CVEs published February 9, 2018
77 CVEs were published on February 9, 2018: 0 critical, 0 high.
- Published
- 77
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 77
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Trend Micro Control Manager
- 8
- IBM WebSphere Portal
- 2
- The PostgreSQL Global Development Group postgresql
- 2
- Apache Software Foundation Apache jUDDI · org.apache.juddi:…
- 1
- Apache Software Foundation Apache Qpid Broker-J · org.apach…
- 1
- austintoddj/canvas
- 1
- croogo/croogo
- 1
- dolibarr/dolibarr
- 1
- IBM Security Guardium
- 1
- insight-api
- 1
Medium, low and unrated 77
- CVE-2017-1000506Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of servicemautic/core
- CVE-2017-1000507Canvs Canvas version 3.4.2 contains a Cross Site Scripting (XSS) vulnerability in User's details that can result in denial of service and exaustintoddj/canvas
- CVE-2017-1000508Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that can result in execution
- CVE-2017-1000509Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript coddolibarr/dolibarr
- CVE-2017-1000510Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascriptcroogo/croogo
- CVE-2018-1000019OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in fax_dispatch.php that can result in OS command injection by an authen
- CVE-2018-1000020OpenEMR version 5.0.0 contains a Cross Site Scripting (XSS) vulnerability in open-flash-chart.swf and _posteddata.php that can result in .
- CVE-2018-1000021GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up te
- CVE-2018-1000022Electrum Technologies GmbH Electrum Bitcoin Wallet version prior to version 3.0.5 contains a Missing Authorization vulnerability in JSONRPC
- CVE-2018-1000023Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpointinsight-api
- CVE-2018-1000024The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerabil
- CVE-2018-1000025Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/Ikreait/firebase-php
- CVE-2018-1000026Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x netwo
- CVE-2018-1000027The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in
- CVE-2018-1000028Linux kernel version after commit bdcf0a423ea1 - 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+ contains a Incorrect Access Control vulnerability in
- CVE-2018-1000029mcholste Enterprise Log Search and Archive (ELSA) version revision 1205, commit 2cc17f1 and earlier contains a Cross Site Scripting (XSS) vu
- CVE-2018-1000031A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service or to possibly
- CVE-2018-1000032A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service or to possibly
- CVE-2018-1000033An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service and read sensitive mem
- CVE-2018-1000034An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service and read sensitive mem
- CVE-2018-1000035A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attack
- CVE-2018-1000041GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c
- CVE-2018-1000042Security Onion Solutions Squert version 1.3.0 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Com
- CVE-2018-1000043Security Onion Solutions Squert version 1.0.1 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Com
- CVE-2018-1000044Security Onion Solutions Squert version 1.1.1 through 1.6.7 contains a SQL Injection vulnerability in .inc/callback.php that can result in e
- CVE-2018-1000045NASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library (Weather data) that can result in remote code executi
- CVE-2018-1000046NASA Pyblock version v1.0 - v1.3 contains a CWE-502 vulnerability in Radar data parsing library that can result in remote code execution.
- CVE-2018-1000047NASA Kodiak version v1.0 contains a CWE-502 vulnerability in Kodiak library's data processing function that can result in remote code execut
- CVE-2018-1000048NASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval functionality of RtRetrieval framework that can re
- CVE-2018-1000049Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner API.
- CVE-2018-1000050Sean Barrett stb_vorbis version 1.12 and earlier contains a Buffer Overflow vulnerability in All vorbis decoding paths.
- CVE-2018-1000051Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / Possible code executio
- CVE-2018-1000052fmtlib version prior to version 4.1.0 (before commit 0555cea5fc0bf890afe0071a558e44625a34ba85) contains a Memory corruption (SIGSEGV), CWE-1
- CVE-2018-1000053LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Theme Uninstallation that can result in C
- CVE-2018-1000054Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with org.jvnet.hudson.plugins:ccm
- CVE-2018-1000055Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackorg.jvnet.hudson.plugins:android-lint
- CVE-2018-1000056Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers wiorg.jenkins-ci.plugins:junit
- CVE-2018-1000057Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs.org.jenkins-ci.plugins:credentials-binding
- CVE-2018-1000058Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods relorg.jenkins-ci.plugins.workflow:workflow-support
- CVE-2018-1000059ValidFormBuilder version 4.5.4 contains a PHP Object Injection vulnerability in Valid Form unserialize method that can result in Possible to
- CVE-2018-1000060Sensu, Inc.
- CVE-2018-1000062WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction(), 'svg' => 'ima
- CVE-2012-6346Multiple cross-site scripting (XSS) vulnerabilities in FortiWeb before 4.4.4 allow remote attackers to inject arbitrary web script or HTML v
- CVE-2012-6347Multiple cross-site scripting (XSS) vulnerabilities in Java number format exception handling in FortiGate FortiDB before 4.4.2 allow remote
- CVE-2014-3219fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (
- CVE-2014-8171The memory resource controller (aka memcg) in the Linux kernel allows local users to cause a denial of service (deadlock) by spawning new pr
- CVE-2015-1862The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specifi
- CVE-2017-0911Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an atTwitter Kit for iOS
- CVE-2018-3600A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to Trend Micro Control Manager
- CVE-2018-3601A password hash usage authentication bypass vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to bypass authentTrend Micro Control Manager
- CVE-2018-3602An AdHocQuery_Processor SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attaTrend Micro Control Manager
- CVE-2018-3603A CGGIServlet SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to exTrend Micro Control Manager
- CVE-2018-3604GetXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacker to Trend Micro Control Manager
- CVE-2018-3605TopXXX, ViolationXXX, and IncidentXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 coTrend Micro Control Manager
- CVE-2018-3606XXXStatusXXX, XXXSummary, TemplateXXX and XXXCompliance method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro ContTrend Micro Control Manager
- CVE-2018-3607XXXTreeNode method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attackeTrend Micro Control Manager
- CVE-2018-5306Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to
- CVE-2018-5307Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 2.x before 2.14.6 allow remote attackers
- CVE-2017-10689In previous versions of Puppet Agent it was possible to install a module with world writable permissions.Puppet Enterprise · Puppet Agent +1
- CVE-2017-10690In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retriPuppet Enterprise · Puppet Agent
- CVE-2018-6508Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the faPuppet Enterprise · puppetlabs/facter_task +4
- CVE-2018-1307In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediatesApache Software Foundation Apache jUDDI · org.apache.juddi:…
- CVE-2018-6876The OLEProperty class in ole/oleprop.cpp in libfpx 1.3.1-10, as used in ImageMagick 7.0.7-22 Q16 and other products, allows remote attackers
- CVE-2018-6878Cross Site Scripting (XSS) exists in the review section in PHP Scripts Mall Hot Scripts Clone Script Classified 3.1 via the title or descrip
- CVE-2017-1761IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting.IBM WebSphere Portal
- CVE-2018-1368IBM Security Guardium Database Activity Monitor 9.0, 9.1, and 9.5 could allow a local user with low privileges to view report pages and perfIBM Security Guardium
- CVE-2018-1401IBM WebSphere Portal 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting.IBM WebSphere Portal
- CVE-2018-6825An issue was discovered on VOBOT CLOCK before 0.99.30 devices.
- CVE-2018-6826An issue was discovered on VOBOT CLOCK before 0.99.30 devices.
- CVE-2018-6827VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serv
- CVE-2018-1052Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read aThe PostgreSQL Global Development Group postgresql
- CVE-2018-1053In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates filThe PostgreSQL Global Development Group postgresql
- CVE-2018-1298A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocApache Software Foundation Apache Qpid Broker-J · org.apach…
- CVE-2016-10712In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can be controlled if the i
- CVE-2018-6869In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function of zzip/zip.c.
- CVE-2018-6871LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use
- CVE-2018-6872The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows