# CVEs published 2018-02-07

60 CVEs were published on February 7, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2017-15386](https://cve.now/CVE-2017-15386.md): Incorrect implementation in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox (URL (no CVSS, Google Chrome prior to)
- [CVE-2017-15387](https://cve.now/CVE-2017-15387.md): Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javasc (no CVSS, Google Chrome prior to)
- [CVE-2017-15388](https://cve.now/CVE-2017-15388.md): Iteration through non-finite points in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds mem (no CVSS, Google Chrome prior to)
- [CVE-2017-15389](https://cve.now/CVE-2017-15389.md): An insufficient watchdog timer in navigation in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the O (no CVSS, Google Chrome prior to)
- [CVE-2017-15390](https://cve.now/CVE-2017-15390.md): Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing via I (no CVSS, Google Chrome prior to)
- [CVE-2017-15391](https://cve.now/CVE-2017-15391.md): Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to access Extension pages wit (no CVSS, Google Chrome prior to)
- [CVE-2017-15392](https://cve.now/CVE-2017-15392.md): Insufficient data validation in V8 in Google Chrome prior to 62.0.3202.62 allowed an attacker who can write to the Windows Registry to poten (no CVSS, Google Chrome prior to)
- [CVE-2017-15393](https://cve.now/CVE-2017-15393.md): Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain acce (no CVSS, Google Chrome prior to)
- [CVE-2017-15394](https://cve.now/CVE-2017-15394.md): Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing in (no CVSS, Google Chrome prior to)
- [CVE-2017-15395](https://cve.now/CVE-2017-15395.md): A use after free in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome prior to)
- [CVE-2017-15397](https://cve.now/CVE-2017-15397.md): Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network positi (no CVSS, Google Chrome OS prior to)
- [CVE-2017-15400](https://cve.now/CVE-2017-15400.md): Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command wit (no CVSS, Google Chrome OS prior to)
- [CVE-2017-5124](https://cve.now/CVE-2017-5124.md): Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or (no CVSS, Google Chrome prior to)
- [CVE-2017-5125](https://cve.now/CVE-2017-5125.md): Heap buffer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome prior to)
- [CVE-2017-5126](https://cve.now/CVE-2017-5126.md): A use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome prior to)
- [CVE-2017-5127](https://cve.now/CVE-2017-5127.md): Use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome prior to)
- [CVE-2017-5128](https://cve.now/CVE-2017-5128.md): Heap buffer overflow in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome prior to)
- [CVE-2017-5129](https://cve.now/CVE-2017-5129.md): A use after free in WebAudio in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds memory re (no CVSS, Google Chrome prior to)
- [CVE-2017-5130](https://cve.now/CVE-2017-5130.md): An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a rem (CVSS 8.8, Google Chrome prior to)
- [CVE-2017-5131](https://cve.now/CVE-2017-5131.md): An integer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome prior to)
- [CVE-2017-5132](https://cve.now/CVE-2017-5132.md): Inappropriate implementation in V8 in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption v (no CVSS, Google Chrome prior to)
- [CVE-2017-5133](https://cve.now/CVE-2017-5133.md): Off-by-one read/write on the heap in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to corrupt memory and possibly l (no CVSS, Google Chrome prior to)
- [CVE-2018-6829](https://cve.now/CVE-2018-6829.md): cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers t (no CVSS)
- [CVE-2018-6574](https://cve.now/CVE-2018-6574.md): Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source cod (no CVSS, toolchain)
- [CVE-2018-6655](https://cve.now/CVE-2018-6655.md): PHP Scripts Mall Doctor Search Script 1.0.2 has Stored XSS via an arbitrary profile field. (no CVSS)
- [CVE-2018-6795](https://cve.now/CVE-2018-6795.md): PHP Scripts Mall Naukri Clone Script 3.0.3 has Stored XSS via every profile input field. (no CVSS)
- [CVE-2018-6796](https://cve.now/CVE-2018-6796.md): PHP Scripts Mall Multilanguage Real Estate MLM Script 3.0 has Stored XSS via every profile input field. (no CVSS)
- [CVE-2016-2540](https://cve.now/CVE-2016-2540.md): Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted FORMATCHU (no CVSS)
- [CVE-2016-2541](https://cve.now/CVE-2016-2541.md): Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted MP2 file. (no CVSS)
- [CVE-2016-6168](https://cve.now/CVE-2016-6168.md): Use-after-free vulnerability in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2016-6169](https://cve.now/CVE-2016-6169.md): Heap-based buffer overflow in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote attackers to cause a denial of serv (no CVSS)
- [CVE-2017-12412](https://cve.now/CVE-2017-12412.md): ccn-lite-ccnb2xml in CCN-lite before 2.0.0 allows context-dependent attackers to have unspecified impact via a crafted file, which triggers (no CVSS)
- [CVE-2017-12463](https://cve.now/CVE-2017-12463.md): Memory leak in the ccnl\_app\_RX function in ccnl-uapi.c in CCN-lite before 2.00 allows context-dependent attackers to cause a denial of servi (no CVSS)
- [CVE-2017-12464](https://cve.now/CVE-2017-12464.md): ccn-lite-valid.c in CCN-lite before 2.00 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via vect (no CVSS)
- [CVE-2017-12465](https://cve.now/CVE-2017-12465.md): Multiple integer overflows in CCN-lite before 2.00 allow context-dependent attackers to have unspecified impact via vectors involving the (1 (no CVSS)
- [CVE-2017-12466](https://cve.now/CVE-2017-12466.md): CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact via vectors related to ssl\_halen when running ccn-lite-si (no CVSS)
- [CVE-2017-12467](https://cve.now/CVE-2017-12467.md): Memory leak in CCN-lite before 2.00 allows context-dependent attackers to cause a denial of service (memory consumption) by leveraging failu (no CVSS)
- [CVE-2017-12468](https://cve.now/CVE-2017-12468.md): Buffer overflow in ccn-lite-ccnb2xml.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact via vectors inv (no CVSS)
- [CVE-2017-12469](https://cve.now/CVE-2017-12469.md): Buffer overflow in util/ccnl-common.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging in (no CVSS)
- [CVE-2017-12470](https://cve.now/CVE-2017-12470.md): Integer overflow in the ndn\_parse\_sequence function in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact vi (no CVSS)
- [CVE-2017-12471](https://cve.now/CVE-2017-12471.md): The cnb\_parse\_lev function in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging failure to ch (no CVSS)
- [CVE-2017-12472](https://cve.now/CVE-2017-12472.md): ccnl-ext-mgmt.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging missing NULL pointer che (no CVSS)
- [CVE-2017-12473](https://cve.now/CVE-2017-12473.md): ccnl\_ccntlv\_bytes2pkt in CCN-lite allows context-dependent attackers to cause a denial of service (application crash) via vectors involving (no CVSS)
- [CVE-2017-1692](https://cve.now/CVE-2017-1692.md): IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level priv (no CVSS, IBM AIX)
- [CVE-2017-17552](https://cve.now/CVE-2017-17552.md): /LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, (no CVSS)
- [CVE-2017-1785](https://cve.now/CVE-2017-1785.md): IBM API Connect 5.0.7 and 5.0.8 could allow an authenticated remote user to modify query parameters to obtain sensitive information. (no CVSS, IBM API Connect)
- [CVE-2018-1366](https://cve.now/CVE-2018-1366.md): IBM Content Navigator 2.0 and 3.0 is vulnerable to Comma Separated Value (CSV) Injection. (no CVSS, IBM Content Navigator)
- [CVE-2018-1382](https://cve.now/CVE-2018-1382.md): IBM API Connect 5.0.0.0 is vulnerable to cross-site scripting. (no CVSS, IBM API Connect)
- [CVE-2018-1388](https://cve.now/CVE-2018-1388.md): GSKit V7 may disclose side channel information via discrepancies between valid and invalid PKCS#1 padding. (no CVSS, IBM WebSphere MQ)
- [CVE-2018-6824](https://cve.now/CVE-2018-6824.md): Cozy version 2 has XSS allowing remote attackers to obtain administrative access via JavaScript code in the url parameter to the /api/proxy (no CVSS)
- [CVE-2018-6823](https://cve.now/CVE-2018-6823.md): In the VPN client in Mailbutler Shimo before 4.1.5.1 on macOS, the com.feingeist.shimo.helper tool LaunchDaemon implements an unprotected XP (no CVSS)
- [CVE-2017-17482](https://cve.now/CVE-2017-17482.md): An issue was discovered in OpenVMS through V8.4-2L2 on Alpha and through V8.4-2L1 on IA64, and VAX/VMS 4.0 and later. (no CVSS)
- [CVE-2018-6822](https://cve.now/CVE-2018-6822.md): In PureVPN 6.0.1 on macOS, HelperTool LaunchDaemon implements an unprotected XPC service that can be abused to execute system commands as ro (no CVSS)
- [CVE-2018-6603](https://cve.now/CVE-2018-6603.md): Promise Technology WebPam Pro-E devices allow remote attackers to conduct XSS, HTTP Response Splitting, and CRLF Injection attacks via JavaS (no CVSS)
- [CVE-2018-6794](https://cve.now/CVE-2018-6794.md): Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. (no CVSS)
- [CVE-2018-6799](https://cve.now/CVE-2018-6799.md): The AcquireCacheNexus function in magick/pixel\_cache.c in GraphicsMagick before 1.3.28 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2018-6806](https://cve.now/CVE-2018-6806.md): Marked 2 through 2.5.11 allows remote attackers to read arbitrary files via a crafted HTML document that triggers a redirect to an x-marked: (no CVSS)
- [CVE-2018-6790](https://cve.now/CVE-2018-6790.md): An issue was discovered in KDE Plasma Workspace before 5.12.0. (no CVSS)
- [CVE-2018-6791](https://cve.now/CVE-2018-6791.md): An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. (no CVSS)
- [CVE-2018-6792](https://cve.now/CVE-2018-6792.md): Multiple SQL injection vulnerabilities in Saifor CVMS HUB 1.3.1 allow an authenticated user to execute arbitrary SQL commands via multiple p (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-02-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.