CVEs published February 7, 2018
60 CVEs were published on February 7, 2018: 0 critical, 1 high.
- Published
- 60
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 59
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Google Chrome prior to
- 20
- Google Chrome OS prior to
- 2
- IBM API Connect
- 2
- IBM AIX
- 1
- IBM Content Navigator
- 1
- IBM WebSphere MQ
- 1
- toolchain
- 1
High 1
Medium, low and unrated 59
- CVE-2017-15386Incorrect implementation in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox (URLGoogle Chrome prior to
- CVE-2017-15387Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascGoogle Chrome prior to
- CVE-2017-15388Iteration through non-finite points in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds memGoogle Chrome prior to
- CVE-2017-15389An insufficient watchdog timer in navigation in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the OGoogle Chrome prior to
- CVE-2017-15390Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing via IGoogle Chrome prior to
- CVE-2017-15391Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to access Extension pages witGoogle Chrome prior to
- CVE-2017-15392Insufficient data validation in V8 in Google Chrome prior to 62.0.3202.62 allowed an attacker who can write to the Windows Registry to potenGoogle Chrome prior to
- CVE-2017-15393Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain acceGoogle Chrome prior to
- CVE-2017-15394Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing inGoogle Chrome prior to
- CVE-2017-15395A use after free in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome prior to
- CVE-2017-15397Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network positiGoogle Chrome OS prior to
- CVE-2017-15400Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command witGoogle Chrome OS prior to
- CVE-2017-5124Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts orGoogle Chrome prior to
- CVE-2017-5125Heap buffer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome prior to
- CVE-2017-5126A use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome prior to
- CVE-2017-5127Use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome prior to
- CVE-2017-5128Heap buffer overflow in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome prior to
- CVE-2017-5129A use after free in WebAudio in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds memory reGoogle Chrome prior to
- CVE-2017-5131An integer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome prior to
- CVE-2017-5132Inappropriate implementation in V8 in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome prior to
- CVE-2017-5133Off-by-one read/write on the heap in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to corrupt memory and possibly lGoogle Chrome prior to
- CVE-2018-6829cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers t
- CVE-2018-6574Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source codtoolchain
- CVE-2018-6655PHP Scripts Mall Doctor Search Script 1.0.2 has Stored XSS via an arbitrary profile field.
- CVE-2018-6795PHP Scripts Mall Naukri Clone Script 3.0.3 has Stored XSS via every profile input field.
- CVE-2018-6796PHP Scripts Mall Multilanguage Real Estate MLM Script 3.0 has Stored XSS via every profile input field.
- CVE-2016-2540Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted FORMATCHU
- CVE-2016-2541Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted MP2 file.
- CVE-2016-6168Use-after-free vulnerability in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote attackers to cause a denial of se
- CVE-2016-6169Heap-based buffer overflow in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote attackers to cause a denial of serv
- CVE-2017-12412ccn-lite-ccnb2xml in CCN-lite before 2.0.0 allows context-dependent attackers to have unspecified impact via a crafted file, which triggers
- CVE-2017-12463Memory leak in the ccnl_app_RX function in ccnl-uapi.c in CCN-lite before 2.00 allows context-dependent attackers to cause a denial of servi
- CVE-2017-12464ccn-lite-valid.c in CCN-lite before 2.00 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via vect
- CVE-2017-12465Multiple integer overflows in CCN-lite before 2.00 allow context-dependent attackers to have unspecified impact via vectors involving the (1
- CVE-2017-12466CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact via vectors related to ssl_halen when running ccn-lite-si
- CVE-2017-12467Memory leak in CCN-lite before 2.00 allows context-dependent attackers to cause a denial of service (memory consumption) by leveraging failu
- CVE-2017-12468Buffer overflow in ccn-lite-ccnb2xml.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact via vectors inv
- CVE-2017-12469Buffer overflow in util/ccnl-common.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging in
- CVE-2017-12470Integer overflow in the ndn_parse_sequence function in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact vi
- CVE-2017-12471The cnb_parse_lev function in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging failure to ch
- CVE-2017-12472ccnl-ext-mgmt.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging missing NULL pointer che
- CVE-2017-12473ccnl_ccntlv_bytes2pkt in CCN-lite allows context-dependent attackers to cause a denial of service (application crash) via vectors involving
- CVE-2017-1692IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privIBM AIX
- CVE-2017-17552/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter,
- CVE-2017-1785IBM API Connect 5.0.7 and 5.0.8 could allow an authenticated remote user to modify query parameters to obtain sensitive information.IBM API Connect
- CVE-2018-1366IBM Content Navigator 2.0 and 3.0 is vulnerable to Comma Separated Value (CSV) Injection.IBM Content Navigator
- CVE-2018-1382IBM API Connect 5.0.0.0 is vulnerable to cross-site scripting.IBM API Connect
- CVE-2018-1388GSKit V7 may disclose side channel information via discrepancies between valid and invalid PKCS#1 padding.IBM WebSphere MQ
- CVE-2018-6824Cozy version 2 has XSS allowing remote attackers to obtain administrative access via JavaScript code in the url parameter to the /api/proxy
- CVE-2018-6823In the VPN client in Mailbutler Shimo before 4.1.5.1 on macOS, the com.feingeist.shimo.helper tool LaunchDaemon implements an unprotected XP
- CVE-2017-17482An issue was discovered in OpenVMS through V8.4-2L2 on Alpha and through V8.4-2L1 on IA64, and VAX/VMS 4.0 and later.
- CVE-2018-6822In PureVPN 6.0.1 on macOS, HelperTool LaunchDaemon implements an unprotected XPC service that can be abused to execute system commands as ro
- CVE-2018-6603Promise Technology WebPam Pro-E devices allow remote attackers to conduct XSS, HTTP Response Splitting, and CRLF Injection attacks via JavaS
- CVE-2018-6794Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c.
- CVE-2018-6799The AcquireCacheNexus function in magick/pixel_cache.c in GraphicsMagick before 1.3.28 allows remote attackers to cause a denial of service
- CVE-2018-6806Marked 2 through 2.5.11 allows remote attackers to read arbitrary files via a crafted HTML document that triggers a redirect to an x-marked:
- CVE-2018-6790An issue was discovered in KDE Plasma Workspace before 5.12.0.
- CVE-2018-6791An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0.
- CVE-2018-6792Multiple SQL injection vulnerabilities in Saifor CVMS HUB 1.3.1 allow an authenticated user to execute arbitrary SQL commands via multiple p