CVEs published February 21, 2018
44 CVEs were published on February 21, 2018: 0 critical, 1 high.
- Published
- 44
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 43
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Joyent SmartOS
- 2
- ABB MicroSCADA
- 1
- IBM Control Center · IBM Financial Transaction Manager +1
- 1
- IBM Maximo Anywhere
- 1
- IBM Rational Rhapsody Design Manager
- 1
- phpmyadmin/phpmyadmin
- 1
- radiant
- 1
- Red Hat Keycloak · org.keycloak:keycloak-core
- 1
- tikiwiki/tiki-manager
- 1
- yab/quarx
- 1
High 1
Medium, low and unrated 43
- CVE-2018-6936Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account.
- CVE-2018-7281CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme.
- CVE-2017-1462IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting.IBM Rational Rhapsody Design Manager
- CVE-2017-1604IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting.IBM Maximo Anywhere
- CVE-2017-1758IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0IBM Control Center · IBM Financial Transaction Manager +1
- CVE-2018-7308A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote users to add/delete/modif
- CVE-2018-7302Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS.tikiwiki/tiki-manager
- CVE-2018-7303The Calendar component in Tiki 17.1 allows HTML injection.
- CVE-2018-7304Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window
- CVE-2018-7305MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts.
- CVE-2017-12161It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset requeRed Hat Keycloak · org.keycloak:keycloak-core
- CVE-2018-7289An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2.
- CVE-2013-4891The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross
- CVE-2015-5314The eap_pwd_process function in eap_server/eap_server_pwd.c in hostapd 2.x before 2.6 does not validate that the reassembly buffer is large
- CVE-2015-5315The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6 does not validate that the reassembly buffer is large en
- CVE-2015-5316The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6, when EAP-pwd is enabled in a network c
- CVE-2015-5725SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute a
- CVE-2016-0343IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to obtain
- CVE-2016-0344Cross-site scripting (XSS) vulnerability in the My Reports component in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.
- CVE-2016-0345IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to obtain
- CVE-2016-0348Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3, 3.3.1, 3.3.2, and 3.4 allows remote attackers to hi
- CVE-2016-0351IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 does not set the secure flag for the session cookie in a
- CVE-2016-0366IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 might allow remote attackers to obtain sensitive informa
- CVE-2016-0367IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 allows remote authenticated users to obtain sensitive in
- CVE-2016-0369XML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6 allows remote authenticated users to obtain sens
- CVE-2018-7261There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4.radiant
- CVE-2018-7280The Ninja Forms plugin before 3.2.14 for WordPress has XSS.
- CVE-2013-0267The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 allow remote authentic
- CVE-2015-0203The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via an AMQP m
- CVE-2015-6569Race condition in the LoadBalancer module in the Atlassian Floodlight Controller before 1.2 allows remote attackers to cause a denial of ser
- CVE-2018-5716An issue was discovered in Reprise License Manager 11.0.
- CVE-2018-7260Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arphpmyadmin/phpmyadmin
- CVE-2018-1164This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router ZyXEL P-870H-51 DSL Router
- CVE-2018-1165This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064Joyent SmartOS
- CVE-2018-1166This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064Joyent SmartOS
- CVE-2018-1168This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with FP 1-2-3.ABB MicroSCADA
- CVE-2018-7276An issue was discovered on Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) devices.
- CVE-2018-7277An issue was discovered on RLE Wi-MGR/FDS-Wi 6.2 devices.
- CVE-2018-7278An issue was discovered on RLE Protocol Converter FDS-PC / FDS-PC-DP 2.1 devices.
- CVE-2018-7271An issue was discovered in MetInfo 6.0.0.
- CVE-2018-7272The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information b
- CVE-2018-7273In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls with
- CVE-2018-7274Yab Quarx through 2.4.3 is prone to multiple persistent cross-site scripting vulnerabilities: Blog (Title), FAQ (Question), Pages (Title), Wyab/quarx