CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In February 2018

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1151 CVE-2017-5780 20 2018-02-15 2018-03-05
4.3
None Remote Medium Not required Partial None None
A remote clickjacking vulnerability in HPE Matrix Operating Environment version v7.6 was found.
1152 CVE-2017-5727 476 2018-02-02 2018-02-16
7.2
None Local Low Not required Complete Complete Complete
Pointer dereference in subsystem in Intel Graphics Driver 15.40.x.x, 15.45.x.x, 15.46.x.x allows unprivileged user to elevate privileges via local access.
1153 CVE-2017-5660 20 2018-02-27 2018-03-21
5.0
None Remote Low Not required None Partial None
There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.
1154 CVE-2017-5251 311 2018-02-22 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
In version 1012 and prior of Insteon's Insteon Hub, the radio transmissions used for communication between the hub and connected devices are not encrypted.
1155 CVE-2017-5250 312 2018-02-22 2019-10-09
5.0
None Remote Low Not required Partial None None
In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner.
1156 CVE-2017-5249 312 2018-02-22 2019-10-09
5.0
None Remote Low Not required Partial None None
In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner.
1157 CVE-2017-5133 787 Exec Code +Info 2018-02-07 2018-12-11
6.8
None Remote Medium Not required Partial Partial Partial
Off-by-one read/write on the heap in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to corrupt memory and possibly leak information and potentially execute code via a crafted PDF file.
1158 CVE-2017-5132 119 Overflow 2018-02-07 2018-02-23
6.8
None Remote Medium Not required Partial Partial Partial
Inappropriate implementation in V8 in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka incorrect WebAssembly stack manipulation.
1159 CVE-2017-5131 190 Overflow 2018-02-07 2018-02-22
6.8
None Remote Medium Not required Partial Partial Partial
An integer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka an out-of-bounds write.
1160 CVE-2017-5130 787 Overflow Mem. Corr. 2018-02-07 2019-07-19
6.8
None Remote Medium Not required Partial Partial Partial
An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.
1161 CVE-2017-5129 416 2018-02-07 2018-02-22
6.8
None Remote Medium Not required Partial Partial Partial
A use after free in WebAudio in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
1162 CVE-2017-5128 119 Overflow 2018-02-07 2018-02-23
6.8
None Remote Medium Not required Partial Partial Partial
Heap buffer overflow in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, related to WebGL.
1163 CVE-2017-5127 416 2018-02-07 2018-02-23
6.8
None Remote Medium Not required Partial Partial Partial
Use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
1164 CVE-2017-5126 416 2018-02-07 2018-02-22
6.8
None Remote Medium Not required Partial Partial Partial
A use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
1165 CVE-2017-5125 119 Overflow 2018-02-07 2018-02-23
6.8
None Remote Medium Not required Partial Partial Partial
Heap buffer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
1166 CVE-2017-5124 79 XSS 2018-02-07 2018-02-23
4.3
None Remote Medium Not required None Partial None
Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted MHTML page.
1167 CVE-2017-3160 2018-02-01 2020-04-15
5.8
None Remote Medium Not required Partial Partial None
After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched. Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android. If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVA_ANDROID_GRADLE_DISTRIBUTION_URL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip
1168 CVE-2017-2297 287 2018-02-01 2019-10-03
6.0
None Remote Medium ??? Partial Partial Partial
Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. This issue has been fixed in Puppet Enterprise 2016.4.5 and 2017.2.1. This only affects users with labeled tokens, which is not the default for tokens.
1169 CVE-2017-2296 20 2018-02-01 2018-02-24
4.0
None Remote Low ??? None None Partial
In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role display names causes errors, effectively causing a DOS to the service. This was resolved in Puppet Enterprise 2017.2.2.
1170 CVE-2017-2293 2018-02-01 2019-10-03
5.5
None Remote Low ??? None Partial Partial
Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove arbitrary packages on all managed agents. This release adds default configuration to not allow these actions. Customers who rely on this functionality can change this policy.
1171 CVE-2017-1785 200 +Info 2018-02-07 2018-02-26
4.0
None Remote Low ??? Partial None None
IBM API Connect 5.0.7 and 5.0.8 could allow an authenticated remote user to modify query parameters to obtain sensitive information. IBM X-Force ID: 136859.
1172 CVE-2017-1774 200 +Info 2018-02-26 2018-03-17
5.0
None Remote Low Not required Partial None None
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 136818.
1173 CVE-2017-1761 79 XSS 2018-02-09 2018-02-26
4.3
None Remote Medium Not required None Partial None
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 136005.
1174 CVE-2017-1758 611 2018-02-21 2018-03-12
5.5
None Remote Low ??? Partial None Partial
IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0.2, 3.0.3, 3.0.4, and 3.1.0, IBM Transformation Extender Advanced 9.0) is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 135859.
1175 CVE-2017-1720 77 Exec Code 2018-02-13 2018-03-01
4.6
None Local Low Not required Partial Partial Partial
IBM Notes 8.5 and 9.0 could allow a local attacker to execute arbitrary commands by carefully crafting a command line sent via the shared memory IPC. IBM X-Force ID: 134807.
1176 CVE-2017-1714 +Priv 2018-02-13 2019-10-03
7.2
None Local Low Not required Complete Complete Complete
IBM Notes and Domino NSD 8.5 and 9.0 could allow an authenticated local user without administrative privileges to gain System privilege. IBM X-Force ID: 134633.
1177 CVE-2017-1711 426 2018-02-13 2018-03-13
6.8
None Remote Medium Not required Partial Partial Partial
IBM iNotes 8.5 and 9.0 SUService can be misguided into running malicious code from a DLL masquerading as a windows DLL in the temp directory. IBM X-Force ID: 134532.
1178 CVE-2017-1692 2018-02-07 2018-02-26
7.2
None Local Low Not required Complete Complete Complete
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. IBM X-Force ID: 134067.
1179 CVE-2017-1682 79 XSS 2018-02-14 2018-03-12
3.5
None Remote Medium ??? None Partial None
IBM Connections 4.0, 4.5, 5.0, 5.5, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134004.
1180 CVE-2017-1604 79 XSS 2018-02-21 2018-03-09
3.5
None Remote Medium ??? None Partial None
IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132851.
1181 CVE-2017-1499 434 Exec Code 2018-02-14 2018-03-09
6.5
None Remote Low ??? Partial Partial Partial
IBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to include arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable Web server. IBM X-Force ID: 129106.
1182 CVE-2017-1462 79 XSS 2018-02-21 2018-03-12
3.5
None Remote Medium ??? None Partial None
IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128461.
1183 CVE-2017-0911 287 2018-02-09 2019-10-09
5.5
None Remote Low ??? Partial Partial None
Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide alternate credentials. In the final step of "Login with Twitter" authentication information is passed back to the application using the registered custom URL scheme (typically twitterkit-<consumer-key>) on iOS. Because the callback handler did not verify the authenticity of the response, this step is vulnerable to forgery, potentially allowing attacker to associate a Twitter account with a third-party service.
1184 CVE-2016-10714 189 2018-02-27 2019-06-11
7.5
None Remote Low Not required Partial Partial Partial
In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.
1185 CVE-2016-10713 119 Overflow 2018-02-13 2018-04-18
4.3
None Remote Medium Not required None None Partial
An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.
1186 CVE-2016-10712 20 2018-02-09 2019-05-22
5.0
None Remote Low Not required None Partial None
In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can be controlled if the input can be controlled (e.g., during file uploads). For example, a "$uri = stream_get_meta_data(fopen($file, "r"))['uri']" call mishandles the case where $file is data:text/plain;uri=eviluri, -- in other words, metadata can be set by an attacker.
1187 CVE-2016-10008 89 Exec Code Sql 2018-02-19 2018-03-05
6.5
None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_STRUCTURE_direction parameter.
1188 CVE-2016-10007 89 Exec Code Sql 2018-02-19 2018-03-05
6.5
None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_FORM_HANDLER_orderBy parameter.
1189 CVE-2016-9570 125 DoS 2018-02-12 2018-03-07
5.0
None Remote Low Not required None None Partial
cb.exe in Carbon Black 5.1.1.60603 allows attackers to cause a denial of service (out-of-bounds read, invalid pointer dereference, and application crash) by leveraging access to the NetMon named pipe.
1190 CVE-2016-9569 125 DoS 2018-02-12 2018-03-07
4.9
None Local Low Not required None None Complete
The cbstream.sys driver in Carbon Black 5.1.1.60603 allows local users with admin privileges to cause a denial of service (out-of-bounds read and system crash) via a large counter value in an 0x62430028 IOCTL call.
1191 CVE-2016-9568 254 2018-02-19 2018-03-21
10.0
None Remote Low Not required Complete Complete Complete
A security design issue can allow an unprivileged user to interact with the Carbon Black Sensor and perform unauthorized actions.
1192 CVE-2016-8750 90 DoS 2018-02-19 2019-04-26
4.0
None Remote Low ??? None None Partial
Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.
1193 CVE-2016-8742 264 2018-02-12 2018-03-14
7.2
None Local Low Not required Complete Complete Complete
The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in the install inherit the file permissions of the parent directory and therefore a non-privileged user can substitute any executable for the nssm.exe service launcher, or CouchDB batch or binary files. A subsequent service or server restart will then run that binary with administrator privilege. This issue affected CouchDB 2.0.0 (Windows platform only) and was addressed in CouchDB 2.0.0.1.
1194 CVE-2016-8535 20 2018-02-15 2018-03-02
3.5
None Remote Medium ??? None Partial None
A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found.
1195 CVE-2016-8534 264 2018-02-15 2018-03-02
6.5
None Remote Low ??? Partial Partial Partial
A remote privilege elevation vulnerability in HPE Matrix Operating Environment version 7.6 was found.
1196 CVE-2016-8533 264 2018-02-15 2018-03-02
6.5
None Remote Low ??? Partial Partial Partial
A remote priviledge escalation vulnerability in HPE Matrix Operating Environment version 7.6 was found.
1197 CVE-2016-8532 79 XSS 2018-02-15 2018-03-01
3.5
None Remote Medium ??? None Partial None
A cross site scripting vulnerability in HPE Matrix Operating Environment version 7.6 was found.
1198 CVE-2016-8531 200 +Info 2018-02-15 2018-03-02
5.0
None Remote Low Not required Partial None None
A remote information disclosure vulnerability in HPE Matrix Operating Environment version 7.6 was found.
1199 CVE-2016-8530 20 DoS 2018-02-15 2018-03-12
5.0
None Remote Low Not required None None Partial
A remote denial of service vulnerability in HPE iMC PLAT version v7.2 E0403P06 and earlier was found. The problem was resolved in iMC PLAT 7.3 E0504 or subsequent version.
1200 CVE-2016-8529 284 Exec Code 2018-02-15 2018-03-12
7.3
None Local Network Low Not required Partial Partial Complete
A Remote Arbitrary Command Execution vulnerability in HPE StoreVirtual 4000 Storage and StoreVirtual VSA Software running LeftHand OS version v12.5 and earlier was found. The problem was resolved in LeftHand OS v12.6 or any subsequent version.
Total number of vulnerabilities : 1328   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 (This Page)25 26 27
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.