# CVEs published 2018-02-20

28 CVEs were published on February 20, 2018: 1 critical, 0 high. Days are UTC.

- [CVE-2017-12415](https://cve.now/CVE-2017-12415.md): OXID eShop Community Edition before 6.0.0 RC2 (development), 4.10.x before 4.10.5 (maintenance), and 4.9.x before 4.9.10 (legacy), Enterpris (no CVSS)
- [CVE-2017-14993](https://cve.now/CVE-2017-14993.md): OXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before 4.10.6 (maintenance), and 4.9.x before 4.9.11 (legacy), Enterpris (no CVSS)
- [CVE-2017-17454](https://cve.now/CVE-2017-17454.md): Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user en (no CVSS)
- [CVE-2017-17455](https://cve.now/CVE-2017-17455.md): Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before 17.10.2 are vulnerable to being forced, via a man-in-the-middle attack, (no CVSS)
- [CVE-2018-7265](https://cve.now/CVE-2018-7265.md): Shimmie 2 2.6.0 allows an attacker to upload a crafted SVG file that enables stored XSS. (no CVSS)
- [CVE-2004-2779](https://cve.now/CVE-2004-2779.md): id3\_utf16\_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggeri (no CVSS)
- [CVE-2018-6487](https://cve.now/CVE-2018-6487.md): MFSBGN03799 rev.1 - Micro Focus UCMDB, Remote Disclosure of Information (CVSS 9.8, Micro Focus Universal CMDB Foundation Software)
- [CVE-2018-7263](https://cve.now/CVE-2018-7263.md): The mad\_decoder\_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRT (no CVSS)
- [CVE-2015-6544](https://cve.now/CVE-2015-6544.md): Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allows remote attackers to (no CVSS)
- [CVE-2017-10963](https://cve.now/CVE-2017-10963.md): In Knox SDS IAM (Identity Access Management) and EMM (Enterprise Mobility Management) 16.11 on Samsung mobile devices, a man-in-the-middle a (no CVSS)
- [CVE-2018-5477](https://cve.now/CVE-2018-5477.md): An Information Exposure issue was discovered in ABB netCADOPS Web Application Version 3.4 and prior, netCADOPS Web Application Version 7.1 a (no CVSS, ABB netCADOPS Web Application)
- [CVE-2017-6192](https://cve.now/CVE-2017-6192.md): Buffer overflow in APNGDis 2.8 and earlier allows a remote attackers to cause denial of service and possibly execute arbitrary code via a cr (no CVSS)
- [CVE-2017-6193](https://cve.now/CVE-2017-6193.md): Buffer overflow in APNGDis 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a cr (no CVSS)
- [CVE-2016-6272](https://cve.now/CVE-2016-6272.md): XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display string (no CVSS)
- [CVE-2017-16356](https://cve.now/CVE-2017-16356.md): Reflected XSS in Kubik-Rubik SIGE (aka Simple Image Gallery Extended) before 3.3.0 allows attackers to execute JavaScript in a victim's brow (no CVSS)
- [CVE-2018-6356](https://cve.now/CVE-2018-6356.md): Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2018-6459](https://cve.now/CVE-2018-6459.md): The rsa\_pss\_params\_parse function in libstrongswan/credentials/keys/signature\_params.c in strongSwan 5.6.1 allows remote attackers to cause (no CVSS)
- [CVE-2018-6940](https://cve.now/CVE-2018-6940.md): A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in c (no CVSS)
- [CVE-2018-6941](https://cve.now/CVE-2018-6941.md): A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in (no CVSS)
- [CVE-2018-7046](https://cve.now/CVE-2018-7046.md): Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system comma (no CVSS)
- [CVE-2018-7205](https://cve.now/CVE-2018-7205.md): Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute (no CVSS)
- [CVE-2015-2081](https://cve.now/CVE-2015-2081.md): Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts. (no CVSS)
- [CVE-2015-9254](https://cve.now/CVE-2015-9254.md): Datto ALTO and SIRIS devices have a default VNC password. (no CVSS)
- [CVE-2015-9255](https://cve.now/CVE-2015-9255.md): Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtua (no CVSS)
- [CVE-2015-9256](https://cve.now/CVE-2015-9256.md): Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because th (no CVSS)
- [CVE-2017-16835](https://cve.now/CVE-2017-16835.md): The "Photo,Video Locker-Calculator" application 12.0 for Android has android:allowBackup="true" in AndroidManifest.xml, which allows attacke (no CVSS)
- [CVE-2017-18192](https://cve.now/CVE-2017-18192.md): smart/calculator/gallerylock/CalculatorActivity.java in the "Photo,Video Locker-Calculator" application through 18 for Android allows attack (no CVSS)
- [CVE-2018-7259](https://cve.now/CVE-2018-7259.md): The FSX / P3Dv4 installer 2.0.1.231 for Flight Sim Labs A320-X sends a user's Google account credentials to http://installLog.flightsimlabs. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-02-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.