CVEs published February 16, 2018
22 CVEs were published on February 16, 2018: 0 critical, 0 high.
- Published
- 22
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- org.jenkins-ci.main:jenkins-core
- 2
- Atlassian Crucible
- 1
- Atlassian Fisheye
- 1
- Atlassian Fisheye and Crucible
- 1
- NIPPON TELEGRAPH AND TELEPHONE EAST "FLET'S Azukeru Backup…
- 1
- NIPPON TELEGRAPH AND TELEPHONE WEST FLET'S v4 / v6 address…
- 1
- Red Hat systemd
- 1
- toolchain
- 1
- Trend Micro InterScan Messaging Security Virtual Appliance
- 1
- Trend Micro User-Mode Hooking (UMH) Module
- 1
Medium, low and unrated 22
- CVE-2018-3609A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticatTrend Micro InterScan Messaging Security Virtual Appliance
- CVE-2018-6218A DLL Hijacking vulnerability in Trend Micro's User-Mode Hooking Module (UMH) could allow an attacker to run arbitrary code on a vulnerable Trend Micro User-Mode Hooking (UMH) Module
- CVE-2018-1049In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be servRed Hat systemd
- CVE-2017-18089The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allows remote attackers Atlassian Crucible
- CVE-2017-18090Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers toAtlassian Fisheye
- CVE-2017-18091The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allowsAtlassian Fisheye and Crucible
- CVE-2018-7188An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator
- CVE-2017-18190A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitr
- CVE-2018-0515Untrusted search path vulnerability in "FLET'S Azukeru Backup Tool" version 1.5.2.6 and earlier allows an attacker to gain privileges via a NIPPON TELEGRAPH AND TELEPHONE EAST "FLET'S Azukeru Backup…
- CVE-2018-0516Untrusted search path vulnerability in FLET'S v4 / v6 address selection tool allows an attacker to gain privileges via a Trojan horse DLL inNIPPON TELEGRAPH AND TELEPHONE WEST FLET'S v4 / v6 address…
- CVE-2018-7187The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only toolchain
- CVE-2018-6943core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails
- CVE-2018-6944core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails
- CVE-2017-14535trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php.
- CVE-2017-14536trixbox 2.8.0.4 has XSS via the PATH_INFO to /maint/index.php or /user/includes/language/langChooser.php.
- CVE-2017-14537trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/ho
- CVE-2018-6189F-Secure Radar (on-premises) before 2018-02-15 has XSS via vectors involving the Tags parameter in the JSON request body in an outbound requ
- CVE-2018-6324F-Secure Radar (on-premises) before 2018-02-15 has an Unvalidated Redirect via the ReturnUrl parameter that triggers upon a user login.
- CVE-2018-7176FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the
- CVE-2018-1000067An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker toorg.jenkins-ci.main:jenkins-core
- CVE-2018-1000068An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attackerorg.jenkins-ci.main:jenkins-core
- CVE-2018-7186Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers t