# CVEs published 2018-02-01

28 CVEs were published on February 1, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2017-2293](https://cve.now/CVE-2017-2293.md): Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to ins (no CVSS, Puppet Enterprise)
- [CVE-2017-2296](https://cve.now/CVE-2017-2296.md): In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group na (no CVSS, Puppet Enterprise)
- [CVE-2017-2297](https://cve.now/CVE-2017-2297.md): Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. (no CVSS, Puppet Enterprise)
- [CVE-2017-3160](https://cve.now/CVE-2017-3160.md): After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch (no CVSS, Apache Software Foundation Apache Cordova Android)
- [CVE-2018-1192](https://cve.now/CVE-2018-1192.md): In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8. (no CVSS, Cloud Foundry Foundation cf-release versions prior to v285;…)
- [CVE-2011-4068](https://cve.now/CVE-2011-4068.md): The check\_password function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empt (no CVSS)
- [CVE-2011-4069](https://cve.now/CVE-2011-4069.md): html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentic (no CVSS)
- [CVE-2013-7435](https://cve.now/CVE-2013-7435.md): The open-ils.pcrud endpoint in Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to obtain sensitiv (no CVSS)
- [CVE-2014-3005](https://cve.now/CVE-2014-3005.md): XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2. (no CVSS)
- [CVE-2014-3244](https://cve.now/CVE-2014-3244.md): XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files (no CVSS)
- [CVE-2014-3519](https://cve.now/CVE-2014-3519.md): The open\_by\_handle\_at function in vzkernel before 042stab090.5 in the OpenVZ modification for the Linux kernel 2.6.32, when using simfs, mig (no CVSS)
- [CVE-2014-3752](https://cve.now/CVE-2014-3752.md): The MiniIcpt.sys driver in G Data TotalProtection 2014 24.0.2.1 and earlier allows local users with administrator rights to execute arbitrar (no CVSS)
- [CVE-2014-9502](https://cve.now/CVE-2014-9502.md): Multiple cross-site request forgery (CSRF) vulnerabilities in unspecified sub modules in the Open Atrium module 7.x-2.x before 7.x-2.26 for (no CVSS)
- [CVE-2014-9503](https://cve.now/CVE-2014-9503.md): The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with "access conte (no CVSS)
- [CVE-2014-9504](https://cve.now/CVE-2014-9504.md): The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child g (no CVSS)
- [CVE-2015-2203](https://cve.now/CVE-2015-2203.md): Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF\_LOGIN permission to obtain sensitive settings history informa (no CVSS)
- [CVE-2015-2204](https://cve.now/CVE-2015-2204.md): Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obta (no CVSS)
- [CVE-2018-0508](https://cve.now/CVE-2018-0508.md): Cross-site scripting vulnerability in epg search result viewer (kkcald) 0.7.21 and earlier allows an attacker to inject arbitrary web script (no CVSS, epg search result viewer)
- [CVE-2018-0509](https://cve.now/CVE-2018-0509.md): Cross-site request forgery (CSRF) vulnerability in epg search result viewer (kkcald) 0.7.21 and earlier allows an attacker to hijack the aut (no CVSS, epg search result viewer)
- [CVE-2018-0510](https://cve.now/CVE-2018-0510.md): Buffer overflow in epg search result viewer (kkcald) 0.7.19 and earlier allows remote attackers to perform unintended operations or execute (no CVSS, epg search result viewer)
- [CVE-2018-0511](https://cve.now/CVE-2018-0511.md): Cross-site scripting vulnerability in WP Retina 2x prior to version 5.2.2 allows an attacker to inject arbitrary web script or HTML via unsp (no CVSS, Jordy Meow WP Retina)
- [CVE-2018-6186](https://cve.now/CVE-2018-6186.md): Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF attack via the /rapi/read\_url URI by an authenticated attacker who has a webapp (no CVSS)
- [CVE-2018-6485](https://cve.now/CVE-2018-6485.md): An integer overflow in the implementation of the posix\_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and ear (no CVSS)
- [CVE-2018-6470](https://cve.now/CVE-2018-6470.md): Nibbleblog 4.0.5 on macOS defaults to having .DS\_Store in each directory, causing DS\_Store information to leak. (no CVSS)
- [CVE-2018-6484](https://cve.now/CVE-2018-6484.md): In ZZIPlib 0.13.67, there is a memory alignment error and bus error in the \_\_zzip\_fetch\_disk\_trailer function of zzip/zip.c. (no CVSS)
- [CVE-2017-1000408](https://cve.now/CVE-2017-1000408.md): A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD\_HWCAP\_MASK environment variable. (no CVSS)
- [CVE-2017-1000409](https://cve.now/CVE-2017-1000409.md): A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD\_LIBRARY\_PATH environment variable. (no CVSS)
- [CVE-2017-16861](https://cve.now/CVE-2017-16861.md): It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. (no CVSS, Atlassian Fisheye and Crucible)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-02-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.