CVEs published January 31, 2018
39 CVEs were published on January 31, 2018: 0 critical, 0 high.
- Published
- 39
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 39
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Flexera Software Linux Kernel
- 4
- Apache Software Foundation Apache Tomcat · org.apache.tomca…
- 1
- Apache Software Foundation Apache Tomcat Native
- 1
- Atlassian Crowd
- 1
- Cisco Aggregation Services Router 9000 Series
- 1
- IBM BigFix Remote Control
- 1
- IBM DataPower Gateways
- 1
- simditor
- 1
Medium, low and unrated 39
- CVE-2017-16911The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to disclose kernel memory addresses.Flexera Software Linux Kernel
- CVE-2017-16912The "get_pipe()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 allows attackers to cFlexera Software Linux Kernel
- CVE-2017-16913The "stub_recv_cmd_submit()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 when handFlexera Software Linux Kernel
- CVE-2017-16914The "stub_send_ret_submit()" function (drivers/usb/usbip/stub_tx.c) in the Linux Kernel before version 4.14.8, 4.9.71, 4.1.49, and 4.4.107 aFlexera Software Linux Kernel
- CVE-2018-6374The GUI component (aka PulseUI) in Pulse Secure Desktop Linux clients before PULSE5.2R9.2 and 5.3.x before PULSE5.3R4.2 does not perform str
- CVE-2017-15653Improper administrator IP validation after his login in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt allow
- CVE-2017-15654Highly predictable session tokens in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt allow gaining administra
- CVE-2017-15655Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version <=3.0.0.4.376.X.
- CVE-2017-15656Password are stored in plaintext in nvram in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt.
- CVE-2017-16928The arq_updater binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privileges
- CVE-2017-16945The standardrestorer binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privil
- CVE-2017-18043Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of service (Qemu process crash).
- CVE-2018-0136A vulnerability in the IPv6 subsystem of Cisco IOS XR Software Release 5.3.4 for the Cisco Aggregation Services Router (ASR) 9000 Series couCisco Aggregation Services Router 9000 Series
- CVE-2018-6479An issue was discovered on Netwave IP Camera devices.
- CVE-2018-6480A type confusion issue was discovered in CCN-lite 2, leading to a memory access violation and a failure of the nonce feature (which, for exa
- CVE-2018-6471In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or po
- CVE-2018-6472In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or po
- CVE-2018-6473In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or po
- CVE-2018-6474In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or po
- CVE-2018-6475In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Privileges.
- CVE-2018-6476In SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYSTEM because of not v
- CVE-2014-1631Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php.
- CVE-2014-1632htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter.
- CVE-2018-5701In Iolo System Shield AntiVirus and AntiSpyware 5.0.0.136, the amp.sys driver file contains an Arbitrary Write vulnerability due to not vali
- CVE-2018-5996Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory c
- CVE-2018-6462Tracker PDF-XChange Viewer and Viewer AX SDK before 2.5.322.8 mishandle conversion from YCC to RGB colour spaces by calculating on the basis
- CVE-2018-6464Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1.simditor
- CVE-2018-6465The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-em
- CVE-2018-6460Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895.
- CVE-2017-8916In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail
- CVE-2018-6384Unquoted Windows search path vulnerability in NSClient++ before 0.4.1.73 allows non-privileged local users to execute arbitrary code with el
- CVE-2017-1233IBM Remote Control v9 could allow a local user to use the component to replace files to which he does not have write access and which he canIBM BigFix Remote Control
- CVE-2017-1773IBM DataPower Gateways 7.1, 7,2, 7.5, and 7.6 could allow an attacker using man-in-the-middle techniques to spoof DNS responses to perform DIBM DataPower Gateways
- CVE-2017-1000411OpenFlow Plugin and OpenDayLight Controller versions Nitrogen, Carbon, Boron, Robert Varga, Anil Vishnoi contain a flaw when multiple 'expir
- CVE-2017-15698When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not coApache Software Foundation Apache Tomcat Native
- CVE-2017-15706As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7Apache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2017-16858The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 alAtlassian Crowd
- CVE-2018-1000001In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer
- CVE-2018-6412In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows