# CVEs published 2018-01-30

23 CVEs were published on January 30, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-6405](https://cve.now/CVE-2018-6405.md): In the ReadDCMImage function in coders/dcm.c in ImageMagick before 7.0.7-23, each redmap, greenmap, and bluemap variable can be overwritten (no CVSS)
- [CVE-2018-6406](https://cve.now/CVE-2018-6406.md): The function ParseVP9SuperFrameIndex in common/libwebm\_util.cc in libwebm through 2018-01-30 does not validate the child\_frame\_length data o (no CVSS)
- [CVE-2018-6407](https://cve.now/CVE-2018-6407.md): An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. (no CVSS)
- [CVE-2018-6408](https://cve.now/CVE-2018-6408.md): An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. (no CVSS)
- [CVE-2011-2902](https://cve.now/CVE-2011-2902.md): zxpdf in xpdf before 3.02-19 as packaged in Debian unstable and 3.02-12+squeeze1 as packaged in Debian squeeze deletes temporary files insec (no CVSS)
- [CVE-2016-6598](https://cve.now/CVE-2016-6598.md): BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010. (no CVSS)
- [CVE-2016-6599](https://cve.now/CVE-2016-6599.md): BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. (no CVSS)
- [CVE-2018-5441](https://cve.now/CVE-2018-5441.md): An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. (no CVSS, PHOENIX CONTACT mGuard)
- [CVE-2018-6194](https://cve.now/CVE-2018-6194.md): A cross-site scripting (XSS) vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin (wp-splashing-ima (no CVSS)
- [CVE-2018-6195](https://cve.now/CVE-2018-6195.md): admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authentica (no CVSS)
- [CVE-2017-1000141](https://cve.now/CVE-2017-1000141.md): An issue was discovered in Mahara before 18.10.0. (no CVSS)
- [CVE-2017-1731](https://cve.now/CVE-2017-1731.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security when using the Administrative Console. (no CVSS, IBM WebSphere Application Server)
- [CVE-2014-4705](https://cve.now/CVE-2014-4705.md): Multiple heap-based buffer overflows in the eSap software platform in Huawei Campus S9300, S7700, S9700, S5300, S5700, S6300, and S6700 seri (no CVSS)
- [CVE-2018-6355](https://cve.now/CVE-2018-6355.md): /goform/setLang on iBall 300M devices with "iB-WRB302N\_1.0.1-Sep 8 2017" firmware has Unauthenticated Stored Cross Site Scripting via the la (no CVSS)
- [CVE-2018-6376](https://cve.now/CVE-2018-6376.md): In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor post (no CVSS)
- [CVE-2018-6377](https://cve.now/CVE-2018-6377.md): In Joomla! before 3.8.4, inadequate input filtering in com\_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, (no CVSS)
- [CVE-2018-6379](https://cve.now/CVE-2018-6379.md): In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability. (no CVSS)
- [CVE-2018-6380](https://cve.now/CVE-2018-6380.md): In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system. (no CVSS)
- [CVE-2017-17969](https://cve.now/CVE-2017-17969.md): Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to c (no CVSS)
- [CVE-2018-6395](https://cve.now/CVE-2018-6395.md): SQL Injection exists in the Visual Calendar 3.1.3 component for Joomla! via the id parameter in a view=load action. (no CVSS)
- [CVE-2018-6397](https://cve.now/CVE-2018-6397.md): Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter. (no CVSS)
- [CVE-2018-6398](https://cve.now/CVE-2018-6398.md): SQL Injection exists in the CP Event Calendar 3.0.1 component for Joomla! via the id parameter in a task=load action. (no CVSS)
- [CVE-2018-6382](https://cve.now/CVE-2018-6382.md): MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.