# CVEs published 2018-02-12

54 CVEs were published on February 12, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2017-9963](https://cve.now/CVE-2017-9963.md): A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistrib (no CVSS)
- [CVE-2017-9967](https://cve.now/CVE-2017-9967.md): A security misconfiguration vulnerability exists in Schneider Electric's IGSS SCADA Software versions 12 and prior. (no CVSS)
- [CVE-2017-9968](https://cve.now/CVE-2017-9968.md): A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of (no CVSS)
- [CVE-2017-9969](https://cve.now/CVE-2017-9969.md): An information disclosure vulnerability exists in Schneider Electric's IGSS Mobile application version 3.01 and prior. (no CVSS)
- [CVE-2017-9970](https://cve.now/CVE-2017-9970.md): A remote code execution vulnerability exists in Schneider Electric's StruxureOn Gateway versions 1.1.3 and prior. (no CVSS)
- [CVE-2017-17722](https://cve.now/CVE-2017-17722.md): In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remote denial of service (no CVSS)
- [CVE-2017-17723](https://cve.now/CVE-2017-17723.md): In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp. (no CVSS)
- [CVE-2017-17724](https://cve.now/CVE-2017-17724.md): In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::IptcData::printStructure function in iptc.cpp, related to the "!= 0x1c" (no CVSS)
- [CVE-2017-17725](https://cve.now/CVE-2017-17725.md): In Exiv2 0.26, there is an integer overflow leading to a heap-based buffer over-read in the Exiv2::getULong function in types.cpp. (no CVSS)
- [CVE-2018-1214](https://cve.now/CVE-2018-1214.md): Dell EMC SupportAssist Enterprise version 1.1 creates a local Windows user account named "OMEAdapterUser" with a default password as part of (no CVSS, Dell SupportAssist Enterprise)
- [CVE-2017-13228](https://cve.now/CVE-2017-13228.md): In function ih264d\_ref\_idx\_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an unsigned character. (no CVSS, Google Android)
- [CVE-2017-13229](https://cve.now/CVE-2017-13229.md): A remote code execution vulnerability in the Android media framework (n/a). (no CVSS, Google Android)
- [CVE-2017-13230](https://cve.now/CVE-2017-13230.md): In hevc codec, there is an out-of-bounds write due to an incorrect bounds check with the i2\_pic\_width\_in\_luma\_samples value. (no CVSS, Google Android)
- [CVE-2017-13231](https://cve.now/CVE-2017-13231.md): In libmediadrm, there is an out-of-bounds write due to improper input validation. (no CVSS, Google Android)
- [CVE-2017-13232](https://cve.now/CVE-2017-13232.md): In audioserver, there is an out-of-bounds write due to a log statement using %s with an array that may not be NULL terminated. (no CVSS, Google Android)
- [CVE-2017-13233](https://cve.now/CVE-2017-13233.md): In ihevcd\_ctb\_boundary\_strength\_pbslice of libhevc, there is possible resource exhaustion. (no CVSS, Google Android)
- [CVE-2017-13234](https://cve.now/CVE-2017-13234.md): In DLSParser of the sonivox library, there is possible resource exhaustion due to a memory leak. (no CVSS, Google Android)
- [CVE-2017-13235](https://cve.now/CVE-2017-13235.md): A other vulnerability in the Android media framework (n/a). (no CVSS, Google Android)
- [CVE-2017-13236](https://cve.now/CVE-2017-13236.md): In the KeyStore service, there is a permissions bypass that allows access to protected resources. (no CVSS, Google Android)
- [CVE-2017-13238](https://cve.now/CVE-2017-13238.md): In XBLRamDump mode, there is a debug feature that can be used to dump memory contents, if an attacker has physical access to the device. (no CVSS, Google Android)
- [CVE-2017-13239](https://cve.now/CVE-2017-13239.md): A information disclosure vulnerability in the Android framework (ui framework). (no CVSS, Google Android)
- [CVE-2017-13240](https://cve.now/CVE-2017-13240.md): A information disclosure vulnerability in the Android framework (crypto framework). (no CVSS, Google Android)
- [CVE-2017-13241](https://cve.now/CVE-2017-13241.md): A information disclosure vulnerability in the Android media framework (libstagefright\_soft\_avcenc). (no CVSS, Google Android)
- [CVE-2017-13242](https://cve.now/CVE-2017-13242.md): A information disclosure vulnerability in the Android system (bluetooth). (no CVSS, Google Android)
- [CVE-2017-13243](https://cve.now/CVE-2017-13243.md): A information disclosure vulnerability in the Android system (ui). (no CVSS, Google Android)
- [CVE-2017-13244](https://cve.now/CVE-2017-13244.md): A elevation of privilege vulnerability in the Upstream kernel easel. (no CVSS, Google Android)
- [CVE-2017-13245](https://cve.now/CVE-2017-13245.md): A elevation of privilege vulnerability in the Upstream kernel audio driver. (no CVSS, Google Android)
- [CVE-2017-13246](https://cve.now/CVE-2017-13246.md): A information disclosure vulnerability in the Upstream kernel network driver. (no CVSS, Google Android)
- [CVE-2017-13247](https://cve.now/CVE-2017-13247.md): In the Pixel 2 bootloader, there is a missing permission check which bypasses carrier bootloader lock. (no CVSS, Google Android)
- [CVE-2018-6927](https://cve.now/CVE-2018-6927.md): The futex\_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer (no CVSS)
- [CVE-2016-9569](https://cve.now/CVE-2016-9569.md): The cbstream.sys driver in Carbon Black 5.1.1.60603 allows local users with admin privileges to cause a denial of service (out-of-bounds rea (no CVSS)
- [CVE-2016-9570](https://cve.now/CVE-2016-9570.md): cb.exe in Carbon Black 5.1.1.60603 allows attackers to cause a denial of service (out-of-bounds read, invalid pointer dereference, and appli (no CVSS)
- [CVE-2016-5397](https://cve.now/CVE-2016-5397.md): The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting t (no CVSS, Apache Software Foundation Apache Thrift · github.com/apach…)
- [CVE-2016-8742](https://cve.now/CVE-2016-8742.md): The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. (no CVSS, Apache Software Foundation Apache CouchDB)
- [CVE-2018-6926](https://cve.now/CVE-2018-6926.md): In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterp (no CVSS)
- [CVE-2017-18175](https://cve.now/CVE-2017-18175.md): Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demonstrated by the src at (no CVSS)
- [CVE-2017-18176](https://cve.now/CVE-2017-18176.md): Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code. (no CVSS)
- [CVE-2017-18177](https://cve.now/CVE-2017-18177.md): Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. (no CVSS)
- [CVE-2017-18178](https://cve.now/CVE-2017-18178.md): Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the redirection target, i (no CVSS)
- [CVE-2017-18179](https://cve.now/CVE-2017-18179.md): Progress Sitefinity 9.1 uses wrap\_access\_token as a non-expiring authentication token that remains valid after a password change or a sessio (no CVSS)
- [CVE-2018-6893](https://cve.now/CVE-2018-6893.md): controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' (no CVSS)
- [CVE-2018-6506](https://cve.now/CVE-2018-6506.md): Cross-Site Scripting (XSS) exists in the Add Forum feature in the Administrative Panel in miniBB 3.2.2 via crafted use of an onload attribut (no CVSS)
- [CVE-2018-6845](https://cve.now/CVE-2018-6845.md): PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field. (no CVSS)
- [CVE-2018-6858](https://cve.now/CVE-2018-6858.md): Cross Site Scripting (XSS) exists in PHP Scripts Mall Facebook Clone Script. (no CVSS)
- [CVE-2018-6860](https://cve.now/CVE-2018-6860.md): Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script 2.0.2 via a profile picture. (no CVSS)
- [CVE-2018-6861](https://cve.now/CVE-2018-6861.md): Cross Site Scripting (XSS) exists in PHP Scripts Mall Lawyer Search Script 1.0.2 via a profile update parameter. (no CVSS)
- [CVE-2018-6862](https://cve.now/CVE-2018-6862.md): Cross Site Scripting (XSS) exists in PHP Scripts Mall Bitcoin MLM Software 1.0.2 via a profile field. (no CVSS)
- [CVE-2018-6863](https://cve.now/CVE-2018-6863.md): SQL Injection exists in PHP Scripts Mall Select Your College Script 2.0.2 via a Login Parameter. (no CVSS)
- [CVE-2018-6864](https://cve.now/CVE-2018-6864.md): Cross Site Scripting (XSS) exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter. (no CVSS)
- [CVE-2018-6880](https://cve.now/CVE-2018-6880.md): EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php. (no CVSS)
- [CVE-2018-6881](https://cve.now/CVE-2018-6881.md): EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php. (no CVSS)
- [CVE-2018-6888](https://cve.now/CVE-2018-6888.md): An issue was discovered in Typesetter 5.1. (no CVSS)
- [CVE-2018-6889](https://cve.now/CVE-2018-6889.md): An issue was discovered in Typesetter 5.1. (no CVSS)
- [CVE-2018-6912](https://cve.now/CVE-2018-6912.md): The decode\_plane function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of ar (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-02-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.