CVEs published February 2, 2018
66 CVEs were published on February 2, 2018: 0 critical, 1 high.
- Published
- 66
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 65
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Atlassian Bamboo
- 6
- simplesamlphp/simplesamlphp
- 4
- Atlassian Bitbucket Server
- 3
- Atlassian Confluence
- 3
- Apport
- 2
- Atlassian Fisheye and Crucible
- 2
- echor
- 2
- Atlassian Jira
- 1
- dijit
- 1
- Fortify Audit Workbench (AWB) and Micro Focus Fortify Softw…
- 1
High 1
Medium, low and unrated 65
- CVE-2014-1834The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semiechor
- CVE-2014-1835The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watchinechor
- CVE-2015-2796Multiple cross-site scripting (XSS) vulnerabilities in Project-Pier ProjectPier-Core allow remote attackers to inject arbitrary web script o
- CVE-2016-0300IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 might allow remote attackers to access arbit
- CVE-2016-0303Cross-site scripting (XSS) vulnerability in IBM Tivoli Integrated Portal 2.2.0.0 through 2.2.0.15 allows remote attackers to inject arbitrar
- CVE-2016-0311Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 6.1.0 before 6.1.0-TIV-BSM-FP0004 and 6.1.1 before 6.1.1-TIV
- CVE-2016-0312IBM TRIRIGA Application Platform before 3.3.2 allows remote attackers to obtain sensitive information via vectors related to granting unauth
- CVE-2016-0329Open redirect vulnerability in IBM Emptoris Sourcing 10.0.0.x before 10.0.0.1_iFix3, 10.0.1.x before 10.0.1.3_iFix3, 10.0.2.x before 10.0.2.
- CVE-2016-0342IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to read or
- CVE-2018-5261An issue was discovered in Flexense DiskBoss 8.8.16 and earlier.
- CVE-2018-6317The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated format string vulnerability, all
- CVE-2018-6318In Sophos Tester Tool 3.2.0.7 Beta, the driver loads (in the context of the application used to test an exploit or ransomware) the DLL using
- CVE-2018-6319In Sophos Tester Tool 3.2.0.7 Beta, the driver accepts a special DeviceIoControl code that doesn't check its argument.
- CVE-2018-6575SQL Injection exists in the JEXTN Classified 1.0.0 component for Joomla! via a view=boutique&sid= request.
- CVE-2018-6576SQL Injection exists in Event Manager 1.0 via the event.php id parameter or the page.php slug parameter.
- CVE-2018-6577SQL Injection exists in the JEXTN Membership 3.1.0 component for Joomla! via the usr_plan parameter in a view=myplans&task=myplans.usersubsc
- CVE-2018-6578SQL Injection exists in the JE PayperVideo 3.0.0 component for Joomla! via the usr_plan parameter in a view=myplans&task=myplans.usersubscri
- CVE-2018-6579SQL Injection exists in the JEXTN Reverse Auction 3.1.0 component for Joomla! via a view=products&uid= request.
- CVE-2018-6580Arbitrary file upload exists in the Jimtawl 2.1.6 and 2.2.5 component for Joomla! via a view=upload&task=upload&pop=true&tmpl=component requ
- CVE-2018-6581SQL Injection exists in the JMS Music 1.1.1 component for Joomla! via a search with the keyword, artist, or username parameter.
- CVE-2017-18121The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft linkssimplesamlphp/simplesamlphp
- CVE-2017-18122A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16.simplesamlphp/simplesamlphp
- CVE-2017-5727Pointer dereference in subsystem in Intel Graphics Driver 15.40.x.x, 15.45.x.x, 15.46.x.x allows unprivileged user to elevate privileges viaIntel Graphics Driver
- CVE-2018-6561dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element.dijit
- CVE-2017-14177Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which anApport
- CVE-2017-14178In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivilegsnapd
- CVE-2017-14179Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root whApport
- CVE-2017-14180Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files asna/ Apport
- CVE-2017-18034The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write aAtlassian Fisheye and Crucible
- CVE-2017-18035The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 wAtlassian Fisheye and Crucible
- CVE-2017-18036The Github repository importer in Atlassian Bitbucket Server before version 5.3.0 allows remote attackers to determine if a service they couAtlassian Bitbucket Server
- CVE-2017-18037The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from veAtlassian Bitbucket Server
- CVE-2017-18038The repository settings resource in Atlassian Bitbucket Server before version 5.6.0 allows remote attackers to read the first line of arbitrAtlassian Bitbucket Server
- CVE-2017-18039The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML Atlassian Jira
- CVE-2017-18040The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaSAtlassian Bamboo
- CVE-2017-18041The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTMLAtlassian Bamboo
- CVE-2017-18042The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwAtlassian Bamboo
- CVE-2017-18080The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross-Atlassian Bamboo
- CVE-2017-18081The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross Atlassian Bamboo
- CVE-2017-18082The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitrary HTML or JavaScriptAtlassian Bamboo
- CVE-2017-18083The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript vAtlassian Confluence
- CVE-2017-18084The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript vAtlassian Confluence
- CVE-2017-18085The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JaAtlassian Confluence
- CVE-2017-18086Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cr
- CVE-2018-6551The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386,
- CVE-2018-6560In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to
- CVE-2017-18120A double-free bug in the read_gif function in gifread.c in gifsicle 1.90 allows a remote attacker to cause a denial-of-service attack or uns
- CVE-2018-6526view_all_bug_page.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filt
- CVE-2018-6536An issue was discovered in Icinga 2.x through 2.8.1.
- CVE-2018-6537A buffer overflow vulnerability in the control protocol of Flexense SyncBreeze Enterprise v10.4.18 allows remote attackers to execute arbitr
- CVE-2018-6540In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address in the zzip_disk_findfirst function of zzip/mmapped.c.
- CVE-2018-6541In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fe
- CVE-2018-6542In ZZIPlib 0.13.67, there is a bus error (when handling a disk64_trailer seek value) caused by loading of a misaligned address in the zzip_d
- CVE-2018-6543In GNU Binutils 2.30, there's an integer overflow in the function load_specific_debug_section() in objdump.c, which results in `malloc()` wi
- CVE-2018-6544pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stac
- CVE-2018-6545Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability, as demonstrated by human.aspx.
- CVE-2018-6548A use-after-free issue was discovered in libwebm through 2018-02-02.
- CVE-2018-6550Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php.
- CVE-2018-6519The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerabsimplesamlphp/saml2
- CVE-2018-6520SimpleSAMLphp before 1.15.2 allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL.simplesamlphp/simplesamlphp
- CVE-2018-6521The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte charsimplesamlphp/simplesamlphp
- CVE-2018-6522In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKRgFtXp.SYS) allows local users to cause a denial of service (BSOD) or possibly have
- CVE-2018-6523In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKFsAv.SYS) allows local users to cause a denial of service (BSOD) or possibly have u
- CVE-2018-6524In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKFsAv.SYS) allows local users to cause a denial of service (BSOD) or possibly have u
- CVE-2018-6525In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKFsAv.SYS) allows local users to cause a denial of service (BSOD) or possibly have u