CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In February 2018

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
901 CVE-2017-14884 119 Overflow 2018-02-23 2018-03-16
7.2
None Local Low Not required Complete Complete Complete
In all Qualcomm products with Android releases from CAF using the Linux kernel, due to lack of bounds checking on the variable "data_len" from the function WLANQCMBR_McProcessMsg, a buffer overflow may potentially occur in WLANFTM_McProcessMsg.
902 CVE-2017-14537 22 Dir. Trav. 2018-02-16 2021-07-30
4.0
None Remote Low ??? Partial None None
trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.
903 CVE-2017-14536 79 XSS 2018-02-16 2018-03-06
3.5
None Remote Medium ??? None Partial None
trixbox 2.8.0.4 has XSS via the PATH_INFO to /maint/index.php or /user/includes/language/langChooser.php.
904 CVE-2017-14535 78 2018-02-16 2021-07-30
9.0
None Remote Low ??? Complete Complete Complete
trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php.
905 CVE-2017-14180 400 DoS +Priv 2018-02-02 2018-02-15
7.2
None Local Low Not required Complete Complete Complete
Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges, a different vulnerability than CVE-2017-14179.
906 CVE-2017-14179 400 DoS +Priv 2018-02-02 2018-02-15
7.2
None Local Low Not required Complete Complete Complete
Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers.
907 CVE-2017-14178 755 Bypass 2018-02-02 2019-10-03
5.0
None Remote Low Not required Partial None None
In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileged, unauthenticated users to bypass systemd-journald's access restrictions.
908 CVE-2017-14177 400 DoS +Priv 2018-02-02 2018-02-15
7.2
None Local Low Not required Complete Complete Complete
Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1324.
909 CVE-2017-13273 2018-02-15 2019-10-03
6.9
None Local Medium Not required Complete Complete Complete
In xt_qtaguid.c, there is a race condition due to insufficient locking. This could lead to local elevation of privileges with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-65853158.
910 CVE-2017-13247 862 Bypass 2018-02-12 2019-10-03
4.6
None Local Low Not required Partial Partial Partial
In the Pixel 2 bootloader, there is a missing permission check which bypasses carrier bootloader lock. This could lead to local elevation of privileges with user execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-71486645.
911 CVE-2017-13246 200 +Info 2018-02-12 2018-03-01
5.0
None Remote Low Not required Partial None None
A information disclosure vulnerability in the Upstream kernel network driver. Product: Android. Versions: Android kernel. ID: A-36279469.
912 CVE-2017-13245 2018-02-12 2019-10-03
4.6
None Local Low Not required Partial Partial Partial
A elevation of privilege vulnerability in the Upstream kernel audio driver. Product: Android. Versions: Android kernel. ID: A-64315347.
913 CVE-2017-13244 2018-02-12 2019-10-03
4.6
None Local Low Not required Partial Partial Partial
A elevation of privilege vulnerability in the Upstream kernel easel. Product: Android. Versions: Android kernel. ID: A-62678986.
914 CVE-2017-13243 200 +Info 2018-02-12 2018-03-01
5.0
None Remote Low Not required Partial None None
A information disclosure vulnerability in the Android system (ui). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. ID: A-38258991.
915 CVE-2017-13242 200 +Info 2018-02-12 2018-03-07
5.0
None Remote Low Not required Partial None None
A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-62672248.
916 CVE-2017-13241 200 +Info 2018-02-12 2018-03-07
5.0
None Remote Low Not required Partial None None
A information disclosure vulnerability in the Android media framework (libstagefright_soft_avcenc). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-69065651.
917 CVE-2017-13240 200 +Info 2018-02-12 2018-03-07
5.0
None Remote Low Not required Partial None None
A information disclosure vulnerability in the Android framework (crypto framework). Product: Android. Versions: 8.0, 8.1. ID: A-68694819.
918 CVE-2017-13239 200 +Info 2018-02-12 2018-03-07
5.0
None Remote Low Not required Partial None None
A information disclosure vulnerability in the Android framework (ui framework). Product: Android. Versions: 8.0. ID: A-66244132.
919 CVE-2017-13238 200 +Info 2018-02-12 2018-03-13
4.7
None Local Medium Not required Complete None None
In XBLRamDump mode, there is a debug feature that can be used to dump memory contents, if an attacker has physical access to the device. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-64610940.
920 CVE-2017-13236 732 Bypass 2018-02-12 2019-10-03
4.6
None Local Low Not required Partial Partial Partial
In the KeyStore service, there is a permissions bypass that allows access to protected resources. This could lead to local escalation of privilege with system execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-68217699.
921 CVE-2017-13235 476 2018-02-12 2018-03-08
4.3
None Remote Medium Not required None None Partial
A other vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-68342866.
922 CVE-2017-13234 772 DoS 2018-02-12 2019-10-03
7.1
None Remote Medium Not required None None Complete
In DLSParser of the sonivox library, there is possible resource exhaustion due to a memory leak. This could lead to remote temporary denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68159767.
923 CVE-2017-13233 400 DoS 2018-02-12 2018-03-13
7.1
None Remote Medium Not required None None Complete
In ihevcd_ctb_boundary_strength_pbslice of libhevc, there is possible resource exhaustion. This could lead to a remote temporary denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-62851602.
924 CVE-2017-13232 200 +Info 2018-02-12 2018-03-07
7.8
None Remote Low Not required Complete None None
In audioserver, there is an out-of-bounds write due to a log statement using %s with an array that may not be NULL terminated. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68953950.
925 CVE-2017-13231 787 2018-02-12 2018-03-13
7.2
None Local Low Not required Complete Complete Complete
In libmediadrm, there is an out-of-bounds write due to improper input validation. This could lead to local elevation of privileges with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-67962232.
926 CVE-2017-13230 787 Exec Code 2018-02-12 2018-03-13
9.3
None Remote Medium Not required Complete Complete Complete
In hevc codec, there is an out-of-bounds write due to an incorrect bounds check with the i2_pic_width_in_luma_samples value. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65483665.
927 CVE-2017-13229 20 Exec Code 2018-02-12 2018-03-06
10.0
None Remote Low Not required Complete Complete Complete
A remote code execution vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-68160703.
928 CVE-2017-13228 787 Exec Code 2018-02-12 2018-03-13
9.3
None Remote Medium Not required Complete Complete Complete
In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an unsigned character. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-69478425.
929 CVE-2017-12726 798 2018-02-15 2018-03-02
7.5
None Remote Low Not required Partial Partial Partial
A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. Telnet on the pump uses hardcoded credentials, which can be used if the pump is configured to allow external communications. Smiths Medical assesses that it is not possible to upload files via Telnet and the impact of this vulnerability is limited to the communications module.
930 CVE-2017-12725 798 2018-02-15 2018-03-02
6.8
None Remote Medium Not required Partial Partial Partial
A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump with default network configuration uses hard-coded credentials to automatically establish a wireless network connection. The pump will establish a wireless network connection even if the pump is Ethernet connected and active; however, if the wireless association is established and the Ethernet cable is attached, the pump does not attach the network stack to the wireless network. In this scenario, all network traffic is instead directed over the wired Ethernet connection.
931 CVE-2017-12724 798 2018-02-15 2018-03-02
6.8
None Remote Medium Not required Partial Partial Partial
A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump contains hardcoded credentials, which are not fully initialized. The FTP server is only accessible if the pump is configured to allow FTP connections.
932 CVE-2017-12723 200 +Info 2018-02-15 2018-03-02
4.3
None Remote Medium Not required Partial None None
A Password in Configuration File issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump stores some passwords in the configuration file, which are accessible if the pump is configured to allow external communications.
933 CVE-2017-12722 125 2018-02-15 2018-03-02
5.0
None Remote Low Not required None None Partial
An Out-of-bounds Read issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A third-party component used in the pump reads memory out of bounds, causing the communications module to crash. Smiths Medical assesses that the crash of the communications module would not impact the operation of the therapeutic module.
934 CVE-2017-12721 295 2018-02-15 2018-03-02
4.3
None Remote Medium Not required Partial None None
An Improper Certificate Validation issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump does not validate host certificates, leaving the pump vulnerable to a man-in-the-middle (MITM) attack.
935 CVE-2017-12720 306 2018-02-15 2019-10-03
6.8
None Remote Medium Not required Partial Partial Partial
An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump does not require authentication if the pump is configured to allow FTP connections.
936 CVE-2017-12718 119 Exec Code Overflow 2018-02-15 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
A Classic Buffer Overflow issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A third-party component used in the pump does not verify input buffer size prior to copying, leading to a buffer overflow, allowing remote code execution on the target device. The pump receives the potentially malicious input infrequently and under certain conditions, increasing the difficulty of exploitation.
937 CVE-2017-12561 824 Exec Code 2018-02-15 2018-03-05
10.0
None Remote Low Not required Complete Complete Complete
A remote code execution vulnerability in HPE intelligent Management Center (iMC) PLAT version Plat 7.3 E0504P4 and earlier was found.
938 CVE-2017-12560 22 DoS Dir. Trav. 2018-02-15 2018-02-25
6.8
None Remote Low ??? None None Complete
A Remote Denial of Service vulnerability in HPE Intelligent Management Center (iMC) PLAT version iMC Plat 7.3 E0504P2 was found.
939 CVE-2017-12559 22 DoS Dir. Trav. 2018-02-15 2018-02-25
6.8
None Remote Low ??? None None Complete
A Remote Denial of Service vulnerability in HPE Intelligent Management Center (iMC) PLAT version iMC Plat 7.3 E0504P2 was found.
940 CVE-2017-12558 502 Exec Code 2018-02-15 2018-03-05
10.0
None Remote Low Not required Complete Complete Complete
A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and earlier was found.
941 CVE-2017-12557 502 Exec Code 2018-02-15 2019-03-08
10.0
None Remote Low Not required Complete Complete Complete
A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and earlier was found.
942 CVE-2017-12556 502 Exec Code 2018-02-15 2018-03-05
10.0
None Remote Low Not required Complete Complete Complete
A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and earlier was found.
943 CVE-2017-12555 200 +Info 2018-02-15 2018-03-13
6.8
None Remote Low ??? Complete None None
A remote arbitrary file download and disclosure of information vulnerability in HPE Intelligent Management Center (iMC) Service Operation Management (SOM) version IMC SOM 7.3 E0501 was found.
944 CVE-2017-12554 20 Exec Code 2018-02-15 2018-03-06
9.0
None Remote Low ??? Complete Complete Complete
A remote code execution vulnerability in HPE intelligent Management Center (iMC) PLAT iMC Plat 7.3 E0504P2 and earlier was found.
945 CVE-2017-12553 Bypass 2018-02-15 2019-10-03
5.5
None Local High ??? Complete Complete None
A local authentication bypass vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
946 CVE-2017-12552 Exec Code 2018-02-15 2019-10-03
5.5
None Local High ??? None Complete Complete
A local arbitrary execution of commands vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
947 CVE-2017-12551 Exec Code 2018-02-15 2019-10-03
5.5
None Local High ??? None Complete Complete
A local arbitrary execution of commands vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
948 CVE-2017-12550 2018-02-15 2019-10-03
5.5
None Local High ??? None Complete Complete
A local security misconfiguration vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
949 CVE-2017-12549 287 Bypass 2018-02-15 2018-03-02
5.5
None Local High ??? Complete Complete None
A local authentication bypass vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
950 CVE-2017-12548 Exec Code 2018-02-15 2019-10-03
5.5
None Local High ??? None Complete Complete
A local arbitrary command execution vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
Total number of vulnerabilities : 1328   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 (This Page)20 21 22 23 24 25 26 27
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.