# CVEs published 2018-02-06

64 CVEs were published on February 6, 2018: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2018-6768](https://cve.now/CVE-2018-6768.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6769](https://cve.now/CVE-2018-6769.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6770](https://cve.now/CVE-2018-6770.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6771](https://cve.now/CVE-2018-6771.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6772](https://cve.now/CVE-2018-6772.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6773](https://cve.now/CVE-2018-6773.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6774](https://cve.now/CVE-2018-6774.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6775](https://cve.now/CVE-2018-6775.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6776](https://cve.now/CVE-2018-6776.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6777](https://cve.now/CVE-2018-6777.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspeci (no CVSS)
- [CVE-2018-6778](https://cve.now/CVE-2018-6778.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6779](https://cve.now/CVE-2018-6779.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6780](https://cve.now/CVE-2018-6780.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6781](https://cve.now/CVE-2018-6781.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6782](https://cve.now/CVE-2018-6782.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6783](https://cve.now/CVE-2018-6783.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6784](https://cve.now/CVE-2018-6784.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6785](https://cve.now/CVE-2018-6785.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2018-6786](https://cve.now/CVE-2018-6786.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspeci (no CVSS)
- [CVE-2018-6787](https://cve.now/CVE-2018-6787.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspeci (no CVSS)
- [CVE-2018-6788](https://cve.now/CVE-2018-6788.md): In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspeci (no CVSS)
- [CVE-2018-6767](https://cve.now/CVE-2018-6767.md): A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a (no CVSS)
- [CVE-2018-4877](https://cve.now/CVE-2018-4877.md): A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. (no CVSS, Adobe Flash Player before)
- [CVE-2018-4878](https://cve.now/CVE-2018-4878.md): A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. (CVSS 7.8, KEV, Adobe Flash Player before)
- [CVE-2018-5457](https://cve.now/CVE-2018-5457.md): A uncontrolled search path element issue was discovered in Vyaire Medical CareFusion Upgrade Utility used with Windows XP systems, Versions (no CVSS, Vyaire Medical CareFusion Upgrade Utility Vulnerability)
- [CVE-2018-6759](https://cve.now/CVE-2018-6759.md): The bfd\_get\_debug\_link\_info\_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils (no CVSS)
- [CVE-2018-1299](https://cve.now/CVE-2018-1299.md): In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application. (no CVSS, Apache Software Foundation Apache Allura)
- [CVE-2016-3952](https://cve.now/CVE-2016-3952.md): web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request (no CVSS)
- [CVE-2016-3953](https://cve.now/CVE-2016-3953.md): The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a har (no CVSS, web2py)
- [CVE-2016-3954](https://cve.now/CVE-2016-3954.md): web2py before 2.14.2 allows remote attackers to obtain the session\_cookie\_key value via a direct request to examples/simple\_examples/status. (no CVSS, web2py)
- [CVE-2016-3957](https://cve.now/CVE-2016-3957.md): The secure\_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, w (no CVSS)
- [CVE-2018-6758](https://cve.now/CVE-2018-6758.md): The uwsgi\_expand\_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length. (no CVSS)
- [CVE-2017-17663](https://cve.now/CVE-2017-17663.md): The htpasswd implementation of mini\_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited rem (no CVSS)
- [CVE-2018-6389](https://cve.now/CVE-2018-6389.md): In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of regist (no CVSS)
- [CVE-2014-5279](https://cve.now/CVE-2014-5279.md): The Docker daemon managed by boot2docker 1.2 and earlier improperly enables unauthenticated TCP connections by default, which makes it easie (no CVSS)
- [CVE-2014-5280](https://cve.now/CVE-2014-5280.md): boot2docker 1.2 and earlier allows attackers to conduct cross-site request forgery (CSRF) attacks by leveraging Docker daemons enabling TCP (no CVSS)
- [CVE-2014-5282](https://cve.now/CVE-2014-5282.md): Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of un (no CVSS)
- [CVE-2015-3618](https://cve.now/CVE-2015-3618.md): Cross-site scripting (XSS) vulnerability in Nagios Business Process Intelligence (BPI) before 2.3.4 allows remote attackers to inject arbitr (no CVSS)
- [CVE-2015-3619](https://cve.now/CVE-2015-3619.md): Cross-site scripting (XSS) vulnerability in assets/js/vm2admin.js in the VirtueMart component before 3.0.8 for Joomla! allows remote attacke (no CVSS)
- [CVE-2015-4400](https://cve.now/CVE-2015-4400.md): Ring (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information about the wireless network configuration by p (no CVSS)
- [CVE-2016-7394](https://cve.now/CVE-2016-7394.md): tiki wiki cms groupware \<=15.2 has a xss vulnerability, allow attackers steal user's cookie. (no CVSS)
- [CVE-2017-17996](https://cve.now/CVE-2017-17996.md): A buffer overflow vulnerability in "Add command" functionality exists in Flexense SyncBreeze Enterprise \<= 10.3.14. (no CVSS)
- [CVE-2017-6198](https://cve.now/CVE-2017-6198.md): The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. (no CVSS)
- [CVE-2017-6199](https://cve.now/CVE-2017-6199.md): A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field. (no CVSS)
- [CVE-2017-6200](https://cve.now/CVE-2017-6200.md): Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. (no CVSS)
- [CVE-2017-6201](https://cve.now/CVE-2017-6201.md): A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203. (no CVSS)
- [CVE-2017-15095](https://cve.now/CVE-2017-15095.md): A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user (no CVSS, FasterXML jackson-databind · com.fasterxml.jackson.core:jac…)
- [CVE-2017-7525](https://cve.now/CVE-2017-7525.md): A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica (no CVSS, FasterXML jackson-databind · com.fasterxml.jackson.core:jac…)
- [CVE-2018-6288](https://cve.now/CVE-2018-6288.md): Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1. (no CVSS, Kaspersky Labs Kaspersky Secure Mail Gateway)
- [CVE-2018-6289](https://cve.now/CVE-2018-6289.md): Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1. (no CVSS, Kaspersky Labs Kaspersky Secure Mail Gateway)
- [CVE-2018-6290](https://cve.now/CVE-2018-6290.md): Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1. (no CVSS, Kaspersky Labs Kaspersky Secure Mail Gateway)
- [CVE-2018-6291](https://cve.now/CVE-2018-6291.md): WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1. (no CVSS, Kaspersky Labs Kaspersky Secure Mail Gateway)
- [CVE-2013-4317](https://cve.now/CVE-2013-4317.md): In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the us (no CVSS, Apache Software Foundation Apache CloudStack)
- [CVE-2016-6813](https://cve.now/CVE-2016-6813.md): Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. (no CVSS, Apache Software Foundation Apache CloudStack)
- [CVE-2018-6466](https://cve.now/CVE-2018-6466.md): A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject ar (no CVSS)
- [CVE-2018-6467](https://cve.now/CVE-2018-6467.md): The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php. (no CVSS)
- [CVE-2018-6468](https://cve.now/CVE-2018-6468.md): A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject ar (no CVSS)
- [CVE-2018-6469](https://cve.now/CVE-2018-6469.md): A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject ar (no CVSS)
- [CVE-2018-6656](https://cve.now/CVE-2018-6656.md): Z-BlogPHP 1.5.1 has CSRF via zb\_users/plugin/AppCentre/app\_del.php, as demonstrated by deleting files and directories. (no CVSS)
- [CVE-2017-6169](https://cve.now/CVE-2017-6169.md): In versions 13.0.0, 12.0.0-12.1.3, or 11.6.0-11.6.2, an F5 BIG-IP virtual server using the URL categorization feature may cause the Traffic (no CVSS, F5 Networks BIG-IP PEM)
- [CVE-2017-6258](https://cve.now/CVE-2017-6258.md): NVIDIA libnvmmlite\_audio.so contains an elevation of privilege vulnerability when running in media server which may cause an out of bounds w (no CVSS, Nvidia Android)
- [CVE-2017-6279](https://cve.now/CVE-2017-6279.md): NVIDIA libnvmmlite\_audio.so contains an elevation of privilege vulnerability when running in media server which may cause an out of bounds w (no CVSS, Nvidia Android)
- [CVE-2018-6654](https://cve.now/CVE-2018-6654.md): The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an 'action: "user"' reque (no CVSS)
- [CVE-2018-6569](https://cve.now/CVE-2018-6569.md): West Wind Web Server 6.x does not require authentication for /ADMIN.ASP. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-02-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.