# CVEs published 2018-02-02 66 CVEs were published on February 2, 2018: 0 critical, 1 high. Days are UTC. - [CVE-2014-1834](https://cve.now/CVE-2014-1834.md): The perform\_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi (no CVSS, echor) - [CVE-2014-1835](https://cve.now/CVE-2014-1835.md): The perform\_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watchin (no CVSS, echor) - [CVE-2015-2796](https://cve.now/CVE-2015-2796.md): Multiple cross-site scripting (XSS) vulnerabilities in Project-Pier ProjectPier-Core allow remote attackers to inject arbitrary web script o (no CVSS) - [CVE-2016-0300](https://cve.now/CVE-2016-0300.md): IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 might allow remote attackers to access arbit (no CVSS) - [CVE-2016-0303](https://cve.now/CVE-2016-0303.md): Cross-site scripting (XSS) vulnerability in IBM Tivoli Integrated Portal 2.2.0.0 through 2.2.0.15 allows remote attackers to inject arbitrar (no CVSS) - [CVE-2016-0311](https://cve.now/CVE-2016-0311.md): Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 6.1.0 before 6.1.0-TIV-BSM-FP0004 and 6.1.1 before 6.1.1-TIV (no CVSS) - [CVE-2016-0312](https://cve.now/CVE-2016-0312.md): IBM TRIRIGA Application Platform before 3.3.2 allows remote attackers to obtain sensitive information via vectors related to granting unauth (no CVSS) - [CVE-2016-0329](https://cve.now/CVE-2016-0329.md): Open redirect vulnerability in IBM Emptoris Sourcing 10.0.0.x before 10.0.0.1\_iFix3, 10.0.1.x before 10.0.1.3\_iFix3, 10.0.2.x before 10.0.2. (no CVSS) - [CVE-2016-0342](https://cve.now/CVE-2016-0342.md): IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to read or (no CVSS) - [CVE-2018-5261](https://cve.now/CVE-2018-5261.md): An issue was discovered in Flexense DiskBoss 8.8.16 and earlier. (no CVSS) - [CVE-2018-6317](https://cve.now/CVE-2018-6317.md): The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated format string vulnerability, all (no CVSS) - [CVE-2018-6318](https://cve.now/CVE-2018-6318.md): In Sophos Tester Tool 3.2.0.7 Beta, the driver loads (in the context of the application used to test an exploit or ransomware) the DLL using (no CVSS) - [CVE-2018-6319](https://cve.now/CVE-2018-6319.md): In Sophos Tester Tool 3.2.0.7 Beta, the driver accepts a special DeviceIoControl code that doesn't check its argument. (no CVSS) - [CVE-2018-6575](https://cve.now/CVE-2018-6575.md): SQL Injection exists in the JEXTN Classified 1.0.0 component for Joomla! via a view=boutique&sid= request. (no CVSS) - [CVE-2018-6576](https://cve.now/CVE-2018-6576.md): SQL Injection exists in Event Manager 1.0 via the event.php id parameter or the page.php slug parameter. (no CVSS) - [CVE-2018-6577](https://cve.now/CVE-2018-6577.md): SQL Injection exists in the JEXTN Membership 3.1.0 component for Joomla! via the usr\_plan parameter in a view=myplans&task=myplans.usersubsc (no CVSS) - [CVE-2018-6578](https://cve.now/CVE-2018-6578.md): SQL Injection exists in the JE PayperVideo 3.0.0 component for Joomla! via the usr\_plan parameter in a view=myplans&task=myplans.usersubscri (no CVSS) - [CVE-2018-6579](https://cve.now/CVE-2018-6579.md): SQL Injection exists in the JEXTN Reverse Auction 3.1.0 component for Joomla! via a view=products&uid= request. (no CVSS) - [CVE-2018-6580](https://cve.now/CVE-2018-6580.md): Arbitrary file upload exists in the Jimtawl 2.1.6 and 2.2.5 component for Joomla! via a view=upload&task=upload&pop=true&tmpl=component requ (no CVSS) - [CVE-2018-6581](https://cve.now/CVE-2018-6581.md): SQL Injection exists in the JMS Music 1.1.1 component for Joomla! via a search with the keyword, artist, or username parameter. (no CVSS) - [CVE-2017-18121](https://cve.now/CVE-2017-18121.md): The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links (no CVSS, simplesamlphp/simplesamlphp) - [CVE-2017-18122](https://cve.now/CVE-2017-18122.md): A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. (no CVSS, simplesamlphp/simplesamlphp) - [CVE-2017-5727](https://cve.now/CVE-2017-5727.md): Pointer dereference in subsystem in Intel Graphics Driver 15.40.x.x, 15.45.x.x, 15.46.x.x allows unprivileged user to elevate privileges via (no CVSS, Intel Graphics Driver) - [CVE-2018-6561](https://cve.now/CVE-2018-6561.md): dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element. (no CVSS, dijit) - [CVE-2017-14177](https://cve.now/CVE-2017-14177.md): Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an (no CVSS, Apport) - [CVE-2017-14178](https://cve.now/CVE-2017-14178.md): In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileg (no CVSS, snapd) - [CVE-2017-14179](https://cve.now/CVE-2017-14179.md): Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root wh (no CVSS, Apport) - [CVE-2017-14180](https://cve.now/CVE-2017-14180.md): Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as (no CVSS, na/ Apport) - [CVE-2017-18034](https://cve.now/CVE-2017-18034.md): The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write a (no CVSS, Atlassian Fisheye and Crucible) - [CVE-2017-18035](https://cve.now/CVE-2017-18035.md): The /rest/review-coverage-chart/1.0/data/\/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 w (no CVSS, Atlassian Fisheye and Crucible) - [CVE-2017-18036](https://cve.now/CVE-2017-18036.md): The Github repository importer in Atlassian Bitbucket Server before version 5.3.0 allows remote attackers to determine if a service they cou (no CVSS, Atlassian Bitbucket Server) - [CVE-2017-18037](https://cve.now/CVE-2017-18037.md): The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from ve (no CVSS, Atlassian Bitbucket Server) - [CVE-2017-18038](https://cve.now/CVE-2017-18038.md): The repository settings resource in Atlassian Bitbucket Server before version 5.6.0 allows remote attackers to read the first line of arbitr (no CVSS, Atlassian Bitbucket Server) - [CVE-2017-18039](https://cve.now/CVE-2017-18039.md): The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML (no CVSS, Atlassian Jira) - [CVE-2017-18040](https://cve.now/CVE-2017-18040.md): The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaS (no CVSS, Atlassian Bamboo) - [CVE-2017-18041](https://cve.now/CVE-2017-18041.md): The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML (no CVSS, Atlassian Bamboo) - [CVE-2017-18042](https://cve.now/CVE-2017-18042.md): The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passw (no CVSS, Atlassian Bamboo) - [CVE-2017-18080](https://cve.now/CVE-2017-18080.md): The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross- (no CVSS, Atlassian Bamboo) - [CVE-2017-18081](https://cve.now/CVE-2017-18081.md): The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross (no CVSS, Atlassian Bamboo) - [CVE-2017-18082](https://cve.now/CVE-2017-18082.md): The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitrary HTML or JavaScript (no CVSS, Atlassian Bamboo) - [CVE-2017-18083](https://cve.now/CVE-2017-18083.md): The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript v (no CVSS, Atlassian Confluence) - [CVE-2017-18084](https://cve.now/CVE-2017-18084.md): The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript v (no CVSS, Atlassian Confluence) - [CVE-2017-18085](https://cve.now/CVE-2017-18085.md): The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or Ja (no CVSS, Atlassian Confluence) - [CVE-2017-18086](https://cve.now/CVE-2017-18086.md): Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cr (no CVSS) - [CVE-2018-6486](https://cve.now/CVE-2018-6486.md): MFSBGN03797 rev.1 - Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), XML External Entity Injection (CVSS 7.3, Fortify Audit Workbench (AWB) and Micro Focus Fortify Softw…) - [CVE-2018-6551](https://cve.now/CVE-2018-6551.md): The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, (no CVSS) - [CVE-2018-6560](https://cve.now/CVE-2018-6560.md): In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to (no CVSS) - [CVE-2017-18120](https://cve.now/CVE-2017-18120.md): A double-free bug in the read\_gif function in gifread.c in gifsicle 1.90 allows a remote attacker to cause a denial-of-service attack or uns (no CVSS) - [CVE-2018-6526](https://cve.now/CVE-2018-6526.md): view\_all\_bug\_page.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filt (no CVSS) - [CVE-2018-6536](https://cve.now/CVE-2018-6536.md): An issue was discovered in Icinga 2.x through 2.8.1. (no CVSS) - [CVE-2018-6537](https://cve.now/CVE-2018-6537.md): A buffer overflow vulnerability in the control protocol of Flexense SyncBreeze Enterprise v10.4.18 allows remote attackers to execute arbitr (no CVSS) - [CVE-2018-6540](https://cve.now/CVE-2018-6540.md): In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address in the zzip\_disk\_findfirst function of zzip/mmapped.c. (no CVSS) - [CVE-2018-6541](https://cve.now/CVE-2018-6541.md): In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64\_trailer local entries) in \_\_zzip\_fe (no CVSS) - [CVE-2018-6542](https://cve.now/CVE-2018-6542.md): In ZZIPlib 0.13.67, there is a bus error (when handling a disk64\_trailer seek value) caused by loading of a misaligned address in the zzip\_d (no CVSS) - [CVE-2018-6543](https://cve.now/CVE-2018-6543.md): In GNU Binutils 2.30, there's an integer overflow in the function load\_specific\_debug\_section() in objdump.c, which results in \`malloc()\` wi (no CVSS) - [CVE-2018-6544](https://cve.now/CVE-2018-6544.md): pdf\_load\_obj\_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stac (no CVSS) - [CVE-2018-6545](https://cve.now/CVE-2018-6545.md): Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability, as demonstrated by human.aspx. (no CVSS) - [CVE-2018-6548](https://cve.now/CVE-2018-6548.md): A use-after-free issue was discovered in libwebm through 2018-02-02. (no CVSS) - [CVE-2018-6550](https://cve.now/CVE-2018-6550.md): Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php. (no CVSS) - [CVE-2018-6519](https://cve.now/CVE-2018-6519.md): The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerab (no CVSS, simplesamlphp/saml2) - [CVE-2018-6520](https://cve.now/CVE-2018-6520.md): SimpleSAMLphp before 1.15.2 allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL. (no CVSS, simplesamlphp/simplesamlphp) - [CVE-2018-6521](https://cve.now/CVE-2018-6521.md): The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte char (no CVSS, simplesamlphp/simplesamlphp) - [CVE-2018-6522](https://cve.now/CVE-2018-6522.md): In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKRgFtXp.SYS) allows local users to cause a denial of service (BSOD) or possibly have (no CVSS) - [CVE-2018-6523](https://cve.now/CVE-2018-6523.md): In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKFsAv.SYS) allows local users to cause a denial of service (BSOD) or possibly have u (no CVSS) - [CVE-2018-6524](https://cve.now/CVE-2018-6524.md): In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKFsAv.SYS) allows local users to cause a denial of service (BSOD) or possibly have u (no CVSS) - [CVE-2018-6525](https://cve.now/CVE-2018-6525.md): In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKFsAv.SYS) allows local users to cause a denial of service (BSOD) or possibly have u (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-02-02 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.