# CVEs published 2018-02-09

77 CVEs were published on February 9, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2017-1000506](https://cve.now/CVE-2017-1000506.md): Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service (no CVSS, mautic/core)
- [CVE-2017-1000507](https://cve.now/CVE-2017-1000507.md): Canvs Canvas version 3.4.2 contains a Cross Site Scripting (XSS) vulnerability in User's details that can result in denial of service and ex (no CVSS, austintoddj/canvas)
- [CVE-2017-1000508](https://cve.now/CVE-2017-1000508.md): Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that can result in execution (no CVSS)
- [CVE-2017-1000509](https://cve.now/CVE-2017-1000509.md): Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript cod (no CVSS, dolibarr/dolibarr)
- [CVE-2017-1000510](https://cve.now/CVE-2017-1000510.md): Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript (no CVSS, croogo/croogo)
- [CVE-2018-1000019](https://cve.now/CVE-2018-1000019.md): OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in fax\_dispatch.php that can result in OS command injection by an authen (no CVSS)
- [CVE-2018-1000020](https://cve.now/CVE-2018-1000020.md): OpenEMR version 5.0.0 contains a Cross Site Scripting (XSS) vulnerability in open-flash-chart.swf and \_posteddata.php that can result in . (no CVSS)
- [CVE-2018-1000021](https://cve.now/CVE-2018-1000021.md): GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up te (no CVSS)
- [CVE-2018-1000022](https://cve.now/CVE-2018-1000022.md): Electrum Technologies GmbH Electrum Bitcoin Wallet version prior to version 3.0.5 contains a Missing Authorization vulnerability in JSONRPC (no CVSS)
- [CVE-2018-1000023](https://cve.now/CVE-2018-1000023.md): Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint (no CVSS, insight-api)
- [CVE-2018-1000024](https://cve.now/CVE-2018-1000024.md): The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerabil (no CVSS)
- [CVE-2018-1000025](https://cve.now/CVE-2018-1000025.md): Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/I (no CVSS, kreait/firebase-php)
- [CVE-2018-1000026](https://cve.now/CVE-2018-1000026.md): Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x netwo (no CVSS)
- [CVE-2018-1000027](https://cve.now/CVE-2018-1000027.md): The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in (no CVSS)
- [CVE-2018-1000028](https://cve.now/CVE-2018-1000028.md): Linux kernel version after commit bdcf0a423ea1 - 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+ contains a Incorrect Access Control vulnerability in (no CVSS)
- [CVE-2018-1000029](https://cve.now/CVE-2018-1000029.md): mcholste Enterprise Log Search and Archive (ELSA) version revision 1205, commit 2cc17f1 and earlier contains a Cross Site Scripting (XSS) vu (no CVSS)
- [CVE-2018-1000031](https://cve.now/CVE-2018-1000031.md): A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service or to possibly (no CVSS)
- [CVE-2018-1000032](https://cve.now/CVE-2018-1000032.md): A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service or to possibly (no CVSS)
- [CVE-2018-1000033](https://cve.now/CVE-2018-1000033.md): An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service and read sensitive mem (no CVSS)
- [CVE-2018-1000034](https://cve.now/CVE-2018-1000034.md): An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service and read sensitive mem (no CVSS)
- [CVE-2018-1000035](https://cve.now/CVE-2018-1000035.md): A heap-based buffer overflow exists in Info-Zip UnZip version \<= 6.00 in the processing of password-protected archives that allows an attack (no CVSS)
- [CVE-2018-1000041](https://cve.now/CVE-2018-1000041.md): GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c (no CVSS)
- [CVE-2018-1000042](https://cve.now/CVE-2018-1000042.md): Security Onion Solutions Squert version 1.3.0 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Com (no CVSS)
- [CVE-2018-1000043](https://cve.now/CVE-2018-1000043.md): Security Onion Solutions Squert version 1.0.1 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Com (no CVSS)
- [CVE-2018-1000044](https://cve.now/CVE-2018-1000044.md): Security Onion Solutions Squert version 1.1.1 through 1.6.7 contains a SQL Injection vulnerability in .inc/callback.php that can result in e (no CVSS)
- [CVE-2018-1000045](https://cve.now/CVE-2018-1000045.md): NASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library (Weather data) that can result in remote code executi (no CVSS)
- [CVE-2018-1000046](https://cve.now/CVE-2018-1000046.md): NASA Pyblock version v1.0 - v1.3 contains a CWE-502 vulnerability in Radar data parsing library that can result in remote code execution. (no CVSS)
- [CVE-2018-1000047](https://cve.now/CVE-2018-1000047.md): NASA Kodiak version v1.0 contains a CWE-502 vulnerability in Kodiak library's data processing function that can result in remote code execut (no CVSS)
- [CVE-2018-1000048](https://cve.now/CVE-2018-1000048.md): NASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval functionality of RtRetrieval framework that can re (no CVSS)
- [CVE-2018-1000049](https://cve.now/CVE-2018-1000049.md): Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner API. (no CVSS)
- [CVE-2018-1000050](https://cve.now/CVE-2018-1000050.md): Sean Barrett stb\_vorbis version 1.12 and earlier contains a Buffer Overflow vulnerability in All vorbis decoding paths. (no CVSS)
- [CVE-2018-1000051](https://cve.now/CVE-2018-1000051.md): Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz\_keep\_key\_storable that can result in DOS / Possible code executio (no CVSS)
- [CVE-2018-1000052](https://cve.now/CVE-2018-1000052.md): fmtlib version prior to version 4.1.0 (before commit 0555cea5fc0bf890afe0071a558e44625a34ba85) contains a Memory corruption (SIGSEGV), CWE-1 (no CVSS)
- [CVE-2018-1000053](https://cve.now/CVE-2018-1000053.md): LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Theme Uninstallation that can result in C (no CVSS)
- [CVE-2018-1000054](https://cve.now/CVE-2018-1000054.md): Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with (no CVSS, org.jvnet.hudson.plugins:ccm)
- [CVE-2018-1000055](https://cve.now/CVE-2018-1000055.md): Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attack (no CVSS, org.jvnet.hudson.plugins:android-lint)
- [CVE-2018-1000056](https://cve.now/CVE-2018-1000056.md): Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers wi (no CVSS, org.jenkins-ci.plugins:junit)
- [CVE-2018-1000057](https://cve.now/CVE-2018-1000057.md): Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. (no CVSS, org.jenkins-ci.plugins:credentials-binding)
- [CVE-2018-1000058](https://cve.now/CVE-2018-1000058.md): Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods rel (no CVSS, org.jenkins-ci.plugins.workflow:workflow-support)
- [CVE-2018-1000059](https://cve.now/CVE-2018-1000059.md): ValidFormBuilder version 4.5.4 contains a PHP Object Injection vulnerability in Valid Form unserialize method that can result in Possible to (no CVSS)
- [CVE-2018-1000060](https://cve.now/CVE-2018-1000060.md): Sensu, Inc. (no CVSS)
- [CVE-2018-1000062](https://cve.now/CVE-2018-1000062.md): WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction(), 'svg' =\> 'ima (no CVSS)
- [CVE-2012-6346](https://cve.now/CVE-2012-6346.md): Multiple cross-site scripting (XSS) vulnerabilities in FortiWeb before 4.4.4 allow remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2012-6347](https://cve.now/CVE-2012-6347.md): Multiple cross-site scripting (XSS) vulnerabilities in Java number format exception handling in FortiGate FortiDB before 4.4.2 allow remote (no CVSS)
- [CVE-2014-3219](https://cve.now/CVE-2014-3219.md): fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, ( (no CVSS)
- [CVE-2014-8171](https://cve.now/CVE-2014-8171.md): The memory resource controller (aka memcg) in the Linux kernel allows local users to cause a denial of service (deadlock) by spawning new pr (no CVSS)
- [CVE-2015-1862](https://cve.now/CVE-2015-1862.md): The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specifi (no CVSS)
- [CVE-2017-0911](https://cve.now/CVE-2017-0911.md): Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an at (no CVSS, Twitter Kit for iOS)
- [CVE-2018-3600](https://cve.now/CVE-2018-3600.md): A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to (no CVSS, Trend Micro Control Manager)
- [CVE-2018-3601](https://cve.now/CVE-2018-3601.md): A password hash usage authentication bypass vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to bypass authent (no CVSS, Trend Micro Control Manager)
- [CVE-2018-3602](https://cve.now/CVE-2018-3602.md): An AdHocQuery\_Processor SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote atta (no CVSS, Trend Micro Control Manager)
- [CVE-2018-3603](https://cve.now/CVE-2018-3603.md): A CGGIServlet SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to ex (no CVSS, Trend Micro Control Manager)
- [CVE-2018-3604](https://cve.now/CVE-2018-3604.md): GetXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacker to (no CVSS, Trend Micro Control Manager)
- [CVE-2018-3605](https://cve.now/CVE-2018-3605.md): TopXXX, ViolationXXX, and IncidentXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 co (no CVSS, Trend Micro Control Manager)
- [CVE-2018-3606](https://cve.now/CVE-2018-3606.md): XXXStatusXXX, XXXSummary, TemplateXXX and XXXCompliance method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Cont (no CVSS, Trend Micro Control Manager)
- [CVE-2018-3607](https://cve.now/CVE-2018-3607.md): XXXTreeNode method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacke (no CVSS, Trend Micro Control Manager)
- [CVE-2018-5306](https://cve.now/CVE-2018-5306.md): Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to (no CVSS)
- [CVE-2018-5307](https://cve.now/CVE-2018-5307.md): Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 2.x before 2.14.6 allow remote attackers (no CVSS)
- [CVE-2017-10689](https://cve.now/CVE-2017-10689.md): In previous versions of Puppet Agent it was possible to install a module with world writable permissions. (no CVSS, Puppet Enterprise · Puppet Agent +1)
- [CVE-2017-10690](https://cve.now/CVE-2017-10690.md): In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retri (no CVSS, Puppet Enterprise · Puppet Agent)
- [CVE-2018-6508](https://cve.now/CVE-2018-6508.md): Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the fa (no CVSS, Puppet Enterprise · puppetlabs/facter\_task +4)
- [CVE-2018-1307](https://cve.now/CVE-2018-1307.md): In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates (no CVSS, Apache Software Foundation Apache jUDDI · org.apache.juddi:…)
- [CVE-2018-6876](https://cve.now/CVE-2018-6876.md): The OLEProperty class in ole/oleprop.cpp in libfpx 1.3.1-10, as used in ImageMagick 7.0.7-22 Q16 and other products, allows remote attackers (no CVSS)
- [CVE-2018-6878](https://cve.now/CVE-2018-6878.md): Cross Site Scripting (XSS) exists in the review section in PHP Scripts Mall Hot Scripts Clone Script Classified 3.1 via the title or descrip (no CVSS)
- [CVE-2017-1761](https://cve.now/CVE-2017-1761.md): IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. (no CVSS, IBM WebSphere Portal)
- [CVE-2018-1368](https://cve.now/CVE-2018-1368.md): IBM Security Guardium Database Activity Monitor 9.0, 9.1, and 9.5 could allow a local user with low privileges to view report pages and perf (no CVSS, IBM Security Guardium)
- [CVE-2018-1401](https://cve.now/CVE-2018-1401.md): IBM WebSphere Portal 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. (no CVSS, IBM WebSphere Portal)
- [CVE-2018-6825](https://cve.now/CVE-2018-6825.md): An issue was discovered on VOBOT CLOCK before 0.99.30 devices. (no CVSS)
- [CVE-2018-6826](https://cve.now/CVE-2018-6826.md): An issue was discovered on VOBOT CLOCK before 0.99.30 devices. (no CVSS)
- [CVE-2018-6827](https://cve.now/CVE-2018-6827.md): VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serv (no CVSS)
- [CVE-2018-1052](https://cve.now/CVE-2018-1052.md): Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read a (no CVSS, The PostgreSQL Global Development Group postgresql)
- [CVE-2018-1053](https://cve.now/CVE-2018-1053.md): In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg\_upgrade creates fil (no CVSS, The PostgreSQL Global Development Group postgresql)
- [CVE-2018-1298](https://cve.now/CVE-2018-1298.md): A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protoc (no CVSS, Apache Software Foundation Apache Qpid Broker-J · org.apach…)
- [CVE-2016-10712](https://cve.now/CVE-2016-10712.md): In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream\_get\_meta\_data can be controlled if the i (no CVSS)
- [CVE-2018-6869](https://cve.now/CVE-2018-6869.md): In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the \_\_zzip\_parse\_root\_directory function of zzip/zip.c. (no CVSS)
- [CVE-2018-6871](https://cve.now/CVE-2018-6871.md): LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use (no CVSS)
- [CVE-2018-6872](https://cve.now/CVE-2018-6872.md): The elf\_parse\_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-02-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.