# CVEs published 2019-01-17

12 CVEs were published on January 17, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2018-20735](https://cve.now/CVE-2018-20735.md): An issue was discovered in BMC PATROL Agent through 11.3.01. (no CVSS)
- [CVE-2019-0624](https://cve.now/CVE-2019-0624.md): A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for (no CVSS, Microsoft Skype)
- [CVE-2019-0646](https://cve.now/CVE-2019-0646.md): A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foun (no CVSS, Microsoft Team)
- [CVE-2019-0647](https://cve.now/CVE-2019-0647.md): An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Fo (no CVSS, Microsoft Team)
- [CVE-2018-20727](https://cve.now/CVE-2018-20727.md): Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt pa (no CVSS)
- [CVE-2018-20728](https://cve.now/CVE-2018-20728.md): A cross site request forgery (CSRF) vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.p (no CVSS)
- [CVE-2018-20729](https://cve.now/CVE-2018-20729.md): A reflected cross site scripting (XSS) vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2018-20730](https://cve.now/CVE-2018-20730.md): A SQL injection vulnerability in NeDi before 1.7Cp3 allows any user to execute arbitrary SQL read commands via the query.php component. (no CVSS)
- [CVE-2018-20731](https://cve.now/CVE-2018-20731.md): A stored cross site scripting (XSS) vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via U (no CVSS)
- [CVE-2015-9281](https://cve.now/CVE-2015-9281.md): Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page. (no CVSS)
- [CVE-2018-20732](https://cve.now/CVE-2018-20732.md): SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code via a Java deserialization variant. (no CVSS)
- [CVE-2018-20733](https://cve.now/CVE-2018-20733.md): BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-01-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.