CVEs published February 22, 2018
48 CVEs were published on February 22, 2018: 1 critical, 2 high.
- Published
- 48
- Critical
- 1
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 45
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Cisco Data Center Analytics Framework
- 2
- Cisco Elastic Services Controller
- 2
- Cisco Jabber Client Framework
- 2
- Cisco Prime Collaboration Provisioning Tool
- 2
- IBM Financial Transaction Manager
- 2
- IBM Maximo Asset Management
- 2
- Cisco Prime Service Catalog
- 1
- Cisco UCS Director and Cisco Integrated Management Controll…
- 1
- Cisco Unified Communications Domain Manager
- 1
- Cisco Unified Communications Manager
- 1
Critical 1
High 2
Medium, low and unrated 45
- CVE-2018-6489XML External Entity (XXE) vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32.
- CVE-2018-1391IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user to execute a specialIBM Financial Transaction Manager
- CVE-2018-1392IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user to execute a specialIBM Financial Transaction Manager
- CVE-2018-1414IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to SQL injection.IBM Maximo Asset Management
- CVE-2018-1415IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2018-6890Cross-site scripting (XSS) vulnerability in Wolf CMS 0.8.3.1 via the page editing feature, as demonstrated by /?/admin/page/edit/3.
- CVE-2018-7296Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to
- CVE-2018-7297Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to obtain read/writ
- CVE-2018-7298In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTT
- CVE-2018-7299Remote Code Execution in the addon installation process in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows authenticated attackers to creat
- CVE-2018-7300Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earli
- CVE-2018-7301eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication.
- CVE-2018-7312SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.
- CVE-2018-7314SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerability than CVE-2008-64
- CVE-2018-7315SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, caste, or country parame
- CVE-2018-7316Arbitrary File Upload exists in the Proclaim 9.1.1 component for Joomla! via a mediafileform action.
- CVE-2018-7317Backup Download exists in the Proclaim 9.1.1 component for Joomla! via a direct request for a .sql file under backup/.
- CVE-2018-7318SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, description_search, or filt
- CVE-2018-7319SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling_system1, heating_system1, or laundry parame
- CVE-2018-7408An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgnpm
- CVE-2018-7409In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.
- CVE-2017-18194SQL injection vulnerability in users/signup.php in the "signup" component in HamayeshNegar CMS allows a remote attacker to execute arbitrary
- CVE-2017-5249In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not Wink Labs Wink - Smart Home
- CVE-2017-5250In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored Insteon for Hub
- CVE-2017-5251In version 1012 and prior of Insteon's Insteon Hub, the radio transmissions used for communication between the hub and connected devices areInsteon Hub Firmware
- CVE-2017-18193fs/f2fs/extent_cache.c in the Linux kernel before 4.13 mishandles extent trees, which allows local users to cause a denial of service (BUG)
- CVE-2018-7313SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.
- CVE-2018-0121A vulnerability in the authentication functionality of the web-based service portal of Cisco Elastic Services Controller Software could alloCisco Elastic Services Controller
- CVE-2018-0124A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protectionCisco Unified Communications Domain Manager
- CVE-2018-0130A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an uCisco Elastic Services Controller
- CVE-2018-0139A vulnerability in the Interactive Voice Response (IVR) management connection interface for Cisco Unified Customer Voice Portal (CVP) could Cisco Unified Customer Voice Portal
- CVE-2018-0145A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticateCisco Data Center Analytics Framework
- CVE-2018-0146A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross-Cisco Data Center Analytics Framework
- CVE-2018-0148A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Controller (IMC) SupervCisco UCS Director and Cisco Integrated Management Controll…
- CVE-2018-0199A vulnerability in Cisco Jabber Client Framework (JCF) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSCisco Jabber Client Framework
- CVE-2018-0200A vulnerability in the web-based interface of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a refleCisco Prime Service Catalog
- CVE-2018-0201A vulnerability in Cisco Jabber Client Framework (JCF) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS)Cisco Jabber Client Framework
- CVE-2018-0203A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send unsolicited email messagCisco Unity Connection
- CVE-2018-0204A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to creaCisco Prime Collaboration Provisioning Tool
- CVE-2018-0205A vulnerability in the User Provisioning tab in the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacCisco Prime Collaboration Provisioning Tool
- CVE-2018-0206A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attackeCisco Unified Communications Manager
- CVE-2018-7284A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk thr
- CVE-2018-7285A NULL pointer access issue was discovered in Asterisk 15.x through 15.2.1.
- CVE-2018-7286An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert
- CVE-2018-7287An issue was discovered in res_http_websocket.c in Asterisk 15.x through 15.2.1.