CVEs published February 6, 2018
64 CVEs were published on February 6, 2018: 0 critical, 1 high. 1 is now in CISA KEV.
- Published
- 64
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 63
- Now in CISA KEV
- 1
- Fix available
- 4
Most affected products
- Kaspersky Labs Kaspersky Secure Mail Gateway
- 4
- Adobe Flash Player before
- 2
- Apache Software Foundation Apache CloudStack
- 2
- FasterXML jackson-databind · com.fasterxml.jackson.core:jac…
- 2
- Nvidia Android
- 2
- web2py
- 2
- Apache Software Foundation Apache Allura
- 1
- F5 Networks BIG-IP PEM
- 1
- Vyaire Medical CareFusion Upgrade Utility Vulnerability
- 1
High 1
Medium, low and unrated 63
- CVE-2018-6768In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6769In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6770In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6771In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6772In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6773In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6774In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6775In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6776In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6777In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspeci
- CVE-2018-6778In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6779In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6780In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6781In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6782In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6783In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6784In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6785In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2018-6786In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspeci
- CVE-2018-6787In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspeci
- CVE-2018-6788In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspeci
- CVE-2018-6767A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a
- CVE-2018-4877A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161.Adobe Flash Player before
- CVE-2018-5457A uncontrolled search path element issue was discovered in Vyaire Medical CareFusion Upgrade Utility used with Windows XP systems, Versions Vyaire Medical CareFusion Upgrade Utility Vulnerability
- CVE-2018-6759The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils
- CVE-2018-1299In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application.Apache Software Foundation Apache Allura
- CVE-2016-3952web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request
- CVE-2016-3953The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a harweb2py
- CVE-2016-3954web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status.web2py
- CVE-2016-3957The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, w
- CVE-2018-6758The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.
- CVE-2017-17663The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited rem
- CVE-2018-6389In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of regist
- CVE-2014-5279The Docker daemon managed by boot2docker 1.2 and earlier improperly enables unauthenticated TCP connections by default, which makes it easie
- CVE-2014-5280boot2docker 1.2 and earlier allows attackers to conduct cross-site request forgery (CSRF) attacks by leveraging Docker daemons enabling TCP
- CVE-2014-5282Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of un
- CVE-2015-3618Cross-site scripting (XSS) vulnerability in Nagios Business Process Intelligence (BPI) before 2.3.4 allows remote attackers to inject arbitr
- CVE-2015-3619Cross-site scripting (XSS) vulnerability in assets/js/vm2admin.js in the VirtueMart component before 3.0.8 for Joomla! allows remote attacke
- CVE-2015-4400Ring (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information about the wireless network configuration by p
- CVE-2016-7394tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie.
- CVE-2017-17996A buffer overflow vulnerability in "Add command" functionality exists in Flexense SyncBreeze Enterprise <= 10.3.14.
- CVE-2017-6198The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process.
- CVE-2017-6199A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field.
- CVE-2017-6200Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function.
- CVE-2017-6201A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203.
- CVE-2017-15095A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated userFasterXML jackson-databind · com.fasterxml.jackson.core:jac…
- CVE-2017-7525A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticaFasterXML jackson-databind · com.fasterxml.jackson.core:jac…
- CVE-2018-6288Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1.Kaspersky Labs Kaspersky Secure Mail Gateway
- CVE-2018-6289Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1.Kaspersky Labs Kaspersky Secure Mail Gateway
- CVE-2018-6290Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1.Kaspersky Labs Kaspersky Secure Mail Gateway
- CVE-2018-6291WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1.Kaspersky Labs Kaspersky Secure Mail Gateway
- CVE-2013-4317In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the usApache Software Foundation Apache CloudStack
- CVE-2016-6813Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API.Apache Software Foundation Apache CloudStack
- CVE-2018-6466A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject ar
- CVE-2018-6467The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php.
- CVE-2018-6468A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject ar
- CVE-2018-6469A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject ar
- CVE-2018-6656Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories.
- CVE-2017-6169In versions 13.0.0, 12.0.0-12.1.3, or 11.6.0-11.6.2, an F5 BIG-IP virtual server using the URL categorization feature may cause the Traffic F5 Networks BIG-IP PEM
- CVE-2017-6258NVIDIA libnvmmlite_audio.so contains an elevation of privilege vulnerability when running in media server which may cause an out of bounds wNvidia Android
- CVE-2017-6279NVIDIA libnvmmlite_audio.so contains an elevation of privilege vulnerability when running in media server which may cause an out of bounds wNvidia Android
- CVE-2018-6654The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an 'action: "user"' reque
- CVE-2018-6569West Wind Web Server 6.x does not require authentication for /ADMIN.ASP.