CVEs published in January 2018
1,346 vulnerabilities, 169 critical, 4 exploited.
- syncthingSyncthing vulnerable to symlink traversal and arbitrary file overwrite7.5 High
- phpbbphpBB Server-Side Request Forgery (SSRF)7.5 High
- broBro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer...9.8 Critical
- mojoportalCross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote...4.8 Medium
- mindwerks wildmidiThe WildMidi_Open function in WildMIDI since commit d8a466829c67cacbb1700beded25c448d99514e5...7.8 High
- ibm mq, websphere mq +1 moreIBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user with authority to send a specially...4.3 Medium
- gnu guixsdGuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links...5.5 Medium
- cmsmadesimple cms made simpleCMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core...7.8 High
- cmsmadesimple cms made simpleCMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core...9.8 Critical
- samlify project samlifySamlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames7.5 High
- fs-git project fs-gitfs-git command injection vulnerability7.8 High
- opencv, debian linux +1 moreInteger Overflow or Wraparound in OpenCV.8.8 High
- structured-data structured data linterStructured Data Linter versions 2.4.1 and older are vulnerable to a directory traversal attack in...7.5 High
- linaro op-teeLinaro's open source TEE solution called OP-TEE, version 2.4.0 (and older) is vulnerable a timing attack in the Montgomery parts of libMPA in OP-TEE resulting in a compromised private RSA key.5.9 Medium
- linaro op-teeLinaro's open source TEE solution called OP-TEE, version 2.4.0 (and older) is vulnerable to the bellcore attack in the LibTomCrypt code resulting in compromised private RSA key.7.5 High
- gps-server gps tracking softwareThe writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted)...9.8 Critical
- gps-server gps tracking softwaregps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that...9.8 Critical
- openhacker project openhackerEleix Openhacker version 0.1.47 is vulnerable to an SQL injection in the account registration and...9.8 Critical
- openhacker project openhackerEleix Openhacker version 0.1.47 is vulnerable to a XSS vulnerability in the bank transactions...6.1 Medium
- passbolt apiPassbolt API is vulnerable to XSS in the url field on the password workspace grid and sidebar5.4 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE...8.8 High
- mozilla firefox, firefox esr +1 moreThe Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary...5.5 Medium
- mozilla firefox, firefox esr +1 moreAn attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and...7.8 High
- mozilla firefox, firefox esr +1 moreThe Mozilla Windows updater modifies some files to be updated by reading the original file and...7.8 High
- mozilla firefox, thunderbird +1 moreThe Gecko Media Plugin sandbox allows access to local files that match specific regular...7.5 High
- mozilla firefox, thunderbird +1 moreA use-after-free can occur during buffer storage operations within the ANGLE graphics library,...7.5 High
- schneider electric se pelco videoxpert enterprise, schneider-electric pelco videoxpert +1 moreA privilege escalation vulnerability exists in Schneider Electric's Pelco VideoXpert Enterprise...7.1 High
- schneider electric se pelco videoxpert enterprise, schneider-electric pelco videoxpert +1 moreAn exposure of sensitive information vulnerability exists in Schneider Electric's Pelco...5.8 Medium
- schneider electric se pelco videoxpert enterprise, schneider-electric pelco videoxpert +1 moreA Path Traversal issue was discovered in Schneider Electric Pelco VideoXpert Enterprise all...6.9 Medium
- wp-unit share this imageThe ILLID Share This Image plugin before 1.04 for WordPress has XSS via the sharer.php url...6.1 Medium
- freedesktop poppler, debian linux +1 morefreedesktop.org libpoppler 0.60.1 fails to validate boundaries in TextPool::addWord, leading to...8.8 High
- imagemagick, canonical ubuntu linux, debian linux +2 moreImageMagick 7.0.7-1 and older version are vulnerable to null pointer dereference in the...6.5 Medium
- pysaml2 project pysaml2, debian linux +1 morepysaml2 Improper Authentication vulnerability8.1 High
- gnome gdk-pixbuf, canonical ubuntu linux, debian linux +2 moreGnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw...8.8 High
- craftcms craft cmsCraft CMS PHP Code Injection Vulnerability8.8 High
- flir brickstream 2300 2d firmware, brickstream 2300 3d\+ firmware, brickstream 2300 3d firmware +2 moregetConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0 4.1.53.166 has Incorrect Access...9.8 Critical
libvirtMageiaUpdated libvirt packages fix security vulnerabilityNo score- z-url preview project previewThe Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter.6.1 Medium
- clickbank affiliate ads for clickbank productsThe MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via...6.1 Medium
- e-goi smart marketing sms and newsletters formsThe E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via...6.1 Medium
- opencvOut-of-bounds Read in OpenCV7.5 High
- oturia smart google code inserterSQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for...9.8 Critical
- oturia smart google code inserterAuthentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5...9.8 Critical
- libtiffIn LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory...6.5 Medium
- imagemagick, canonical ubuntu linux +1 moreIn ImageMagick 7.0.7-17 Q16, there is a Memory Leak in ReadPWPImage in coders/pwp.c.6.5 Medium
- extensis portfolio netpublishnetpub/server.np in Extensis Portfolio NetPublish has XSS in the quickfind parameter, aka Open...6.1 Medium