# CVEs published 2018-01-25

39 CVEs were published on January 25, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2016-10710](https://cve.now/CVE-2016-10710.md): Biscom Secure File Transfer (SFT) 5.0.1000 through 5.0.1048 does not validate the dataFieldId value, and uses sequential numbers, which allo (no CVSS)
- [CVE-2018-5447](https://cve.now/CVE-2018-5447.md): An Improper Input Validation issue was discovered in Nari PCS-9611 relay. (no CVSS, Nari PCS-9611)
- [CVE-2018-6313](https://cve.now/CVE-2018-6313.md): Cross-site scripting (XSS) in WBCE CMS 1.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the Modif (no CVSS)
- [CVE-2018-6315](https://cve.now/CVE-2018-6315.md): The outputSWF\_TEXT\_RECORD function (util/outputscript.c) in libming through 0.4.8 is vulnerable to an integer overflow and resultant out-of- (no CVSS)
- [CVE-2017-15703](https://cve.now/CVE-2017-15703.md): Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and cau (no CVSS, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2017-15132](https://cve.now/CVE-2017-15132.md): A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. (no CVSS, The Dovecot Project dovecot)
- [CVE-2018-1051](https://cve.now/CVE-2018-1051.md): It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible (no CVSS, Red Hat resteasy · org.jboss.resteasy:resteasy-yaml-provider)
- [CVE-2017-1000505](https://cve.now/CVE-2017-1000505.md): In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a t (no CVSS, org.jenkins-ci.plugins:script-security)
- [CVE-2018-5973](https://cve.now/CVE-2018-5973.md): SQL Injection exists in Professional Local Directory Script 1.0 via the sellers\_subcategories.php IndustryID parameter, or the suppliers.php (no CVSS)
- [CVE-2018-5997](https://cve.now/CVE-2018-5997.md): An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056. (no CVSS)
- [CVE-2017-1000414](https://cve.now/CVE-2017-1000414.md): ImpulseAdventure JPEGsnoop version 1.7.5 is vulnerable to a division by zero in the JFIF decode handling resulting denial of service. (no CVSS)
- [CVE-2017-15365](https://cve.now/CVE-2017-15365.md): sql/event\_data\_objects.cc in MariaDB before 10.1.30 and 10.2.x before 10.2.10 and Percona XtraDB Cluster before 5.6.37-26.21-3 and 5.7.x bef (no CVSS)
- [CVE-2018-5748](https://cve.now/CVE-2018-5748.md): qemu/qemu\_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply. (no CVSS)
- [CVE-2018-5954](https://cve.now/CVE-2018-5954.md): phpFreeChat 1.7 and earlier allows remote attackers to cause a denial of service by sending a large number of connect commands. (no CVSS)
- [CVE-2018-5963](https://cve.now/CVE-2018-5963.md): CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/addbookmark.php via the title parameter. (no CVSS)
- [CVE-2018-5964](https://cve.now/CVE-2018-5964.md): CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1\_messages parameter. (no CVSS)
- [CVE-2018-5965](https://cve.now/CVE-2018-5965.md): CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1\_errors parameter. (no CVSS)
- [CVE-2018-4835](https://cve.now/CVE-2018-4835.md): A vulnerability has been identified in TeleControl Server Basic \< V3.1. (no CVSS, Siemens AG TeleControl Server Basic)
- [CVE-2018-4836](https://cve.now/CVE-2018-4836.md): A vulnerability has been identified in TeleControl Server Basic \< V3.1. (no CVSS, Siemens AG TeleControl Server Basic)
- [CVE-2018-4837](https://cve.now/CVE-2018-4837.md): A vulnerability has been identified in TeleControl Server Basic \< V3.1. (no CVSS, Siemens AG TeleControl Server Basic)
- [CVE-2018-5967](https://cve.now/CVE-2018-5967.md): Netis WF2419 V2.2.36123 devices allow XSS via the Description parameter on the Bandwidth Control Rule Settings page. (no CVSS)
- [CVE-2018-6217](https://cve.now/CVE-2018-6217.md): The WStr::\_alloc\_iostr\_data() function in kso.dll in Kingsoft WPS Office 10.1.0.7106 and 10.2.0.5978 allows remote attackers to cause a deni (no CVSS)
- [CVE-2018-6308](https://cve.now/CVE-2018-6308.md): Multiple SQL injections exist in SugarCRM Community Edition 6.5.26 and below via the track parameter to modules\\Campaigns\\Tracker.php and mo (no CVSS)
- [CVE-2018-6200](https://cve.now/CVE-2018-6200.md): vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter. (no CVSS)
- [CVE-2018-6201](https://cve.now/CVE-2018-6201.md): In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have un (no CVSS)
- [CVE-2018-6202](https://cve.now/CVE-2018-6202.md): In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have un (no CVSS)
- [CVE-2018-6203](https://cve.now/CVE-2018-6203.md): In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have un (no CVSS)
- [CVE-2018-6204](https://cve.now/CVE-2018-6204.md): In Max Secure Anti Virus 19.0.3.019,, the driver file (SDActMon.sys) allows local users to cause a denial of service (BSOD) or possibly have (no CVSS)
- [CVE-2018-6205](https://cve.now/CVE-2018-6205.md): In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibl (no CVSS)
- [CVE-2018-6206](https://cve.now/CVE-2018-6206.md): In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibl (no CVSS)
- [CVE-2018-6207](https://cve.now/CVE-2018-6207.md): In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibl (no CVSS)
- [CVE-2018-6208](https://cve.now/CVE-2018-6208.md): In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibl (no CVSS)
- [CVE-2018-6209](https://cve.now/CVE-2018-6209.md): In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxCryptMon.sys) allows local users to cause a denial of service (BSOD) or possibly h (no CVSS)
- [CVE-2017-15546](https://cve.now/CVE-2017-15546.md): The Security Console in EMC RSA Authentication Manager 8.2 SP1 P6 and earlier is affected by a blind SQL injection vulnerability. (no CVSS, EMC RSA Authentication Manager 8.2 SP1 P6 and earlier)
- [CVE-2018-5443](https://cve.now/CVE-2018-5443.md): A SQL Injection issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2\_20170817. (no CVSS, Advantech WebAccess/SCADA)
- [CVE-2018-5445](https://cve.now/CVE-2018-5445.md): A Path Traversal issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2\_20170817. (no CVSS, Advantech WebAccess/SCADA)
- [CVE-2018-6196](https://cve.now/CVE-2018-6196.md): w3m through 0.5.3 is prone to an infinite recursion flaw in HTMLlineproc0 because the feed\_table\_block\_tag function in table.c does not prev (no CVSS)
- [CVE-2018-6197](https://cve.now/CVE-2018-6197.md): w3m through 0.5.3 is prone to a NULL pointer dereference flaw in formUpdateBuffer in form.c. (no CVSS)
- [CVE-2018-6198](https://cve.now/CVE-2018-6198.md): w3m through 0.5.3 does not properly handle temporary files when the ~/.w3m directory is unwritable, which allows a local attacker to craft a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.