CVEs published January 29, 2018
36 CVEs were published on January 29, 2018: 1 critical, 2 high. 1 is now in CISA KEV.
- Published
- 36
- Critical
- 1
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 1
- Fix available
- 6
Most affected products
- org.jenkins-ci.main:jenkins-core
- 4
- IBM Cognos Analytics
- 3
- Apache Software Foundation Apache POI · org.apache.poi:poi
- 1
- Atlassian Activity Streams
- 1
- Cisco Adaptive Security Appliance
- 1
- Fortinet FortiOS
- 1
- IBM Content Navigator
- 1
- Miek Gieben miekg-dns · github.com/miekg/dns
- 1
- Talos Walt Disney Animation Studios PTEX
- 1
- VMware AirWatch Console
- 1
Critical 1
High 2
- CVE-2018-3835An exploitable out of bounds write vulnerability exists in version 2.2 of the Per Face Texture mapping application known as PTEX.Talos Walt Disney Animation Studios PTEX
- CVE-2017-12626Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, Apache Software Foundation Apache POI · org.apache.poi:poi
Medium, low and unrated 33
- CVE-2016-10711Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751.
- CVE-2018-0101A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an uCisco Adaptive Security Appliance
- CVE-2018-6393FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order parameter.
- CVE-2017-15133A denial of service flaw was found in miekg-dns before 1.0.4.Miek Gieben miekg-dns · github.com/miekg/dns
- CVE-2017-9513Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any CAtlassian Activity Streams
- CVE-2018-6390The WStr::assign function in kso.dll in Kingsoft WPS Office 10.1.0.7106 and 10.2.0.5978 does not validate the size of the source memory bloc
- CVE-2018-6391A cross-site request forgery web vulnerability has been discovered on Netis WF2419 V2.2.36123 devices.
- CVE-2018-6392The filter_slice function in libavfilter/vf_transpose.c in FFmpeg through 3.4.1 allows remote attackers to cause a denial of service (out-of
- CVE-2018-6383Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .pha
- CVE-2018-6387iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices have a hardcoded password of admin for the admin account, a hardcoded password of sup
- CVE-2018-6388iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices allow remote authenticated users to execute arbitrary OS commands via shell metachara
- CVE-2017-1000354Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkinorg.jenkins-ci.main:jenkins-core
- CVE-2017-1000355Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate voidorg.jenkins-ci.main:jenkins-core
- CVE-2017-1000356Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication rorg.jenkins-ci.main:jenkins-core
- CVE-2018-6381In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.56 there is a segmenta
- CVE-2017-14190A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrarFortinet FortiOS
- CVE-2017-14698ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N
- CVE-2017-14699Multiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1,
- CVE-2017-1779IBM Cognos Analytics 11.0 could store cached credentials locally that could be obtained by a local user.IBM Cognos Analytics
- CVE-2017-1783IBM Cognos Analytics 11.0 could allow a local user to change parameters set from the Cognos Analytics menus without proper authentication.IBM Cognos Analytics
- CVE-2017-1784IBM Cognos Analytics 11.0 could produce results in temporary files that contain highly sensitive information that can be read by a local useIBM Cognos Analytics
- CVE-2017-4947VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via XenoVMware vRealize Automation · VMware vSphere Integrated Cont…
- CVE-2017-4951VMware AirWatch Console (9.2.x before 9.2.2 and 9.1.x before 9.1.5) contains a Cross Site Request Forgery vulnerability when accessing the AVMware AirWatch Console
- CVE-2018-1364IBM Content Navigator 2.0 and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data.IBM Content Navigator
- CVE-2017-18078systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlin
- CVE-2017-18079drivers/input/serio/i8042.c in the Linux kernel before 4.12.4 allows attackers to cause a denial of service (NULL pointer dereference and sy
- CVE-2018-5720An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices.
- CVE-2018-6007CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket.
- CVE-2018-6008Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file parameter.
- CVE-2018-6363SQL Injection exists in Task Rabbit Clone 1.0 via the single_blog.php id parameter.
- CVE-2018-6364SQL Injection exists in Multilanguage Real Estate MLM Script through 3.0 via the /product-list.php srch parameter.
- CVE-2018-6365SQL Injection exists in TSiteBuilder 1.0 via the id parameter to /site.php, /pagelist.php, or /page_new.php.
- CVE-2018-6367SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chat_im/chat_window.php request_id parameter or the /search_e