# CVEs published 2018-01-29

36 CVEs were published on January 29, 2018: 1 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2016-10711](https://cve.now/CVE-2016-10711.md): Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751. (no CVSS)
- [CVE-2018-0101](https://cve.now/CVE-2018-0101.md): A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an u (no CVSS, Cisco Adaptive Security Appliance)
- [CVE-2018-3835](https://cve.now/CVE-2018-3835.md): An exploitable out of bounds write vulnerability exists in version 2.2 of the Per Face Texture mapping application known as PTEX. (CVSS 8.8, Talos Walt Disney Animation Studios PTEX)
- [CVE-2018-6393](https://cve.now/CVE-2018-6393.md): FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order parameter. (no CVSS)
- [CVE-2017-15133](https://cve.now/CVE-2017-15133.md): A denial of service flaw was found in miekg-dns before 1.0.4. (no CVSS, Miek Gieben miekg-dns · github.com/miekg/dns)
- [CVE-2017-9513](https://cve.now/CVE-2017-9513.md): Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any C (no CVSS, Atlassian Activity Streams)
- [CVE-2018-6390](https://cve.now/CVE-2018-6390.md): The WStr::assign function in kso.dll in Kingsoft WPS Office 10.1.0.7106 and 10.2.0.5978 does not validate the size of the source memory bloc (no CVSS)
- [CVE-2018-6391](https://cve.now/CVE-2018-6391.md): A cross-site request forgery web vulnerability has been discovered on Netis WF2419 V2.2.36123 devices. (no CVSS)
- [CVE-2018-6392](https://cve.now/CVE-2018-6392.md): The filter\_slice function in libavfilter/vf\_transpose.c in FFmpeg through 3.4.1 allows remote attackers to cause a denial of service (out-of (no CVSS)
- [CVE-2018-6383](https://cve.now/CVE-2018-6383.md): Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .pha (no CVSS)
- [CVE-2018-6387](https://cve.now/CVE-2018-6387.md): iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices have a hardcoded password of admin for the admin account, a hardcoded password of sup (no CVSS)
- [CVE-2018-6388](https://cve.now/CVE-2018-6388.md): iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices allow remote authenticated users to execute arbitrary OS commands via shell metachara (no CVSS)
- [CVE-2017-1000353](https://cve.now/CVE-2017-1000353.md): Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. (CVSS 9.8, KEV, org.jenkins-ci.main:jenkins-core)
- [CVE-2017-1000354](https://cve.now/CVE-2017-1000354.md): Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkin (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2017-1000355](https://cve.now/CVE-2017-1000355.md): Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2017-1000356](https://cve.now/CVE-2017-1000356.md): Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication r (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2017-12626](https://cve.now/CVE-2017-12626.md): Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, (CVSS 7.5, Apache Software Foundation Apache POI · org.apache.poi:poi)
- [CVE-2018-6381](https://cve.now/CVE-2018-6381.md): In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.56 there is a segmenta (no CVSS)
- [CVE-2017-14190](https://cve.now/CVE-2017-14190.md): A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrar (no CVSS, Fortinet FortiOS)
- [CVE-2017-14698](https://cve.now/CVE-2017-14698.md): ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10\_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N (no CVSS)
- [CVE-2017-14699](https://cve.now/CVE-2017-14699.md): Multiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, (no CVSS)
- [CVE-2017-1779](https://cve.now/CVE-2017-1779.md): IBM Cognos Analytics 11.0 could store cached credentials locally that could be obtained by a local user. (no CVSS, IBM Cognos Analytics)
- [CVE-2017-1783](https://cve.now/CVE-2017-1783.md): IBM Cognos Analytics 11.0 could allow a local user to change parameters set from the Cognos Analytics menus without proper authentication. (no CVSS, IBM Cognos Analytics)
- [CVE-2017-1784](https://cve.now/CVE-2017-1784.md): IBM Cognos Analytics 11.0 could produce results in temporary files that contain highly sensitive information that can be read by a local use (no CVSS, IBM Cognos Analytics)
- [CVE-2017-4947](https://cve.now/CVE-2017-4947.md): VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xeno (no CVSS, VMware vRealize Automation · VMware vSphere Integrated Cont…)
- [CVE-2017-4951](https://cve.now/CVE-2017-4951.md): VMware AirWatch Console (9.2.x before 9.2.2 and 9.1.x before 9.1.5) contains a Cross Site Request Forgery vulnerability when accessing the A (no CVSS, VMware AirWatch Console)
- [CVE-2018-1364](https://cve.now/CVE-2018-1364.md): IBM Content Navigator 2.0 and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. (no CVSS, IBM Content Navigator)
- [CVE-2017-18078](https://cve.now/CVE-2017-18078.md): systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected\_hardlin (no CVSS)
- [CVE-2017-18079](https://cve.now/CVE-2017-18079.md): drivers/input/serio/i8042.c in the Linux kernel before 4.12.4 allows attackers to cause a denial of service (NULL pointer dereference and sy (no CVSS)
- [CVE-2018-5720](https://cve.now/CVE-2018-5720.md): An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices. (no CVSS)
- [CVE-2018-6007](https://cve.now/CVE-2018-6007.md): CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket. (no CVSS)
- [CVE-2018-6008](https://cve.now/CVE-2018-6008.md): Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download\_file parameter. (no CVSS)
- [CVE-2018-6363](https://cve.now/CVE-2018-6363.md): SQL Injection exists in Task Rabbit Clone 1.0 via the single\_blog.php id parameter. (no CVSS)
- [CVE-2018-6364](https://cve.now/CVE-2018-6364.md): SQL Injection exists in Multilanguage Real Estate MLM Script through 3.0 via the /product-list.php srch parameter. (no CVSS)
- [CVE-2018-6365](https://cve.now/CVE-2018-6365.md): SQL Injection exists in TSiteBuilder 1.0 via the id parameter to /site.php, /pagelist.php, or /page\_new.php. (no CVSS)
- [CVE-2018-6367](https://cve.now/CVE-2018-6367.md): SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chat\_im/chat\_window.php request\_id parameter or the /search\_e (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.