CVEs published February 19, 2018
43 CVEs were published on February 19, 2018: 1 critical, 2 high.
- Published
- 43
- Critical
- 1
- High
- 2
- Medium
- 2
- Low
- 0
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Quagga bgpd
- 4
- IBM Client Application Access · IBM Notes
- 3
- Atlassian Crucible
- 2
- GE D60 Line Distance Relay
- 2
- anchorcms/anchor-cms
- 1
- Apache Software Foundation Apache Karaf · org.apache.karaf:…
- 1
- Apache Software Foundation Apache Oozie · org.apache.oozie:…
- 1
- Apache Software Foundation jUDDI
- 1
- Atlassian Fisheye and Crucible
- 1
- jcbrand/converse.js · converse.js
- 1
Critical 1
High 2
- CVE-2018-5378The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute leQuagga bgpd
- CVE-2018-5379The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing clustQuagga bgpd
Medium, low and unrated 40
- CVE-2018-7253The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-b
- CVE-2018-7254The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buf
- CVE-2018-7251An issue was discovered in config/error.php in Anchor 0.12.3.anchorcms/anchor-cms
- CVE-2016-10007SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated admini
- CVE-2016-10008SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenti
- CVE-2018-5763An issue was discovered in OXID eShop Enterprise Edition before 5.3.7 and 6.x before 6.0.1.
- CVE-2010-0109DBManager in Symantec Altiris Deployment Solution 6.9.x before DS 6.9 SP4 allows remote attackers to cause a denial of service via a crafted
- CVE-2011-3477GEAR Software CD DVD Filter driver (aka GEARAspiWDM.sys), as used in Symantec Backup Exec System Recovery 8.5 and BESR 2010, Symantec System
- CVE-2012-0771Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns
- CVE-2014-3972Directory traversal vulnerability in Apexis APM-J601-WS cameras with firmware before 17.35.2.49 allows remote attackers to read arbitrary fi
- CVE-2015-2324Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authentica
- CVE-2015-9253An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20.
- CVE-2016-9568A security design issue can allow an unprivileged user to interact with the Carbon Black Sensor and perform unauthorized actions.
- CVE-2017-16670The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a
- CVE-2017-17101An issue was discovered in Apexis APM-H803-MPC software, as used with many different models of IP Camera.
- CVE-2017-7376Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling
- CVE-2018-6592Unisys Stealth 3.3 Windows endpoints before 3.3.016.1 allow local users to gain access to Stealth-enabled devices by leveraging improper cle
- CVE-2018-5439A Command Injection issue was discovered in Nortek Linear eMerge E3 series Versions V0.32-07e and prior.Nortek Linear eMerge E3 Series
- CVE-2018-5473An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in GE D60 Line Distance Relay devices runninGE D60 Line Distance Relay
- CVE-2018-5475A Stack-based Buffer Overflow issue was discovered in GE D60 Line Distance Relay devices running firmware Version 7.11 and prior.GE D60 Line Distance Relay
- CVE-2018-7247An issue was discovered in pixHtmlViewer in prog/htmlviewer.c in Leptonica before 1.75.3.
- CVE-2017-18191An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1.nova
- CVE-2018-7226An issue was discovered in vcSetXCutTextProc() in VNConsole.c in LinuxVNC and VNCommand from the LibVNC/vncterm distribution through 0.9.10.
- CVE-2009-4267The console in Apache jUDDI 3.0.0 does not properly escape line feeds, which allows remote authenticated users to spoof log entries via the Apache Software Foundation jUDDI
- CVE-2016-8750Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP.Apache Software Foundation Apache Karaf · org.apache.karaf:…
- CVE-2018-7225An issue was discovered in LibVNCServer through 0.9.11.
- CVE-2017-15712Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process.Apache Software Foundation Apache Oozie · org.apache.oozie:…
- CVE-2017-16755An issue was discovered in Userscape HelpSpot before 4.7.2.
- CVE-2017-16756An issue was discovered in Userscape HelpSpot before 4.7.2.
- CVE-2017-18092The print snippet resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackersAtlassian Crucible
- CVE-2017-18093Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackeAtlassian Fisheye and Crucible
- CVE-2017-18095The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attackerAtlassian Crucible
- CVE-2018-1409IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system.IBM Client Application Access · IBM Notes
- CVE-2018-1410IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system.IBM Client Application Access · IBM Notes
- CVE-2018-1411IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system.IBM Client Application Access · IBM Notes
- CVE-2018-6591Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine whethjcbrand/converse.js · converse.js
- CVE-2018-7219application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a p
- CVE-2018-5380The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer vaQuagga bgpd
- CVE-2018-5381The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgpQuagga bgpd
- CVE-2017-16924Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencry