Wildfly 9.x.Red Hat Wildfly · org.wildfly:wildfly-undertow
- CVE-2018-1048It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus alloRed Hat undertow as shipped in Jboss EAP 7.1.0.GA · org.jbo…
- CVE-2017-1000474Soyket Chowdhury Vehicle Sales Management System version 2017-07-30 is vulnerable to multiple SQL Injecting in login/vehicle.php, login/prof
- CVE-2018-1000005libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers.
- CVE-2018-1000007libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties.
- CVE-2018-5759jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows remote attackers to ca
- CVE-2018-6190Netis WF2419 V3.2.41381 devices allow XSS via the Description field on the MAC Filtering page.
- CVE-2018-6191The js_strtod function in jsdtoa.c in Artifex MuJS through 1.0.2 has an integer overflow because of incorrect exponent validation.
- CVE-2018-6192In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf-xref.c allows remote attackers to cause a denial of service (segmentation
- CVE-2018-6193A Cross-Site Scripting (XSS) vulnerability was found in Routers2 2.24, affecting the 'rtr' GET parameter in a page=graph action to cgi-bin/r
- CVE-2018-5705Reservo Image Hosting 1.6 is vulnerable to XSS attacks.
- CVE-2017-12176xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause XThe X.Org Foundation xorg-x11-server
- CVE-2017-12177xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X serThe X.Org Foundation xorg-x11-server
- CVE-2017-12178xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server tThe X.Org Foundation xorg-x11-server
- CVE-2017-12179xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing malicious X client to The X.Org Foundation xorg-x11-server
- CVE-2017-12180xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to craThe X.Org Foundation xorg-x11-server
- CVE-2017-12181xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash The X.Org Foundation xorg-x11-server
- CVE-2017-12182xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash The X.Org Foundation xorg-x11-server
- CVE-2017-12183xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or poThe X.Org Foundation xorg-x11-server
- CVE-2017-12184xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or The X.Org Foundation xorg-x11-server
- CVE-2017-12185xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to c
- CVE-2017-12186xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash oThe X.Org Foundation xorg-x11-server
- CVE-2017-12187xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or poThe X.Org Foundation xorg-x11-server
- CVE-2017-13696A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze E
- CVE-2017-15135It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly Red Hat 389-ds-base
- CVE-2018-5319RAVPower FileHub 2.000.056 allows remote users to steal sensitive information via a crafted HTTP request.
- CVE-2018-5777An issue was discovered in Ipswitch WhatsUp Gold before 2017 Plus SP1 (17.1.1).
- CVE-2018-5778An issue was discovered in Ipswitch WhatsUp Gold before 2017 Plus SP1 (17.1.1).
- CVE-2018-6017Unencrypted transmission of images in Tinder iOS app and Tinder Android app allows an attacker to extract private sensitive information by s
- CVE-2018-6018Fixed sizes of HTTPS responses in Tinder iOS app and Tinder Android app allow an attacker to extract private sensitive information by sniffi
- CVE-2017-1000475FreeSSHd 1.3.1 version is vulnerable to an Unquoted Path Service allowing local users to launch processes with elevated privileges.
- CVE-2017-15718The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN ApApache Software Foundation Apache Hadoop · org.apache.hadoo…
- CVE-2017-1769IBM Business Process Manager 8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorIBM Business Process Manager
- CVE-2018-1000018An information disclosure in ovirt-hosted-engine-setup prior to 2.2.7 reveals the root user's password in the log file.
- CVE-2017-18075crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user able to access the AF_ALG-based AEAD
- CVE-2018-5969Cross Site Request Forgery (CSRF) exists in Photography CMS 1.0 via clients/resources/ajax/ajax_new_admin.php, as demonstrated by adding an
- CVE-2018-5972SQL Injection exists in Classified Ads CMS Quickad 4.0 via the keywords, placeid, cat, or subcat parameter to the listing URI.
- CVE-2018-5976Cross Site Request Forgery (CSRF) exists in RSVP Invitation Online 1.0 via function/account.php, as demonstrated by modifying the admin pass
- CVE-2018-5977SQL Injection exists in Affiligator Affiliate Webshop Management System 2.1.0 via a search/?q=&price_type=range&price= request.
- CVE-2018-5978SQL Injection exists in Facebook Style Php Ajax Chat Zechat 1.5 via the login.php User field.
- CVE-2018-5979SQL Injection exists in Wchat Fully Responsive PHP AJAX Chat Script 1.5 via the login.php User field.
- CVE-2018-5984SQL Injection exists in the Tumder (An Arcade Games Platform) 2.1 component for Joomla! via the PATH_INFO to the category/ URI.
- CVE-2018-5985SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request.
- CVE-2018-5986SQL Injection exists in Easy Car Script 2014 via the s_order or s_row parameter to site_search.php.
- CVE-2018-5988SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobile_preview.php or index.php.
- CVE-2018-6184ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.next
- CVE-2018-6187In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the pdf/pdf-write.c fil