# CVEs published 2018-02-08

74 CVEs were published on February 8, 2018: 2 critical, 0 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2011-4889](https://cve.now/CVE-2011-4889.md): The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Server (WAS) 6.1 before (no CVSS)
- [CVE-2012-0941](https://cve.now/CVE-2012-0941.md): Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiGate UTM WAF appliances with FortiOS 4.3.x before 4.3.6 allow remote at (no CVSS)
- [CVE-2012-2166](https://cve.now/CVE-2012-2166.md): IBM XIV Storage System 2810-A14 and 2812-A14 devices before level 10.2.4.e-2 and 2810-114 and 2812-114 devices before level 11.1.1 have hard (no CVSS)
- [CVE-2012-3331](https://cve.now/CVE-2012-3331.md): IBM Sametime allows remote attackers to obtain sensitive information from the Sametime Log database via a direct request to STLOG.NSF. (no CVSS)
- [CVE-2012-5359](https://cve.now/CVE-2012-5359.md): Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted ASF file. (no CVSS)
- [CVE-2012-5360](https://cve.now/CVE-2012-5360.md): Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted QT file. (no CVSS)
- [CVE-2013-2830](https://cve.now/CVE-2013-2830.md): Use-after-free vulnerability in SumatraPDF Reader 2.x before 2.2.1 allows remote attackers to execute arbitrary code via a crafted PDF file. (no CVSS)
- [CVE-2013-3552](https://cve.now/CVE-2013-3552.md): Nitro Pro 7.5.0.29 and earlier and Nitro Reader 2.5.0.45 and earlier allow remote attackers to execute arbitrary code via a crafted PDF file (no CVSS)
- [CVE-2013-3553](https://cve.now/CVE-2013-3553.md): Nitro Pro 7.5.0.22 and earlier and Nitro Reader 2.5.0.36 and earlier allow remote attackers to execute arbitrary code via a crafted PDF file (no CVSS)
- [CVE-2014-4066](https://cve.now/CVE-2014-4066.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2014-4112](https://cve.now/CVE-2014-4112.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2014-4145](https://cve.now/CVE-2014-4145.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2014-8985](https://cve.now/CVE-2014-8985.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS)
- [CVE-2015-2329](https://cve.now/CVE-2015-2329.md): Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2017-15914](https://cve.now/CVE-2017-15914.md): Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3. (no CVSS, borgbackup)
- [CVE-2018-6180](https://cve.now/CVE-2018-6180.md): A flaw in the profile section of Online Voting System 1.0 allows an unauthenticated user to set an arbitrary password for other accounts. (no CVSS)
- [CVE-2018-6644](https://cve.now/CVE-2018-6644.md): SBLIM Small Footprint CIM Broker (SFCB) 1.4.9 has a null pointer (DoS) vulnerability via a crafted POST request to the /cimom URI. (no CVSS)
- [CVE-2018-6789](https://cve.now/CVE-2018-6789.md): An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. (CVSS 9.8, KEV)
- [CVE-2017-6225](https://cve.now/CVE-2017-6225.md): Cross-site scripting (XSS) vulnerability in the web-based management interface of Brocade Fibre Channel SAN products running Brocade Fabric (no CVSS, Brocade Communications Systems Brocade FABRIC OS)
- [CVE-2017-6227](https://cve.now/CVE-2017-6227.md): A vulnerability in the IPv6 stack on Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b, 8.1.2 and 8. (no CVSS, Brocade Communications Systems Brocade FABRIC OS)
- [CVE-2018-5550](https://cve.now/CVE-2018-5550.md): Versions of Epson AirPrint released prior to January 19, 2018 contain a reflective cross-site scripting (XSS) vulnerability, which can allow (no CVSS, Epson AirPrint)
- [CVE-2017-17412](https://cve.now/CVE-2017-17412.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17413](https://cve.now/CVE-2017-17413.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS)
- [CVE-2017-17414](https://cve.now/CVE-2017-17414.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17415](https://cve.now/CVE-2017-17415.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17416](https://cve.now/CVE-2017-17416.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17417](https://cve.now/CVE-2017-17417.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17418](https://cve.now/CVE-2017-17418.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17419](https://cve.now/CVE-2017-17419.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17420](https://cve.now/CVE-2017-17420.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17421](https://cve.now/CVE-2017-17421.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17422](https://cve.now/CVE-2017-17422.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17423](https://cve.now/CVE-2017-17423.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17424](https://cve.now/CVE-2017-17424.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17425](https://cve.now/CVE-2017-17425.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17652](https://cve.now/CVE-2017-17652.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17653](https://cve.now/CVE-2017-17653.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17654](https://cve.now/CVE-2017-17654.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17655](https://cve.now/CVE-2017-17655.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17656](https://cve.now/CVE-2017-17656.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17657](https://cve.now/CVE-2017-17657.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17658](https://cve.now/CVE-2017-17658.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2017-17659](https://cve.now/CVE-2017-17659.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. (no CVSS, Quest NetVault Backup)
- [CVE-2018-1161](https://cve.now/CVE-2018-1161.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.2.0.13. (no CVSS, Quest NetVault Backup)
- [CVE-2018-1162](https://cve.now/CVE-2018-1162.md): This vulnerability allows remote attackers to create a denial-of-service condition on vulnerable installations of Quest NetVault Backup 11.2 (no CVSS, Quest NetVault Backup)
- [CVE-2018-1163](https://cve.now/CVE-2018-1163.md): This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup 11.2.0.13. (no CVSS, Quest NetVault Backup)
- [CVE-2018-1000030](https://cve.now/CVE-2018-1000030.md): Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. (CVSS 3.6)
- [CVE-2018-6846](https://cve.now/CVE-2018-6846.md): Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zb\_system/function/lib/upload.php. (no CVSS)
- [CVE-2017-7351](https://cve.now/CVE-2017-7351.md): A SQL injection issue exists in a file upload handler in REDCap 7.x before 7.0.11 via a trailing substring to SendITController:upload. (no CVSS)
- [CVE-2018-0512](https://cve.now/CVE-2018-0512.md): Devices with IP address setting tool "MagicalFinder" provided by I-O DATA DEVICE, INC. (no CVSS, I-O DATA DEVICE IP address setting tool "MagicalFinder")
- [CVE-2018-0513](https://cve.now/CVE-2018-0513.md): Cross-site scripting vulnerability in MTS Simple Booking C, MTS Simple Booking Business version 1.28.0 and earlier allows remote attackers t (no CVSS, MT Systems Co. MTS Simple Booking C · MT Systems Co. MTS Si…)
- [CVE-2018-0514](https://cve.now/CVE-2018-0514.md): MP Form Mail CGI eCommerce Edition Ver 2.0.13 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. (no CVSS, futomi Co. MP Form Mail CGI eCommerce Edition)
- [CVE-2018-0517](https://cve.now/CVE-2018-0517.md): Untrusted search path vulnerability in Anshin net security for Windows Version 16.0.1.44 and earlier allows an attacker to gain privileges v (no CVSS, KDDI Anshin net security for Windows)
- [CVE-2018-0113](https://cve.now/CVE-2018-0113.md): A vulnerability in an operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute arbitrary shell comman (no CVSS, Cisco UCS Central)
- [CVE-2018-0116](https://cve.now/CVE-2018-0116.md): A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to be authorized a (no CVSS, Cisco Policy Suite)
- [CVE-2018-0117](https://cve.now/CVE-2018-0117.md): A vulnerability in the ingress packet processing functionality of the Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software c (no CVSS, Cisco Virtualized Packet Core-Distributed Instance)
- [CVE-2018-0119](https://cve.now/CVE-2018-0119.md): A vulnerability in certain authentication controls in the account services of Cisco Spark could allow an authenticated, remote attacker to i (no CVSS, Cisco Spark)
- [CVE-2018-0120](https://cve.now/CVE-2018-0120.md): A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct an SQL (no CVSS, Cisco Unified Communications Manager)
- [CVE-2018-0122](https://cve.now/CVE-2018-0122.md): A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authen (no CVSS, Cisco StarOS for Cisco ASR 5000 Series Aggregation Services…)
- [CVE-2018-0123](https://cve.now/CVE-2018-0123.md): A Path Traversal vulnerability in the diagnostic shell for Cisco IOS and IOS XE Software could allow an authenticated, local attacker to use (no CVSS, Cisco IOS and IOS XE)
- [CVE-2018-0125](https://cve.now/CVE-2018-0125.md): A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unaut (CVSS 9.8, KEV, Cisco RV132W and RV134W)
- [CVE-2018-0127](https://cve.now/CVE-2018-0127.md): A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allo (no CVSS, Cisco RV132W and RV134W Wireless VPN Routers)
- [CVE-2018-0128](https://cve.now/CVE-2018-0128.md): A vulnerability in the web-based management interface of Cisco Data Center Analytics Framework could allow an unauthenticated, remote attack (no CVSS, Cisco Data Center Analytics Framework)
- [CVE-2018-0129](https://cve.now/CVE-2018-0129.md): A vulnerability in the web-based management interface of Cisco Data Center Analytics Framework could allow an unauthenticated, remote attack (no CVSS, Cisco Data Center Analytics Framework)
- [CVE-2018-0132](https://cve.now/CVE-2018-0132.md): A vulnerability in the forwarding information base (FIB) code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to ca (no CVSS, Cisco IOS XR)
- [CVE-2018-0134](https://cve.now/CVE-2018-0134.md): A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to determine wheth (no CVSS, Cisco Policy Suite)
- [CVE-2018-0135](https://cve.now/CVE-2018-0135.md): A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to access sensitive information on an (no CVSS, Cisco Unified Communications Manager)
- [CVE-2018-0137](https://cve.now/CVE-2018-0137.md): A vulnerability in the TCP throttling process of Cisco Prime Network could allow an unauthenticated, remote attacker to cause a denial of se (no CVSS, Cisco Prime Network)
- [CVE-2018-0138](https://cve.now/CVE-2018-0138.md): A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass file po (no CVSS, Cisco Firepower System Software)
- [CVE-2018-0140](https://cve.now/CVE-2018-0140.md): A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an auth (no CVSS, Cisco Email Security Appliance and Cisco Content Security M…)
- [CVE-2018-6834](https://cve.now/CVE-2018-6834.md): static/js/pad\_utils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href. (no CVSS)
- [CVE-2018-6835](https://cve.now/CVE-2018-6835.md): node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access rest (no CVSS, ep\_etherpad-lite)
- [CVE-2018-6836](https://cve.now/CVE-2018-6836.md): The netmonrec\_comment\_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an uninitialized memory a (no CVSS)
- [CVE-2018-6844](https://cve.now/CVE-2018-6844.md): MyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-02-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.