# CVEs published 2018-02-21

44 CVEs were published on February 21, 2018: 0 critical, 1 high. Days are UTC.

- [CVE-2018-6936](https://cve.now/CVE-2018-6936.md): Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account. (no CVSS)
- [CVE-2018-7281](https://cve.now/CVE-2018-7281.md): CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme. (no CVSS)
- [CVE-2018-7311](https://cve.now/CVE-2018-7311.md): PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. (CVSS 8.8)
- [CVE-2017-1462](https://cve.now/CVE-2017-1462.md): IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Rhapsody Design Manager)
- [CVE-2017-1604](https://cve.now/CVE-2017-1604.md): IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting. (no CVSS, IBM Maximo Anywhere)
- [CVE-2017-1758](https://cve.now/CVE-2017-1758.md): IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0 (no CVSS, IBM Control Center · IBM Financial Transaction Manager +1)
- [CVE-2018-7308](https://cve.now/CVE-2018-7308.md): A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote users to add/delete/modif (no CVSS)
- [CVE-2018-7302](https://cve.now/CVE-2018-7302.md): Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS. (no CVSS, tikiwiki/tiki-manager)
- [CVE-2018-7303](https://cve.now/CVE-2018-7303.md): The Calendar component in Tiki 17.1 allows HTML injection. (no CVSS)
- [CVE-2018-7304](https://cve.now/CVE-2018-7304.md): Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window (no CVSS)
- [CVE-2018-7305](https://cve.now/CVE-2018-7305.md): MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts. (no CVSS)
- [CVE-2017-12161](https://cve.now/CVE-2017-12161.md): It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset reque (no CVSS, Red Hat Keycloak · org.keycloak:keycloak-core)
- [CVE-2018-7289](https://cve.now/CVE-2018-7289.md): An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. (no CVSS)
- [CVE-2013-4891](https://cve.now/CVE-2013-4891.md): The xss\_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross (no CVSS)
- [CVE-2015-5314](https://cve.now/CVE-2015-5314.md): The eap\_pwd\_process function in eap\_server/eap\_server\_pwd.c in hostapd 2.x before 2.6 does not validate that the reassembly buffer is large (no CVSS)
- [CVE-2015-5315](https://cve.now/CVE-2015-5315.md): The eap\_pwd\_process function in eap\_peer/eap\_pwd.c in wpa\_supplicant 2.x before 2.6 does not validate that the reassembly buffer is large en (no CVSS)
- [CVE-2015-5316](https://cve.now/CVE-2015-5316.md): The eap\_pwd\_perform\_confirm\_exchange function in eap\_peer/eap\_pwd.c in wpa\_supplicant 2.x before 2.6, when EAP-pwd is enabled in a network c (no CVSS)
- [CVE-2015-5725](https://cve.now/CVE-2015-5725.md): SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute a (no CVSS)
- [CVE-2016-0343](https://cve.now/CVE-2016-0343.md): IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to obtain (no CVSS)
- [CVE-2016-0344](https://cve.now/CVE-2016-0344.md): Cross-site scripting (XSS) vulnerability in the My Reports component in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4. (no CVSS)
- [CVE-2016-0345](https://cve.now/CVE-2016-0345.md): IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to obtain (no CVSS)
- [CVE-2016-0348](https://cve.now/CVE-2016-0348.md): Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3, 3.3.1, 3.3.2, and 3.4 allows remote attackers to hi (no CVSS)
- [CVE-2016-0351](https://cve.now/CVE-2016-0351.md): IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 does not set the secure flag for the session cookie in a (no CVSS)
- [CVE-2016-0366](https://cve.now/CVE-2016-0366.md): IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 might allow remote attackers to obtain sensitive informa (no CVSS)
- [CVE-2016-0367](https://cve.now/CVE-2016-0367.md): IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 allows remote authenticated users to obtain sensitive in (no CVSS)
- [CVE-2016-0369](https://cve.now/CVE-2016-0369.md): XML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6 allows remote authenticated users to obtain sens (no CVSS)
- [CVE-2018-7261](https://cve.now/CVE-2018-7261.md): There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4. (no CVSS, radiant)
- [CVE-2018-7280](https://cve.now/CVE-2018-7280.md): The Ninja Forms plugin before 3.2.14 for WordPress has XSS. (no CVSS)
- [CVE-2013-0267](https://cve.now/CVE-2013-0267.md): The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 allow remote authentic (no CVSS)
- [CVE-2015-0203](https://cve.now/CVE-2015-0203.md): The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via an AMQP m (no CVSS)
- [CVE-2015-6569](https://cve.now/CVE-2015-6569.md): Race condition in the LoadBalancer module in the Atlassian Floodlight Controller before 1.2 allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2018-5716](https://cve.now/CVE-2018-5716.md): An issue was discovered in Reprise License Manager 11.0. (no CVSS)
- [CVE-2018-7260](https://cve.now/CVE-2018-7260.md): Cross-site scripting (XSS) vulnerability in db\_central\_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject ar (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2018-1164](https://cve.now/CVE-2018-1164.md): This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router (no CVSS, ZyXEL P-870H-51 DSL Router)
- [CVE-2018-1165](https://cve.now/CVE-2018-1165.md): This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064 (no CVSS, Joyent SmartOS)
- [CVE-2018-1166](https://cve.now/CVE-2018-1166.md): This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064 (no CVSS, Joyent SmartOS)
- [CVE-2018-1168](https://cve.now/CVE-2018-1168.md): This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with FP 1-2-3. (no CVSS, ABB MicroSCADA)
- [CVE-2018-7276](https://cve.now/CVE-2018-7276.md): An issue was discovered on Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) devices. (no CVSS)
- [CVE-2018-7277](https://cve.now/CVE-2018-7277.md): An issue was discovered on RLE Wi-MGR/FDS-Wi 6.2 devices. (no CVSS)
- [CVE-2018-7278](https://cve.now/CVE-2018-7278.md): An issue was discovered on RLE Protocol Converter FDS-PC / FDS-PC-DP 2.1 devices. (no CVSS)
- [CVE-2018-7271](https://cve.now/CVE-2018-7271.md): An issue was discovered in MetInfo 6.0.0. (no CVSS)
- [CVE-2018-7272](https://cve.now/CVE-2018-7272.md): The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information b (no CVSS)
- [CVE-2018-7273](https://cve.now/CVE-2018-7273.md): In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls with (no CVSS)
- [CVE-2018-7274](https://cve.now/CVE-2018-7274.md): Yab Quarx through 2.4.3 is prone to multiple persistent cross-site scripting vulnerabilities: Blog (Title), FAQ (Question), Pages (Title), W (no CVSS, yab/quarx)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-02-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.