CVEs published February 12, 2018
54 CVEs were published on February 12, 2018: 0 critical, 0 high.
- Published
- 54
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 54
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Google Android
- 19
- Apache Software Foundation Apache CouchDB
- 1
- Apache Software Foundation Apache Thrift · github.com/apach…
- 1
- Dell SupportAssist Enterprise
- 1
Medium, low and unrated 54
- CVE-2017-9963A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistrib
- CVE-2017-9967A security misconfiguration vulnerability exists in Schneider Electric's IGSS SCADA Software versions 12 and prior.
- CVE-2017-9968A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of
- CVE-2017-9969An information disclosure vulnerability exists in Schneider Electric's IGSS Mobile application version 3.01 and prior.
- CVE-2017-9970A remote code execution vulnerability exists in Schneider Electric's StruxureOn Gateway versions 1.1.3 and prior.
- CVE-2017-17722In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remote denial of service
- CVE-2017-17723In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp.
- CVE-2017-17724In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::IptcData::printStructure function in iptc.cpp, related to the "!= 0x1c"
- CVE-2017-17725In Exiv2 0.26, there is an integer overflow leading to a heap-based buffer over-read in the Exiv2::getULong function in types.cpp.
- CVE-2018-1214Dell EMC SupportAssist Enterprise version 1.1 creates a local Windows user account named "OMEAdapterUser" with a default password as part ofDell SupportAssist Enterprise
- CVE-2017-13228In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an unsigned character.Google Android
- CVE-2017-13229A remote code execution vulnerability in the Android media framework (n/a).Google Android
- CVE-2017-13230In hevc codec, there is an out-of-bounds write due to an incorrect bounds check with the i2_pic_width_in_luma_samples value.Google Android
- CVE-2017-13231In libmediadrm, there is an out-of-bounds write due to improper input validation.Google Android
- CVE-2017-13232In audioserver, there is an out-of-bounds write due to a log statement using %s with an array that may not be NULL terminated.Google Android
- CVE-2017-13233In ihevcd_ctb_boundary_strength_pbslice of libhevc, there is possible resource exhaustion.Google Android
- CVE-2017-13234In DLSParser of the sonivox library, there is possible resource exhaustion due to a memory leak.Google Android
- CVE-2017-13235A other vulnerability in the Android media framework (n/a).Google Android
- CVE-2017-13236In the KeyStore service, there is a permissions bypass that allows access to protected resources.Google Android
- CVE-2017-13238In XBLRamDump mode, there is a debug feature that can be used to dump memory contents, if an attacker has physical access to the device.Google Android
- CVE-2017-13239A information disclosure vulnerability in the Android framework (ui framework).Google Android
- CVE-2017-13240A information disclosure vulnerability in the Android framework (crypto framework).Google Android
- CVE-2017-13241A information disclosure vulnerability in the Android media framework (libstagefright_soft_avcenc).Google Android
- CVE-2017-13242A information disclosure vulnerability in the Android system (bluetooth).Google Android
- CVE-2017-13243A information disclosure vulnerability in the Android system (ui).Google Android
- CVE-2017-13244A elevation of privilege vulnerability in the Upstream kernel easel.Google Android
- CVE-2017-13245A elevation of privilege vulnerability in the Upstream kernel audio driver.Google Android
- CVE-2017-13246A information disclosure vulnerability in the Upstream kernel network driver.Google Android
- CVE-2017-13247In the Pixel 2 bootloader, there is a missing permission check which bypasses carrier bootloader lock.Google Android
- CVE-2018-6927The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer
- CVE-2016-9569The cbstream.sys driver in Carbon Black 5.1.1.60603 allows local users with admin privileges to cause a denial of service (out-of-bounds rea
- CVE-2016-9570cb.exe in Carbon Black 5.1.1.60603 allows attackers to cause a denial of service (out-of-bounds read, invalid pointer dereference, and appli
- CVE-2016-5397The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tApache Software Foundation Apache Thrift · github.com/apach…
- CVE-2016-8742The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation.Apache Software Foundation Apache CouchDB
- CVE-2018-6926In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterp
- CVE-2017-18175Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demonstrated by the src at
- CVE-2017-18176Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code.
- CVE-2017-18177Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page.
- CVE-2017-18178Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the redirection target, i
- CVE-2017-18179Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a password change or a sessio
- CVE-2018-6893controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module'
- CVE-2018-6506Cross-Site Scripting (XSS) exists in the Add Forum feature in the Administrative Panel in miniBB 3.2.2 via crafted use of an onload attribut
- CVE-2018-6845PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field.
- CVE-2018-6858Cross Site Scripting (XSS) exists in PHP Scripts Mall Facebook Clone Script.
- CVE-2018-6860Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script 2.0.2 via a profile picture.
- CVE-2018-6861Cross Site Scripting (XSS) exists in PHP Scripts Mall Lawyer Search Script 1.0.2 via a profile update parameter.
- CVE-2018-6862Cross Site Scripting (XSS) exists in PHP Scripts Mall Bitcoin MLM Software 1.0.2 via a profile field.
- CVE-2018-6863SQL Injection exists in PHP Scripts Mall Select Your College Script 2.0.2 via a Login Parameter.
- CVE-2018-6864Cross Site Scripting (XSS) exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter.
- CVE-2018-6880EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php.
- CVE-2018-6881EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php.
- CVE-2018-6888An issue was discovered in Typesetter 5.1.
- CVE-2018-6889An issue was discovered in Typesetter 5.1.
- CVE-2018-6912The decode_plane function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of ar