# CVEs published 2018-02-19

43 CVEs were published on February 19, 2018: 1 critical, 2 high. Days are UTC.

- [CVE-2018-7253](https://cve.now/CVE-2018-7253.md): The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-b (no CVSS)
- [CVE-2018-7254](https://cve.now/CVE-2018-7254.md): The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buf (no CVSS)
- [CVE-2018-7251](https://cve.now/CVE-2018-7251.md): An issue was discovered in config/error.php in Anchor 0.12.3. (no CVSS, anchorcms/anchor-cms)
- [CVE-2016-10007](https://cve.now/CVE-2016-10007.md): SQL injection vulnerability in the "Marketing \> Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated admini (no CVSS)
- [CVE-2016-10008](https://cve.now/CVE-2016-10008.md): SQL injection vulnerability in the "Content Types \> Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenti (no CVSS)
- [CVE-2018-5763](https://cve.now/CVE-2018-5763.md): An issue was discovered in OXID eShop Enterprise Edition before 5.3.7 and 6.x before 6.0.1. (no CVSS)
- [CVE-2010-0109](https://cve.now/CVE-2010-0109.md): DBManager in Symantec Altiris Deployment Solution 6.9.x before DS 6.9 SP4 allows remote attackers to cause a denial of service via a crafted (no CVSS)
- [CVE-2011-3477](https://cve.now/CVE-2011-3477.md): GEAR Software CD DVD Filter driver (aka GEARAspiWDM.sys), as used in Symantec Backup Exec System Recovery 8.5 and BESR 2010, Symantec System (no CVSS)
- [CVE-2012-0771](https://cve.now/CVE-2012-0771.md): Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns (no CVSS)
- [CVE-2014-3972](https://cve.now/CVE-2014-3972.md): Directory traversal vulnerability in Apexis APM-J601-WS cameras with firmware before 17.35.2.49 allows remote attackers to read arbitrary fi (no CVSS)
- [CVE-2015-2324](https://cve.now/CVE-2015-2324.md): Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authentica (no CVSS)
- [CVE-2015-9253](https://cve.now/CVE-2015-9253.md): An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. (no CVSS)
- [CVE-2016-9568](https://cve.now/CVE-2016-9568.md): A security design issue can allow an unprivileged user to interact with the Carbon Black Sensor and perform unauthorized actions. (no CVSS)
- [CVE-2017-16670](https://cve.now/CVE-2017-16670.md): The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a (no CVSS)
- [CVE-2017-17101](https://cve.now/CVE-2017-17101.md): An issue was discovered in Apexis APM-H803-MPC software, as used with many different models of IP Camera. (no CVSS)
- [CVE-2017-7375](https://cve.now/CVE-2017-7375.md): A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, D (CVSS 9.8)
- [CVE-2017-7376](https://cve.now/CVE-2017-7376.md): Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling (no CVSS)
- [CVE-2018-6592](https://cve.now/CVE-2018-6592.md): Unisys Stealth 3.3 Windows endpoints before 3.3.016.1 allow local users to gain access to Stealth-enabled devices by leveraging improper cle (no CVSS)
- [CVE-2018-5439](https://cve.now/CVE-2018-5439.md): A Command Injection issue was discovered in Nortek Linear eMerge E3 series Versions V0.32-07e and prior. (no CVSS, Nortek Linear eMerge E3 Series)
- [CVE-2018-5473](https://cve.now/CVE-2018-5473.md): An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in GE D60 Line Distance Relay devices runnin (no CVSS, GE D60 Line Distance Relay)
- [CVE-2018-5475](https://cve.now/CVE-2018-5475.md): A Stack-based Buffer Overflow issue was discovered in GE D60 Line Distance Relay devices running firmware Version 7.11 and prior. (no CVSS, GE D60 Line Distance Relay)
- [CVE-2018-7247](https://cve.now/CVE-2018-7247.md): An issue was discovered in pixHtmlViewer in prog/htmlviewer.c in Leptonica before 1.75.3. (no CVSS)
- [CVE-2017-18191](https://cve.now/CVE-2017-18191.md): An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. (no CVSS, nova)
- [CVE-2018-7226](https://cve.now/CVE-2018-7226.md): An issue was discovered in vcSetXCutTextProc() in VNConsole.c in LinuxVNC and VNCommand from the LibVNC/vncterm distribution through 0.9.10. (no CVSS)
- [CVE-2009-4267](https://cve.now/CVE-2009-4267.md): The console in Apache jUDDI 3.0.0 does not properly escape line feeds, which allows remote authenticated users to spoof log entries via the (no CVSS, Apache Software Foundation jUDDI)
- [CVE-2016-8750](https://cve.now/CVE-2016-8750.md): Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. (no CVSS, Apache Software Foundation Apache Karaf · org.apache.karaf:…)
- [CVE-2018-7225](https://cve.now/CVE-2018-7225.md): An issue was discovered in LibVNCServer through 0.9.11. (no CVSS)
- [CVE-2017-15712](https://cve.now/CVE-2017-15712.md): Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. (no CVSS, Apache Software Foundation Apache Oozie · org.apache.oozie:…)
- [CVE-2017-16755](https://cve.now/CVE-2017-16755.md): An issue was discovered in Userscape HelpSpot before 4.7.2. (no CVSS)
- [CVE-2017-16756](https://cve.now/CVE-2017-16756.md): An issue was discovered in Userscape HelpSpot before 4.7.2. (no CVSS)
- [CVE-2017-18092](https://cve.now/CVE-2017-18092.md): The print snippet resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers (no CVSS, Atlassian Crucible)
- [CVE-2017-18093](https://cve.now/CVE-2017-18093.md): Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attacke (no CVSS, Atlassian Fisheye and Crucible)
- [CVE-2017-18095](https://cve.now/CVE-2017-18095.md): The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attacker (no CVSS, Atlassian Crucible)
- [CVE-2018-1409](https://cve.now/CVE-2018-1409.md): IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. (no CVSS, IBM Client Application Access · IBM Notes)
- [CVE-2018-1410](https://cve.now/CVE-2018-1410.md): IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. (no CVSS, IBM Client Application Access · IBM Notes)
- [CVE-2018-1411](https://cve.now/CVE-2018-1411.md): IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. (no CVSS, IBM Client Application Access · IBM Notes)
- [CVE-2018-6591](https://cve.now/CVE-2018-6591.md): Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine wheth (no CVSS, jcbrand/converse.js · converse.js)
- [CVE-2018-7219](https://cve.now/CVE-2018-7219.md): application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a p (no CVSS)
- [CVE-2018-5378](https://cve.now/CVE-2018-5378.md): The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute le (CVSS 7.1, Quagga bgpd)
- [CVE-2018-5379](https://cve.now/CVE-2018-5379.md): The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing clust (CVSS 7.5, Quagga bgpd)
- [CVE-2018-5380](https://cve.now/CVE-2018-5380.md): The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer va (CVSS 4.3, Quagga bgpd)
- [CVE-2018-5381](https://cve.now/CVE-2018-5381.md): The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp\_packet.c:bgp (CVSS 6.5, Quagga bgpd)
- [CVE-2017-16924](https://cve.now/CVE-2017-16924.md): Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencry (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-02-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.