# CVEs published 2018-02-16

22 CVEs were published on February 16, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-3609](https://cve.now/CVE-2018-3609.md): A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticat (no CVSS, Trend Micro InterScan Messaging Security Virtual Appliance)
- [CVE-2018-6218](https://cve.now/CVE-2018-6218.md): A DLL Hijacking vulnerability in Trend Micro's User-Mode Hooking Module (UMH) could allow an attacker to run arbitrary code on a vulnerable (no CVSS, Trend Micro User-Mode Hooking (UMH) Module)
- [CVE-2018-1049](https://cve.now/CVE-2018-1049.md): In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serv (no CVSS, Red Hat systemd)
- [CVE-2017-18089](https://cve.now/CVE-2017-18089.md): The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allows remote attackers (no CVSS, Atlassian Crucible)
- [CVE-2017-18090](https://cve.now/CVE-2017-18090.md): Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to (no CVSS, Atlassian Fisheye)
- [CVE-2017-18091](https://cve.now/CVE-2017-18091.md): The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows (no CVSS, Atlassian Fisheye and Crucible)
- [CVE-2018-7188](https://cve.now/CVE-2018-7188.md): An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator (no CVSS)
- [CVE-2017-18190](https://cve.now/CVE-2017-18190.md): A localhost.localdomain whitelist entry in valid\_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2018-0515](https://cve.now/CVE-2018-0515.md): Untrusted search path vulnerability in "FLET'S Azukeru Backup Tool" version 1.5.2.6 and earlier allows an attacker to gain privileges via a (no CVSS, NIPPON TELEGRAPH AND TELEPHONE EAST "FLET'S Azukeru Backup…)
- [CVE-2018-0516](https://cve.now/CVE-2018-0516.md): Untrusted search path vulnerability in FLET'S v4 / v6 address selection tool allows an attacker to gain privileges via a Trojan horse DLL in (no CVSS, NIPPON TELEGRAPH AND TELEPHONE WEST FLET'S v4 / v6 address…)
- [CVE-2018-7187](https://cve.now/CVE-2018-7187.md): The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only (no CVSS, toolchain)
- [CVE-2018-6943](https://cve.now/CVE-2018-6943.md): core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails (no CVSS)
- [CVE-2018-6944](https://cve.now/CVE-2018-6944.md): core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails (no CVSS)
- [CVE-2017-14535](https://cve.now/CVE-2017-14535.md): trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php. (no CVSS)
- [CVE-2017-14536](https://cve.now/CVE-2017-14536.md): trixbox 2.8.0.4 has XSS via the PATH\_INFO to /maint/index.php or /user/includes/language/langChooser.php. (no CVSS)
- [CVE-2017-14537](https://cve.now/CVE-2017-14537.md): trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/ho (no CVSS)
- [CVE-2018-6189](https://cve.now/CVE-2018-6189.md): F-Secure Radar (on-premises) before 2018-02-15 has XSS via vectors involving the Tags parameter in the JSON request body in an outbound requ (no CVSS)
- [CVE-2018-6324](https://cve.now/CVE-2018-6324.md): F-Secure Radar (on-premises) before 2018-02-15 has an Unvalidated Redirect via the ReturnUrl parameter that triggers upon a user login. (no CVSS)
- [CVE-2018-7176](https://cve.now/CVE-2018-7176.md): FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the (no CVSS)
- [CVE-2018-1000067](https://cve.now/CVE-2018-1000067.md): An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-1000068](https://cve.now/CVE-2018-1000068.md): An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-7186](https://cve.now/CVE-2018-7186.md): Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers t (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-02-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.