# CVEs published 2018-01-31

39 CVEs were published on January 31, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2017-16911](https://cve.now/CVE-2017-16911.md): The vhci\_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to disclose kernel memory addresses. (no CVSS, Flexera Software Linux Kernel)
- [CVE-2017-16912](https://cve.now/CVE-2017-16912.md): The "get\_pipe()" function (drivers/usb/usbip/stub\_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 allows attackers to c (no CVSS, Flexera Software Linux Kernel)
- [CVE-2017-16913](https://cve.now/CVE-2017-16913.md): The "stub\_recv\_cmd\_submit()" function (drivers/usb/usbip/stub\_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 when hand (no CVSS, Flexera Software Linux Kernel)
- [CVE-2017-16914](https://cve.now/CVE-2017-16914.md): The "stub\_send\_ret\_submit()" function (drivers/usb/usbip/stub\_tx.c) in the Linux Kernel before version 4.14.8, 4.9.71, 4.1.49, and 4.4.107 a (no CVSS, Flexera Software Linux Kernel)
- [CVE-2018-6374](https://cve.now/CVE-2018-6374.md): The GUI component (aka PulseUI) in Pulse Secure Desktop Linux clients before PULSE5.2R9.2 and 5.3.x before PULSE5.3R4.2 does not perform str (no CVSS)
- [CVE-2017-15653](https://cve.now/CVE-2017-15653.md): Improper administrator IP validation after his login in the HTTPd server in all current versions (\<= 3.0.0.4.380.7743) of Asus asuswrt allow (no CVSS)
- [CVE-2017-15654](https://cve.now/CVE-2017-15654.md): Highly predictable session tokens in the HTTPd server in all current versions (\<= 3.0.0.4.380.7743) of Asus asuswrt allow gaining administra (no CVSS)
- [CVE-2017-15655](https://cve.now/CVE-2017-15655.md): Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version \<=3.0.0.4.376.X. (no CVSS)
- [CVE-2017-15656](https://cve.now/CVE-2017-15656.md): Password are stored in plaintext in nvram in the HTTPd server in all current versions (\<= 3.0.0.4.380.7743) of Asus asuswrt. (no CVSS)
- [CVE-2017-16928](https://cve.now/CVE-2017-16928.md): The arq\_updater binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privileges (no CVSS)
- [CVE-2017-16945](https://cve.now/CVE-2017-16945.md): The standardrestorer binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privil (no CVSS)
- [CVE-2017-18043](https://cve.now/CVE-2017-18043.md): Integer overflow in the macro ROUND\_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of service (Qemu process crash). (no CVSS)
- [CVE-2018-0136](https://cve.now/CVE-2018-0136.md): A vulnerability in the IPv6 subsystem of Cisco IOS XR Software Release 5.3.4 for the Cisco Aggregation Services Router (ASR) 9000 Series cou (no CVSS, Cisco Aggregation Services Router 9000 Series)
- [CVE-2018-6479](https://cve.now/CVE-2018-6479.md): An issue was discovered on Netwave IP Camera devices. (no CVSS)
- [CVE-2018-6480](https://cve.now/CVE-2018-6480.md): A type confusion issue was discovered in CCN-lite 2, leading to a memory access violation and a failure of the nonce feature (which, for exa (no CVSS)
- [CVE-2018-6471](https://cve.now/CVE-2018-6471.md): In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or po (no CVSS)
- [CVE-2018-6472](https://cve.now/CVE-2018-6472.md): In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or po (no CVSS)
- [CVE-2018-6473](https://cve.now/CVE-2018-6473.md): In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or po (no CVSS)
- [CVE-2018-6474](https://cve.now/CVE-2018-6474.md): In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or po (no CVSS)
- [CVE-2018-6475](https://cve.now/CVE-2018-6475.md): In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Privileges. (no CVSS)
- [CVE-2018-6476](https://cve.now/CVE-2018-6476.md): In SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\\SYSTEM because of not v (no CVSS)
- [CVE-2014-1631](https://cve.now/CVE-2014-1631.md): Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php. (no CVSS)
- [CVE-2014-1632](https://cve.now/CVE-2014-1632.md): htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter. (no CVSS)
- [CVE-2018-5701](https://cve.now/CVE-2018-5701.md): In Iolo System Shield AntiVirus and AntiSpyware 5.0.0.136, the amp.sys driver file contains an Arbitrary Write vulnerability due to not vali (no CVSS)
- [CVE-2018-5996](https://cve.now/CVE-2018-5996.md): Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory c (no CVSS)
- [CVE-2018-6462](https://cve.now/CVE-2018-6462.md): Tracker PDF-XChange Viewer and Viewer AX SDK before 2.5.322.8 mishandle conversion from YCC to RGB colour spaces by calculating on the basis (no CVSS)
- [CVE-2018-6464](https://cve.now/CVE-2018-6464.md): Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1. (no CVSS, simditor)
- [CVE-2018-6465](https://cve.now/CVE-2018-6465.md): The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-em (no CVSS)
- [CVE-2018-6460](https://cve.now/CVE-2018-6460.md): Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. (no CVSS)
- [CVE-2017-8916](https://cve.now/CVE-2017-8916.md): In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail (no CVSS)
- [CVE-2018-6384](https://cve.now/CVE-2018-6384.md): Unquoted Windows search path vulnerability in NSClient++ before 0.4.1.73 allows non-privileged local users to execute arbitrary code with el (no CVSS)
- [CVE-2017-1233](https://cve.now/CVE-2017-1233.md): IBM Remote Control v9 could allow a local user to use the component to replace files to which he does not have write access and which he can (no CVSS, IBM BigFix Remote Control)
- [CVE-2017-1773](https://cve.now/CVE-2017-1773.md): IBM DataPower Gateways 7.1, 7,2, 7.5, and 7.6 could allow an attacker using man-in-the-middle techniques to spoof DNS responses to perform D (no CVSS, IBM DataPower Gateways)
- [CVE-2017-1000411](https://cve.now/CVE-2017-1000411.md): OpenFlow Plugin and OpenDayLight Controller versions Nitrogen, Carbon, Boron, Robert Varga, Anil Vishnoi contain a flaw when multiple 'expir (no CVSS)
- [CVE-2017-15698](https://cve.now/CVE-2017-15698.md): When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not co (no CVSS, Apache Software Foundation Apache Tomcat Native)
- [CVE-2017-15706](https://cve.now/CVE-2017-15706.md): As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7 (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2017-16858](https://cve.now/CVE-2017-16858.md): The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 al (no CVSS, Atlassian Crowd)
- [CVE-2018-1000001](https://cve.now/CVE-2018-1000001.md): In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer (no CVSS)
- [CVE-2018-6412](https://cve.now/CVE-2018-6412.md): In the function sbusfb\_ioctl\_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.