# CVEs published 2018-02-22

48 CVEs were published on February 22, 2018: 1 critical, 2 high. Days are UTC.

- [CVE-2018-0015](https://cve.now/CVE-2018-0015.md): AppFormix: Debug Shell Command Execution in AppFormix Agent (CVSS 9.8, Juniper Networks AppFormix)
- [CVE-2018-6488](https://cve.now/CVE-2018-6488.md): MFSBGN03798 rev.1 - Micro Focus Universal CMDB, Apache Struts Instance (CVSS 8.1, Micro Focus Universal CMDB)
- [CVE-2018-6489](https://cve.now/CVE-2018-6489.md): XML External Entity (XXE) vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. (no CVSS)
- [CVE-2018-1391](https://cve.now/CVE-2018-1391.md): IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user to execute a special (no CVSS, IBM Financial Transaction Manager)
- [CVE-2018-1392](https://cve.now/CVE-2018-1392.md): IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user to execute a special (no CVSS, IBM Financial Transaction Manager)
- [CVE-2018-1414](https://cve.now/CVE-2018-1414.md): IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to SQL injection. (no CVSS, IBM Maximo Asset Management)
- [CVE-2018-1415](https://cve.now/CVE-2018-1415.md): IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. (no CVSS, IBM Maximo Asset Management)
- [CVE-2018-1417](https://cve.now/CVE-2018-1417.md): Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code running under a secur (CVSS 8.1, IBM SDK, Java Technology Edition)
- [CVE-2018-6890](https://cve.now/CVE-2018-6890.md): Cross-site scripting (XSS) vulnerability in Wolf CMS 0.8.3.1 via the page editing feature, as demonstrated by /?/admin/page/edit/3. (no CVSS)
- [CVE-2018-7296](https://cve.now/CVE-2018-7296.md): Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to (no CVSS)
- [CVE-2018-7297](https://cve.now/CVE-2018-7297.md): Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to obtain read/writ (no CVSS)
- [CVE-2018-7298](https://cve.now/CVE-2018-7298.md): In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTT (no CVSS)
- [CVE-2018-7299](https://cve.now/CVE-2018-7299.md): Remote Code Execution in the addon installation process in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows authenticated attackers to creat (no CVSS)
- [CVE-2018-7300](https://cve.now/CVE-2018-7300.md): Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earli (no CVSS)
- [CVE-2018-7301](https://cve.now/CVE-2018-7301.md): eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. (no CVSS)
- [CVE-2018-7312](https://cve.now/CVE-2018-7312.md): SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter. (no CVSS)
- [CVE-2018-7314](https://cve.now/CVE-2018-7314.md): SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerability than CVE-2008-64 (no CVSS)
- [CVE-2018-7315](https://cve.now/CVE-2018-7315.md): SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, caste, or country parame (no CVSS)
- [CVE-2018-7316](https://cve.now/CVE-2018-7316.md): Arbitrary File Upload exists in the Proclaim 9.1.1 component for Joomla! via a mediafileform action. (no CVSS)
- [CVE-2018-7317](https://cve.now/CVE-2018-7317.md): Backup Download exists in the Proclaim 9.1.1 component for Joomla! via a direct request for a .sql file under backup/. (no CVSS)
- [CVE-2018-7318](https://cve.now/CVE-2018-7318.md): SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title\_search, tag\_search, name\_search, description\_search, or filt (no CVSS)
- [CVE-2018-7319](https://cve.now/CVE-2018-7319.md): SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling\_system1, heating\_system1, or laundry parame (no CVSS)
- [CVE-2018-7408](https://cve.now/CVE-2018-7408.md): An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upg (no CVSS, npm)
- [CVE-2018-7409](https://cve.now/CVE-2018-7409.md): In unixODBC before 2.3.5, there is a buffer overflow in the unicode\_to\_ansi\_copy() function in DriverManager/\_\_info.c. (no CVSS)
- [CVE-2017-18194](https://cve.now/CVE-2017-18194.md): SQL injection vulnerability in users/signup.php in the "signup" component in HamayeshNegar CMS allows a remote attacker to execute arbitrary (no CVSS)
- [CVE-2017-5249](https://cve.now/CVE-2017-5249.md): In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not (no CVSS, Wink Labs Wink - Smart Home)
- [CVE-2017-5250](https://cve.now/CVE-2017-5250.md): In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored (no CVSS, Insteon for Hub)
- [CVE-2017-5251](https://cve.now/CVE-2017-5251.md): In version 1012 and prior of Insteon's Insteon Hub, the radio transmissions used for communication between the hub and connected devices are (no CVSS, Insteon Hub Firmware)
- [CVE-2017-18193](https://cve.now/CVE-2017-18193.md): fs/f2fs/extent\_cache.c in the Linux kernel before 4.13 mishandles extent trees, which allows local users to cause a denial of service (BUG) (no CVSS)
- [CVE-2018-7313](https://cve.now/CVE-2018-7313.md): SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter. (no CVSS)
- [CVE-2018-0121](https://cve.now/CVE-2018-0121.md): A vulnerability in the authentication functionality of the web-based service portal of Cisco Elastic Services Controller Software could allo (no CVSS, Cisco Elastic Services Controller)
- [CVE-2018-0124](https://cve.now/CVE-2018-0124.md): A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protection (no CVSS, Cisco Unified Communications Domain Manager)
- [CVE-2018-0130](https://cve.now/CVE-2018-0130.md): A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an u (no CVSS, Cisco Elastic Services Controller)
- [CVE-2018-0139](https://cve.now/CVE-2018-0139.md): A vulnerability in the Interactive Voice Response (IVR) management connection interface for Cisco Unified Customer Voice Portal (CVP) could (no CVSS, Cisco Unified Customer Voice Portal)
- [CVE-2018-0145](https://cve.now/CVE-2018-0145.md): A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticate (no CVSS, Cisco Data Center Analytics Framework)
- [CVE-2018-0146](https://cve.now/CVE-2018-0146.md): A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross- (no CVSS, Cisco Data Center Analytics Framework)
- [CVE-2018-0148](https://cve.now/CVE-2018-0148.md): A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Controller (IMC) Superv (no CVSS, Cisco UCS Director and Cisco Integrated Management Controll…)
- [CVE-2018-0199](https://cve.now/CVE-2018-0199.md): A vulnerability in Cisco Jabber Client Framework (JCF) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XS (no CVSS, Cisco Jabber Client Framework)
- [CVE-2018-0200](https://cve.now/CVE-2018-0200.md): A vulnerability in the web-based interface of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a refle (no CVSS, Cisco Prime Service Catalog)
- [CVE-2018-0201](https://cve.now/CVE-2018-0201.md): A vulnerability in Cisco Jabber Client Framework (JCF) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) (no CVSS, Cisco Jabber Client Framework)
- [CVE-2018-0203](https://cve.now/CVE-2018-0203.md): A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send unsolicited email messag (no CVSS, Cisco Unity Connection)
- [CVE-2018-0204](https://cve.now/CVE-2018-0204.md): A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to crea (no CVSS, Cisco Prime Collaboration Provisioning Tool)
- [CVE-2018-0205](https://cve.now/CVE-2018-0205.md): A vulnerability in the User Provisioning tab in the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attac (no CVSS, Cisco Prime Collaboration Provisioning Tool)
- [CVE-2018-0206](https://cve.now/CVE-2018-0206.md): A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacke (no CVSS, Cisco Unified Communications Manager)
- [CVE-2018-7284](https://cve.now/CVE-2018-7284.md): A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk thr (no CVSS)
- [CVE-2018-7285](https://cve.now/CVE-2018-7285.md): A NULL pointer access issue was discovered in Asterisk 15.x through 15.2.1. (no CVSS)
- [CVE-2018-7286](https://cve.now/CVE-2018-7286.md): An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert (no CVSS)
- [CVE-2018-7287](https://cve.now/CVE-2018-7287.md): An issue was discovered in res\_http\_websocket.c in Asterisk 15.x through 15.2.1. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-02-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.