CVEs published February 20, 2018
28 CVEs were published on February 20, 2018: 1 critical, 0 high.
- Published
- 28
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- ABB netCADOPS Web Application
- 1
- Micro Focus Universal CMDB Foundation Software
- 1
- org.jenkins-ci.main:jenkins-core
- 1
Critical 1
Medium, low and unrated 27
- CVE-2017-12415OXID eShop Community Edition before 6.0.0 RC2 (development), 4.10.x before 4.10.5 (maintenance), and 4.9.x before 4.9.10 (legacy), Enterpris
- CVE-2017-14993OXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before 4.10.6 (maintenance), and 4.9.x before 4.9.11 (legacy), Enterpris
- CVE-2017-17454Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user en
- CVE-2017-17455Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before 17.10.2 are vulnerable to being forced, via a man-in-the-middle attack,
- CVE-2018-7265Shimmie 2 2.6.0 allows an attacker to upload a crafted SVG file that enables stored XSS.
- CVE-2004-2779id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggeri
- CVE-2018-7263The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRT
- CVE-2015-6544Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allows remote attackers to
- CVE-2017-10963In Knox SDS IAM (Identity Access Management) and EMM (Enterprise Mobility Management) 16.11 on Samsung mobile devices, a man-in-the-middle a
- CVE-2018-5477An Information Exposure issue was discovered in ABB netCADOPS Web Application Version 3.4 and prior, netCADOPS Web Application Version 7.1 aABB netCADOPS Web Application
- CVE-2017-6192Buffer overflow in APNGDis 2.8 and earlier allows a remote attackers to cause denial of service and possibly execute arbitrary code via a cr
- CVE-2017-6193Buffer overflow in APNGDis 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a cr
- CVE-2016-6272XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display string
- CVE-2017-16356Reflected XSS in Kubik-Rubik SIGE (aka Simple Image Gallery Extended) before 3.3.0 allows attackers to execute JavaScript in a victim's brow
- CVE-2018-6356Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs org.jenkins-ci.main:jenkins-core
- CVE-2018-6459The rsa_pss_params_parse function in libstrongswan/credentials/keys/signature_params.c in strongSwan 5.6.1 allows remote attackers to cause
- CVE-2018-6940A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in c
- CVE-2018-6941A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in
- CVE-2018-7046Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system comma
- CVE-2018-7205Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute
- CVE-2015-2081Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.
- CVE-2015-9254Datto ALTO and SIRIS devices have a default VNC password.
- CVE-2015-9255Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtua
- CVE-2015-9256Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because th
- CVE-2017-16835The "Photo,Video Locker-Calculator" application 12.0 for Android has android:allowBackup="true" in AndroidManifest.xml, which allows attacke
- CVE-2017-18192smart/calculator/gallerylock/CalculatorActivity.java in the "Photo,Video Locker-Calculator" application through 18 for Android allows attack
- CVE-2018-7259The FSX / P3Dv4 installer 2.0.1.231 for Flight Sim Labs A320-X sends a user's Google account credentials to http://installLog.flightsimlabs.