# CVEs published 2018-02-21

44 CVEs were published on February 21, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-6936](https://cve.now/CVE-2018-6936.md): Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account. (no CVSS)
- [CVE-2018-7281](https://cve.now/CVE-2018-7281.md): CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme. (no CVSS)
- [CVE-2018-7311](https://cve.now/CVE-2018-7311.md): PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. (CVSS 8.8)
- [CVE-2017-1462](https://cve.now/CVE-2017-1462.md): IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Rhapsody Design Manager)
- [CVE-2017-1604](https://cve.now/CVE-2017-1604.md): IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting. (no CVSS, IBM Maximo Anywhere)
- [CVE-2017-1758](https://cve.now/CVE-2017-1758.md): IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager… (no CVSS, IBM Control Center · IBM Financial Transaction Manager +1)
- [CVE-2018-7308](https://cve.now/CVE-2018-7308.md): A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote users to… (no CVSS)
- [CVE-2018-7302](https://cve.now/CVE-2018-7302.md): Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS. (no CVSS, tikiwiki/tiki-manager)
- [CVE-2018-7303](https://cve.now/CVE-2018-7303.md): The Calendar component in Tiki 17.1 allows HTML injection. (no CVSS)
- [CVE-2018-7304](https://cve.now/CVE-2018-7304.md): Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator… (no CVSS)
- [CVE-2018-7305](https://cve.now/CVE-2018-7305.md): MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts. (no CVSS)
- [CVE-2017-12161](https://cve.now/CVE-2017-12161.md): It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset… (no CVSS, Red Hat Keycloak · org.keycloak:keycloak-core)
- [CVE-2018-7289](https://cve.now/CVE-2018-7289.md): An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. (no CVSS)
- [CVE-2013-4891](https://cve.now/CVE-2013-4891.md): The xss\_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct… (no CVSS)
- [CVE-2015-5314](https://cve.now/CVE-2015-5314.md): The eap\_pwd\_process function in eap\_server/eap\_server\_pwd.c in hostapd 2.x before 2.6 does not validate that the reassembly buffer is… (no CVSS)
- [CVE-2015-5315](https://cve.now/CVE-2015-5315.md): The eap\_pwd\_process function in eap\_peer/eap\_pwd.c in wpa\_supplicant 2.x before 2.6 does not validate that the reassembly buffer is large… (no CVSS)
- [CVE-2015-5316](https://cve.now/CVE-2015-5316.md): The eap\_pwd\_perform\_confirm\_exchange function in eap\_peer/eap\_pwd.c in wpa\_supplicant 2.x before 2.6, when EAP-pwd is enabled in a network… (no CVSS)
- [CVE-2015-5725](https://cve.now/CVE-2015-5725.md): SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute… (no CVSS)
- [CVE-2016-0343](https://cve.now/CVE-2016-0343.md): IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to… (no CVSS)
- [CVE-2016-0344](https://cve.now/CVE-2016-0344.md): Cross-site scripting (XSS) vulnerability in the My Reports component in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before… (no CVSS)
- [CVE-2016-0345](https://cve.now/CVE-2016-0345.md): IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to… (no CVSS)
- [CVE-2016-0348](https://cve.now/CVE-2016-0348.md): Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3, 3.3.1, 3.3.2, and 3.4 allows remote attackers to… (no CVSS)
- [CVE-2016-0351](https://cve.now/CVE-2016-0351.md): IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 does not set the secure flag for the session cookie in… (no CVSS)
- [CVE-2016-0366](https://cve.now/CVE-2016-0366.md): IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 might allow remote attackers to obtain sensitive… (no CVSS)
- [CVE-2016-0367](https://cve.now/CVE-2016-0367.md): IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 allows remote authenticated users to obtain sensitive… (no CVSS)
- [CVE-2016-0369](https://cve.now/CVE-2016-0369.md): XML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6 allows remote authenticated users to obtain… (no CVSS)
- [CVE-2018-7261](https://cve.now/CVE-2018-7261.md): There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4. (no CVSS, radiant)
- [CVE-2018-7280](https://cve.now/CVE-2018-7280.md): The Ninja Forms plugin before 3.2.14 for WordPress has XSS. (no CVSS)
- [CVE-2013-0267](https://cve.now/CVE-2013-0267.md): The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 allow remote… (no CVSS)
- [CVE-2015-0203](https://cve.now/CVE-2015-0203.md): The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via an AMQP… (no CVSS)
- [CVE-2015-6569](https://cve.now/CVE-2015-6569.md): Race condition in the LoadBalancer module in the Atlassian Floodlight Controller before 1.2 allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2018-5716](https://cve.now/CVE-2018-5716.md): An issue was discovered in Reprise License Manager 11.0. (no CVSS)
- [CVE-2018-7260](https://cve.now/CVE-2018-7260.md): Cross-site scripting (XSS) vulnerability in db\_central\_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject… (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2018-1164](https://cve.now/CVE-2018-1164.md): This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL… (no CVSS, ZyXEL P-870H-51 DSL Router)
- [CVE-2018-1165](https://cve.now/CVE-2018-1165.md): This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS… (no CVSS, Joyent SmartOS)
- [CVE-2018-1166](https://cve.now/CVE-2018-1166.md): This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS… (no CVSS, Joyent SmartOS)
- [CVE-2018-1168](https://cve.now/CVE-2018-1168.md): This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with FP 1-2-3. (no CVSS, ABB MicroSCADA)
- [CVE-2018-7276](https://cve.now/CVE-2018-7276.md): An issue was discovered on Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) devices. (no CVSS)
- [CVE-2018-7277](https://cve.now/CVE-2018-7277.md): An issue was discovered on RLE Wi-MGR/FDS-Wi 6.2 devices. (no CVSS)
- [CVE-2018-7278](https://cve.now/CVE-2018-7278.md): An issue was discovered on RLE Protocol Converter FDS-PC / FDS-PC-DP 2.1 devices. (no CVSS)
- [CVE-2018-7271](https://cve.now/CVE-2018-7271.md): An issue was discovered in MetInfo 6.0.0. (no CVSS)
- [CVE-2018-7272](https://cve.now/CVE-2018-7272.md): The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information… (no CVSS)
- [CVE-2018-7273](https://cve.now/CVE-2018-7273.md): In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls… (no CVSS)
- [CVE-2018-7274](https://cve.now/CVE-2018-7274.md): Yab Quarx through 2.4.3 is prone to multiple persistent cross-site scripting vulnerabilities: Blog (Title), FAQ (Question), Pages (Title)… (no CVSS, yab/quarx)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-02-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.