# CVEs published 2018-01-26 55 CVEs were published on January 26, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2016-2983](https://cve.now/CVE-2016-2983.md): IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker under unusual circumstances to read operational data or TL (no CVSS, IBM Tealeaf Customer Experience) - [CVE-2017-1204](https://cve.now/CVE-2017-1204.md): IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 contains hard-coded credentials. (no CVSS, IBM Tealeaf Customer Experience) - [CVE-2017-1279](https://cve.now/CVE-2017-1279.md): IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker to traverse directories on the system. (no CVSS, IBM Tealeaf Customer Experience) - [CVE-2017-1506](https://cve.now/CVE-2017-1506.md): IBM Cognos TM1 10.2 and 10.2.2 is vulnerable to cross-site scripting. (no CVSS, IBM Cognos TM1) - [CVE-2017-1515](https://cve.now/CVE-2017-1515.md): IBM Doors Web Access 9.5 and 9.6 could allow an authenticated user to obtain sensitive information from HTTP internal server error responses (no CVSS, IBM Rational DOORS) - [CVE-2017-1516](https://cve.now/CVE-2017-1516.md): IBM Doors Web Access 9.5 and 9.6 could allow a remote attacker to hijack the clicking action of the victim. (no CVSS, IBM Rational DOORS) - [CVE-2017-1532](https://cve.now/CVE-2017-1532.md): IBM DOORS 9.5 and 9.6 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS) - [CVE-2017-1540](https://cve.now/CVE-2017-1540.md): IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS) - [CVE-2017-1545](https://cve.now/CVE-2017-1545.md): IBM Doors Web Access 9.5 and 9.6 could allow an attacker with physical access to the system to log into the application using previously sto (no CVSS, IBM Rational DOORS) - [CVE-2017-1563](https://cve.now/CVE-2017-1563.md): IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS) - [CVE-2017-1567](https://cve.now/CVE-2017-1567.md): IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. (no CVSS, IBM Rational DOORS) - [CVE-2017-1653](https://cve.now/CVE-2017-1653.md): IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 6.0.x) is vulnerable to cross-site scripting. (no CVSS, IBM Rational Collaborative Lifecycle Management) - [CVE-2016-6217](https://cve.now/CVE-2016-6217.md): Cross-site scripting (XSS) vulnerability in Sophos PureMessage for UNIX before 6.3.2 allows remote attackers to inject arbitrary web script (no CVSS) - [CVE-2017-12374](https://cve.now/CVE-2017-12374.md): The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to caus (no CVSS, ClamAV AntiVirus software versions 0.99.2 and prior) - [CVE-2017-12375](https://cve.now/CVE-2017-12375.md): The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to caus (no CVSS, ClamAV AntiVirus software versions 0.99.2 and prior) - [CVE-2017-12376](https://cve.now/CVE-2017-12376.md): ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a (no CVSS, ClamAV AntiVirus software versions 0.99.2 and prior) - [CVE-2017-12377](https://cve.now/CVE-2017-12377.md): ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a (no CVSS, ClamAV AntiVirus software versions 0.99.2 and prior) - [CVE-2017-12378](https://cve.now/CVE-2017-12378.md): ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a (no CVSS, ClamAV AntiVirus software versions 0.99.2 and prior) - [CVE-2017-12379](https://cve.now/CVE-2017-12379.md): ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a (no CVSS, ClamAV AntiVirus software versions 0.99.2 and prior) - [CVE-2017-12380](https://cve.now/CVE-2017-12380.md): ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a (no CVSS, ClamAV AntiVirus software versions 0.99.2 and prior) - [CVE-2017-14521](https://cve.now/CVE-2017-14521.md): In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload. (no CVSS) - [CVE-2017-14522](https://cve.now/CVE-2017-14522.md): In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. (CVSS 6.1) - [CVE-2017-14523](https://cve.now/CVE-2017-14523.md): WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. (no CVSS) - [CVE-2017-17976](https://cve.now/CVE-2017-17976.md): In Utilities.php in Perfex CRM 1.9.7, Unrestricted file upload can lead to remote code execution. (no CVSS) - [CVE-2018-6015](https://cve.now/CVE-2018-6015.md): An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. (no CVSS) - [CVE-2017-18076](https://cve.now/CVE-2017-18076.md): In strategy.rb in OmniAuth before 1.3.2, the authenticity\_token value is improperly protected because POST (in addition to GET) parameters a (no CVSS, omniauth) - [CVE-2017-3768](https://cve.now/CVE-2017-3768.md): An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for Len (no CVSS, Lenovo Group Integrated Management Module) - [CVE-2018-5750](https://cve.now/CVE-2018-5750.md): The acpi\_smbus\_hc\_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain sensitive address in (no CVSS) - [CVE-2017-2166](https://cve.now/CVE-2017-2166.md): Open redirect vulnerability in GroupSession version 4.7.0 and earlier allows an attacker to redirect users to arbitrary web sites and conduc (no CVSS, Japan Total System Co. GroupSession) - [CVE-2018-0506](https://cve.now/CVE-2018-0506.md): Nootka 1.4.4 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. (no CVSS, SeeLook Nootka) - [CVE-2018-0507](https://cve.now/CVE-2018-0507.md): Untrusted search path vulnerability in FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.11 and earlier versions, FLET'S VIRUS CLEAR v6 E (no CVSS, NIPPON TELEGRAPH AND TELEPHONE EAST FLET'S VIRUS CLEAR Easy…) - [CVE-2018-6323](https://cve.now/CVE-2018-6323.md): The elf\_object\_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has (no CVSS) - [CVE-2017-1000386](https://cve.now/CVE-2017-1000386.md): Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on (no CVSS, org.biouno:uno-choice) - [CVE-2017-1000387](https://cve.now/CVE-2017-1000387.md): Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build\_publi (no CVSS, org.jenkins-ci.plugins:build-publisher) - [CVE-2017-1000388](https://cve.now/CVE-2017-1000388.md): Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency (no CVSS, org.jenkins-ci.plugins:depgraph-view) - [CVE-2017-1000389](https://cve.now/CVE-2017-1000389.md): Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. (no CVSS, org.jenkins-ci.plugins:global-build-stats) - [CVE-2017-1000390](https://cve.now/CVE-2017-1000390.md): Jenkins Multijob plugin version 1.25 and earlier did not check permissions in the Resume Build action, allowing anyone with Job/Read permiss (no CVSS, org.jenkins-ci.plugins:jenkins-multijob-plugin) - [CVE-2017-1000391](https://cve.now/CVE-2017-1000391.md): Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as wel (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2017-1000392](https://cve.now/CVE-2017-1000392.md): Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-sit (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2017-1000393](https://cve.now/CVE-2017-1000393.md): Jenkins 2.73.1 and earlier, 2.83 and earlier users with permission to create or configure agents in Jenkins could configure a launch method (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2017-1000394](https://cve.now/CVE-2017-1000394.md): Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-fileupload library with the denial-of-service vulnerability kn (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2017-1000395](https://cve.now/CVE-2017-1000395.md): Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with Ov (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2017-1000396](https://cve.now/CVE-2017-1000396.md): Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that i (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2017-1000397](https://cve.now/CVE-2017-1000397.md): Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrec (no CVSS, org.jenkins-ci.main:maven-plugin) - [CVE-2017-1000398](https://cve.now/CVE-2017-1000398.md): The remote API in Jenkins 2.73.1 and earlier, 2.83 and earlier at /computer/(agent-name)/api showed information about tasks (typically build (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2017-1000399](https://cve.now/CVE-2017-1000399.md): The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /queue/item/(ID)/api showed information about tasks in the queue (typically b (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2017-1000400](https://cve.now/CVE-2017-1000400.md): The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream proje (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2017-1000401](https://cve.now/CVE-2017-1000401.md): The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, \, supports form validati (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2017-1000402](https://cve.now/CVE-2017-1000402.md): Jenkins Swarm Plugin Client 3.4 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that in (no CVSS, org.jenkins-ci.plugins:swarm-client · org.jvnet.hudson.plug…) - [CVE-2017-1000403](https://cve.now/CVE-2017-1000403.md): Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVM (no CVSS, org.jvnet.hudson.plugins:speaks) - [CVE-2017-1000404](https://cve.now/CVE-2017-1000404.md): The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScr (no CVSS, se.diabol.jenkins.pipeline:delivery-pipeline-plugin) - [CVE-2017-14592](https://cve.now/CVE-2017-14592.md): Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. (no CVSS, Atlassian Sourcetree for macOS) - [CVE-2017-14593](https://cve.now/CVE-2017-14593.md): Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. (no CVSS, Atlassian Sourcetree for Windows) - [CVE-2018-1342](https://cve.now/CVE-2018-1342.md): A Vulnerability exists on Admin Console where an attacker can upload files to the Admin Console server, and potentially execute them. (no CVSS, Micro Focus NetIQ Access Manager, Administrative Console) - [CVE-2017-3762](https://cve.now/CVE-2017-3762.md): Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon credentials and fingerp (no CVSS, Lenovo Group Lenovo Fingerprint Manager Pro) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-01-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.