CVEs published January 25, 2018
39 CVEs were published on January 25, 2018: 0 critical, 0 high.
- Published
- 39
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 39
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Siemens AG TeleControl Server Basic
- 3
- Advantech WebAccess/SCADA
- 2
- Apache Software Foundation Apache NiFi · org.apache.nifi:ni…
- 1
- EMC RSA Authentication Manager 8.2 SP1 P6 and earlier
- 1
- Nari PCS-9611
- 1
- org.jenkins-ci.plugins:script-security
- 1
- Red Hat resteasy · org.jboss.resteasy:resteasy-yaml-provider
- 1
- The Dovecot Project dovecot
- 1
Medium, low and unrated 39
- CVE-2016-10710Biscom Secure File Transfer (SFT) 5.0.1000 through 5.0.1048 does not validate the dataFieldId value, and uses sequential numbers, which allo
- CVE-2018-5447An Improper Input Validation issue was discovered in Nari PCS-9611 relay.Nari PCS-9611
- CVE-2018-6313Cross-site scripting (XSS) in WBCE CMS 1.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the Modif
- CVE-2018-6315The outputSWF_TEXT_RECORD function (util/outputscript.c) in libming through 0.4.8 is vulnerable to an integer overflow and resultant out-of-
- CVE-2017-15703Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and cauApache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2017-15132A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0.The Dovecot Project dovecot
- CVE-2018-1051It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possibleRed Hat resteasy · org.jboss.resteasy:resteasy-yaml-provider
- CVE-2017-1000505In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a torg.jenkins-ci.plugins:script-security
- CVE-2018-5973SQL Injection exists in Professional Local Directory Script 1.0 via the sellers_subcategories.php IndustryID parameter, or the suppliers.php
- CVE-2018-5997An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056.
- CVE-2017-1000414ImpulseAdventure JPEGsnoop version 1.7.5 is vulnerable to a division by zero in the JFIF decode handling resulting denial of service.
- CVE-2017-15365sql/event_data_objects.cc in MariaDB before 10.1.30 and 10.2.x before 10.2.10 and Percona XtraDB Cluster before 5.6.37-26.21-3 and 5.7.x bef
- CVE-2018-5748qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply.
- CVE-2018-5954phpFreeChat 1.7 and earlier allows remote attackers to cause a denial of service by sending a large number of connect commands.
- CVE-2018-5963CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/addbookmark.php via the title parameter.
- CVE-2018-5964CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_messages parameter.
- CVE-2018-5965CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_errors parameter.
- CVE-2018-4835A vulnerability has been identified in TeleControl Server Basic < V3.1.Siemens AG TeleControl Server Basic
- CVE-2018-4836A vulnerability has been identified in TeleControl Server Basic < V3.1.Siemens AG TeleControl Server Basic
- CVE-2018-4837A vulnerability has been identified in TeleControl Server Basic < V3.1.Siemens AG TeleControl Server Basic
- CVE-2018-5967Netis WF2419 V2.2.36123 devices allow XSS via the Description parameter on the Bandwidth Control Rule Settings page.
- CVE-2018-6217The WStr::_alloc_iostr_data() function in kso.dll in Kingsoft WPS Office 10.1.0.7106 and 10.2.0.5978 allows remote attackers to cause a deni
- CVE-2018-6308Multiple SQL injections exist in SugarCRM Community Edition 6.5.26 and below via the track parameter to modules\Campaigns\Tracker.php and mo
- CVE-2018-6200vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.
- CVE-2018-6201In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have un
- CVE-2018-6202In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have un
- CVE-2018-6203In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have un
- CVE-2018-6204In Max Secure Anti Virus 19.0.3.019,, the driver file (SDActMon.sys) allows local users to cause a denial of service (BSOD) or possibly have
- CVE-2018-6205In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibl
- CVE-2018-6206In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibl
- CVE-2018-6207In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibl
- CVE-2018-6208In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibl
- CVE-2018-6209In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxCryptMon.sys) allows local users to cause a denial of service (BSOD) or possibly h
- CVE-2017-15546The Security Console in EMC RSA Authentication Manager 8.2 SP1 P6 and earlier is affected by a blind SQL injection vulnerability.EMC RSA Authentication Manager 8.2 SP1 P6 and earlier
- CVE-2018-5443A SQL Injection issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817.Advantech WebAccess/SCADA
- CVE-2018-5445A Path Traversal issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817.Advantech WebAccess/SCADA
- CVE-2018-6196w3m through 0.5.3 is prone to an infinite recursion flaw in HTMLlineproc0 because the feed_table_block_tag function in table.c does not prev
- CVE-2018-6197w3m through 0.5.3 is prone to a NULL pointer dereference flaw in formUpdateBuffer in form.c.
- CVE-2018-6198w3m through 0.5.3 does not properly handle temporary files when the ~/.w3m directory is unwritable, which allows a local attacker to craft a