CVEs published January 26, 2018
55 CVEs were published on January 26, 2018: 0 critical, 0 high.
- Published
- 55
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 54
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- org.jenkins-ci.main:jenkins-core
- 10
- ClamAV AntiVirus software versions 0.99.2 and prior
- 7
- IBM Rational DOORS
- 7
- IBM Tealeaf Customer Experience
- 3
- Atlassian Sourcetree for macOS
- 1
- Atlassian Sourcetree for Windows
- 1
- IBM Cognos TM1
- 1
- IBM Rational Collaborative Lifecycle Management
- 1
- Japan Total System Co. GroupSession
- 1
- Lenovo Group Integrated Management Module
- 1
Medium, low and unrated 55
- CVE-2016-2983IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker under unusual circumstances to read operational data or TLIBM Tealeaf Customer Experience
- CVE-2017-1204IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 contains hard-coded credentials.IBM Tealeaf Customer Experience
- CVE-2017-1279IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker to traverse directories on the system.IBM Tealeaf Customer Experience
- CVE-2017-1506IBM Cognos TM1 10.2 and 10.2.2 is vulnerable to cross-site scripting.IBM Cognos TM1
- CVE-2017-1515IBM Doors Web Access 9.5 and 9.6 could allow an authenticated user to obtain sensitive information from HTTP internal server error responsesIBM Rational DOORS
- CVE-2017-1516IBM Doors Web Access 9.5 and 9.6 could allow a remote attacker to hijack the clicking action of the victim.IBM Rational DOORS
- CVE-2017-1532IBM DOORS 9.5 and 9.6 is vulnerable to cross-site scripting.IBM Rational DOORS
- CVE-2017-1540IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting.IBM Rational DOORS
- CVE-2017-1545IBM Doors Web Access 9.5 and 9.6 could allow an attacker with physical access to the system to log into the application using previously stoIBM Rational DOORS
- CVE-2017-1563IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting.IBM Rational DOORS
- CVE-2017-1567IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting.IBM Rational DOORS
- CVE-2017-1653IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 6.0.x) is vulnerable to cross-site scripting.IBM Rational Collaborative Lifecycle Management
- CVE-2016-6217Cross-site scripting (XSS) vulnerability in Sophos PureMessage for UNIX before 6.3.2 allows remote attackers to inject arbitrary web script
- CVE-2017-12374The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to causClamAV AntiVirus software versions 0.99.2 and prior
- CVE-2017-12375The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to causClamAV AntiVirus software versions 0.99.2 and prior
- CVE-2017-12376ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a ClamAV AntiVirus software versions 0.99.2 and prior
- CVE-2017-12377ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a ClamAV AntiVirus software versions 0.99.2 and prior
- CVE-2017-12378ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a ClamAV AntiVirus software versions 0.99.2 and prior
- CVE-2017-12379ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a ClamAV AntiVirus software versions 0.99.2 and prior
- CVE-2017-12380ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a ClamAV AntiVirus software versions 0.99.2 and prior
- CVE-2017-14521In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload.
- CVE-2017-14522In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript.
- CVE-2017-14523WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack.
- CVE-2017-17976In Utilities.php in Perfex CRM 1.9.7, Unrestricted file upload can lead to remote code execution.
- CVE-2018-6015An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress.
- CVE-2017-18076In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters aomniauth
- CVE-2017-3768An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for LenLenovo Group Integrated Management Module
- CVE-2018-5750The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain sensitive address in
- CVE-2017-2166Open redirect vulnerability in GroupSession version 4.7.0 and earlier allows an attacker to redirect users to arbitrary web sites and conducJapan Total System Co. GroupSession
- CVE-2018-0506Nootka 1.4.4 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.SeeLook Nootka
- CVE-2018-0507Untrusted search path vulnerability in FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.11 and earlier versions, FLET'S VIRUS CLEAR v6 ENIPPON TELEGRAPH AND TELEPHONE EAST FLET'S VIRUS CLEAR Easy…
- CVE-2018-6323The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has
- CVE-2017-1000386Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown onorg.biouno:uno-choice
- CVE-2017-1000387Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publiorg.jenkins-ci.plugins:build-publisher
- CVE-2017-1000388Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency org.jenkins-ci.plugins:depgraph-view
- CVE-2017-1000389Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters.org.jenkins-ci.plugins:global-build-stats
- CVE-2017-1000390Jenkins Multijob plugin version 1.25 and earlier did not check permissions in the Resume Build action, allowing anyone with Job/Read permissorg.jenkins-ci.plugins:jenkins-multijob-plugin
- CVE-2017-1000391Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as welorg.jenkins-ci.main:jenkins-core
- CVE-2017-1000392Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-sitorg.jenkins-ci.main:jenkins-core
- CVE-2017-1000393Jenkins 2.73.1 and earlier, 2.83 and earlier users with permission to create or configure agents in Jenkins could configure a launch method org.jenkins-ci.main:jenkins-core
- CVE-2017-1000394Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-fileupload library with the denial-of-service vulnerability knorg.jenkins-ci.main:jenkins-core
- CVE-2017-1000395Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with Ovorg.jenkins-ci.main:jenkins-core
- CVE-2017-1000396Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that iorg.jenkins-ci.main:jenkins-core
- CVE-2017-1000397Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrecorg.jenkins-ci.main:maven-plugin
- CVE-2017-1000398The remote API in Jenkins 2.73.1 and earlier, 2.83 and earlier at /computer/(agent-name)/api showed information about tasks (typically buildorg.jenkins-ci.main:jenkins-core
- CVE-2017-1000399The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /queue/item/(ID)/api showed information about tasks in the queue (typically borg.jenkins-ci.main:jenkins-core
- CVE-2017-1000400The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream projeorg.jenkins-ci.main:jenkins-core
- CVE-2017-1000401The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validatiorg.jenkins-ci.main:jenkins-core
- CVE-2017-1000402Jenkins Swarm Plugin Client 3.4 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that inorg.jenkins-ci.plugins:swarm-client · org.jvnet.hudson.plug…
- CVE-2017-1000403Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVMorg.jvnet.hudson.plugins:speaks
- CVE-2017-1000404The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScrse.diabol.jenkins.pipeline:delivery-pipeline-plugin
- CVE-2017-14592Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling.Atlassian Sourcetree for macOS
- CVE-2017-14593Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling.Atlassian Sourcetree for Windows
- CVE-2018-1342A Vulnerability exists on Admin Console where an attacker can upload files to the Admin Console server, and potentially execute them.Micro Focus NetIQ Access Manager, Administrative Console
- CVE-2017-3762Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon credentials and fingerpLenovo Group Lenovo Fingerprint Manager Pro