# CVEs published 2018-02-28

28 CVEs were published on February 28, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2015-4117](https://cve.now/CVE-2015-4117.md): Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup p (no CVSS)
- [CVE-2015-5079](https://cve.now/CVE-2015-5079.md): Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2018-6947](https://cve.now/CVE-2018-6947.md): An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoMachine 6.0.66\_2 and (no CVSS)
- [CVE-2015-3898](https://cve.now/CVE-2015-3898.md): Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and (no CVSS)
- [CVE-2018-7568](https://cve.now/CVE-2018-7568.md): The parse\_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows rem (no CVSS)
- [CVE-2018-7569](https://cve.now/CVE-2018-7569.md): dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a d (no CVSS)
- [CVE-2018-7570](https://cve.now/CVE-2018-7570.md): The assign\_file\_positions\_for\_non\_load\_sections function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed i (no CVSS)
- [CVE-2018-1304](https://cve.now/CVE-2018-1304.md): The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4 (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2018-1286](https://cve.now/CVE-2018-1286.md): In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to d (no CVSS, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2016-0291](https://cve.now/CVE-2016-0291.md): IBM BigFix Platform 9.0, 9.1 before 9.1.8, and 9.2 before 9.2.8 allow remote authenticated users to execute arbitrary commands by leveraging (no CVSS)
- [CVE-2016-0295](https://cve.now/CVE-2016-0295.md): Cross-site request forgery (CSRF) vulnerability in the IBM BigFix Platform 9.0, 9.1, 9.2, and 9.5 before 9.5.2 allows remote attackers to hi (no CVSS)
- [CVE-2016-0299](https://cve.now/CVE-2016-0299.md): IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote attackers to obtain sensitive (no CVSS)
- [CVE-2018-7264](https://cve.now/CVE-2018-7264.md): The Pictview image processing library embedded in the ActivePDF toolkit through 2018.1.0.18321 is prone to multiple out of bounds write and (no CVSS)
- [CVE-2017-9447](https://cve.now/CVE-2017-9447.md): In the web interface of Parallels Remote Application Server (RAS) 15.5 Build 16140, a vulnerability exists due to improper validation of the (no CVSS)
- [CVE-2018-7469](https://cve.now/CVE-2018-7469.md): PHP Scripts Mall Entrepreneur Job Portal Script 2.0.9 has XSS via the p\_name (aka Edit Category Name) field to admin/categories\_industry.php (no CVSS)
- [CVE-2017-12191](https://cve.now/CVE-2017-12191.md): A flaw was found in the CloudForms account configuration when using VMware. (no CVSS, Red Hat CloudForms)
- [CVE-2018-7477](https://cve.now/CVE-2018-7477.md): SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parent\_module/parent (no CVSS)
- [CVE-2018-7482](https://cve.now/CVE-2018-7482.md): The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, (no CVSS)
- [CVE-2018-7556](https://cve.now/CVE-2018-7556.md): LimeSurvey 2.6.x before 2.6.7, 2.7x.x before 2.73.1, and 3.x before 3.4.2 mishandles application/controller/InstallerController.php after in (no CVSS)
- [CVE-2018-7557](https://cve.now/CVE-2018-7557.md): The decode\_init function in libavcodec/utvideodec.c in FFmpeg 2.8 through 3.4.2 allows remote attackers to cause a denial of service (Out of (no CVSS)
- [CVE-2018-7551](https://cve.now/CVE-2018-7551.md): There is an invalid free in MiniPS::delete0 in minips.cpp that leads to a Segmentation fault in sam2p 0.49.4. (no CVSS)
- [CVE-2018-7552](https://cve.now/CVE-2018-7552.md): There is an invalid free in Mapping::DoubleHash::clear in mapping.cpp that leads to a Segmentation fault in sam2p 0.49.4. (no CVSS)
- [CVE-2018-7553](https://cve.now/CVE-2018-7553.md): There is a heap-based buffer overflow in the pcxLoadRaster function of in\_pcx.cpp in sam2p 0.49.4. (no CVSS)
- [CVE-2018-7554](https://cve.now/CVE-2018-7554.md): There is an invalid free in ReadImage in input-bmp.ci that leads to a Segmentation fault in sam2p 0.49.4. (no CVSS)
- [CVE-2018-6638](https://cve.now/CVE-2018-6638.md): A stack-based buffer overflow (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. (no CVSS)
- [CVE-2018-6639](https://cve.now/CVE-2018-6639.md): An out-of-bounds write (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. (no CVSS)
- [CVE-2018-6640](https://cve.now/CVE-2018-6640.md): A Heap Overflow (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. (no CVSS)
- [CVE-2018-6641](https://cve.now/CVE-2018-6641.md): An Arbitrary Free (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-02-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.