CVEs published February 1, 2018
28 CVEs were published on February 1, 2018: 0 critical, 0 high.
- Published
- 28
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- epg search result viewer
- 3
- Puppet Enterprise
- 3
- Apache Software Foundation Apache Cordova Android
- 1
- Atlassian Fisheye and Crucible
- 1
- Cloud Foundry Foundation cf-release versions prior to v285;…
- 1
- Jordy Meow WP Retina
- 1
Medium, low and unrated 28
- CVE-2017-2293Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to insPuppet Enterprise
- CVE-2017-2296In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group naPuppet Enterprise
- CVE-2017-2297Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens.Puppet Enterprise
- CVE-2017-3160After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetchApache Software Foundation Apache Cordova Android
- CVE-2018-1192In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.Cloud Foundry Foundation cf-release versions prior to v285;…
- CVE-2011-4068The check_password function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empt
- CVE-2011-4069html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentic
- CVE-2013-7435The open-ils.pcrud endpoint in Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to obtain sensitiv
- CVE-2014-3005XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.
- CVE-2014-3244XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files
- CVE-2014-3519The open_by_handle_at function in vzkernel before 042stab090.5 in the OpenVZ modification for the Linux kernel 2.6.32, when using simfs, mig
- CVE-2014-3752The MiniIcpt.sys driver in G Data TotalProtection 2014 24.0.2.1 and earlier allows local users with administrator rights to execute arbitrar
- CVE-2014-9502Multiple cross-site request forgery (CSRF) vulnerabilities in unspecified sub modules in the Open Atrium module 7.x-2.x before 7.x-2.26 for
- CVE-2014-9503The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with "access conte
- CVE-2014-9504The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child g
- CVE-2015-2203Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sensitive settings history informa
- CVE-2015-2204Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obta
- CVE-2018-0508Cross-site scripting vulnerability in epg search result viewer (kkcald) 0.7.21 and earlier allows an attacker to inject arbitrary web scriptepg search result viewer
- CVE-2018-0509Cross-site request forgery (CSRF) vulnerability in epg search result viewer (kkcald) 0.7.21 and earlier allows an attacker to hijack the autepg search result viewer
- CVE-2018-0510Buffer overflow in epg search result viewer (kkcald) 0.7.19 and earlier allows remote attackers to perform unintended operations or execute epg search result viewer
- CVE-2018-0511Cross-site scripting vulnerability in WP Retina 2x prior to version 5.2.2 allows an attacker to inject arbitrary web script or HTML via unspJordy Meow WP Retina
- CVE-2018-6186Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF attack via the /rapi/read_url URI by an authenticated attacker who has a webapp
- CVE-2018-6485An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and ear
- CVE-2018-6470Nibbleblog 4.0.5 on macOS defaults to having .DS_Store in each directory, causing DS_Store information to leak.
- CVE-2018-6484In ZZIPlib 0.13.67, there is a memory alignment error and bus error in the __zzip_fetch_disk_trailer function of zzip/zip.c.
- CVE-2017-1000408A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable.
- CVE-2017-1000409A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable.
- CVE-2017-16861It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur.Atlassian Fisheye and Crucible