CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In February 2018

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1251 CVE-2015-6544 79 XSS 2018-02-20 2018-03-09
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allows remote attackers to inject arbitrary web script or HTML via a dashboard title.
1252 CVE-2015-5725 89 Exec Code Sql 2018-02-21 2018-03-14
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors involving the offset variable.
1253 CVE-2015-5674 20 DoS 2018-02-05 2018-03-14
4.0
None Remote Low ??? None None Partial
The routed daemon in FreeBSD 9.3 before 9.3-RELEASE-p22, 10.2-RC2 before 10.2-RC2-p1, 10.2-RC1 before 10.2-RC1-p2, 10.2 before 10.2-BETA2-p3, and 10.1 before 10.1-RELEASE-p17 allows remote authenticated users to cause a denial of service (assertion failure and daemon exit) via a query from a network that is not directly connected.
1254 CVE-2015-5316 476 DoS 2018-02-21 2018-03-21
4.3
None Remote Medium Not required None None Partial
The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6, when EAP-pwd is enabled in a network configuration profile, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an EAP-pwd Confirm message followed by the Identity exchange.
1255 CVE-2015-5315 119 DoS Overflow 2018-02-21 2018-03-21
4.3
None Remote Medium Not required None None Partial
The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when EAP-pwd is enabled in a network configuration profile, which allows remote attackers to cause a denial of service (process termination) via a large final fragment in an EAP-pwd message.
1256 CVE-2015-5314 119 DoS Overflow 2018-02-21 2018-03-21
4.3
None Remote Medium Not required None None Partial
The eap_pwd_process function in eap_server/eap_server_pwd.c in hostapd 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when used with (1) an internal EAP server or (2) a RADIUS server and EAP-pwd is enabled in a runtime configuration, which allows remote attackers to cause a denial of service (process termination) via a large final fragment in an EAP-pwd message.
1257 CVE-2015-5079 22 Dir. Trav. 2018-02-28 2019-04-29
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the dl parameter.
1258 CVE-2015-4461 22 Dir. Trav. +Info 2018-02-05 2018-02-26
4.0
None Remote Low ??? Partial None None
Absolute path traversal vulnerability in eFront CMS 3.6.15.4 and earlier allows remote Professor users to obtain sensitive information via a full pathname in the other parameter.
1259 CVE-2015-4412 400 DoS 2018-02-05 2018-03-13
7.5
None Remote Low Not required Partial Partial Partial
BSON injection vulnerability in the legal? function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service (resource consumption) or inject arbitrary data via a crafted string.
1260 CVE-2015-4400 255 +Info 2018-02-06 2018-03-13
2.1
None Local Low Not required Partial None None
Ring (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information about the wireless network configuration by pressing the set up button and leveraging an API in the GainSpan Wi-Fi module.
1261 CVE-2015-4179 352 CSRF 2018-02-05 2018-02-26
6.8
None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in the Codestyling Localization plugin 1.99.30 and earlier for Wordpress.
1262 CVE-2015-4117 78 Exec Code 2018-02-28 2018-03-23
6.5
None Remote Low ??? Partial Partial Partial
Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/backup/index.php.
1263 CVE-2015-3898 601 2018-02-28 2019-04-30
5.8
None Remote Medium Not required Partial Partial None
Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the redirectUrl parameter to (1) bonita/login.jsp or (2) bonita/loginservice.
1264 CVE-2015-3619 79 XSS 2018-02-06 2018-02-26
3.5
None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in assets/js/vm2admin.js in the VirtueMart component before 3.0.8 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors involving a "double encode combination of first_name, last_name and company."
1265 CVE-2015-3618 79 XSS 2018-02-06 2018-02-26
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Nagios Business Process Intelligence (BPI) before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving index.php.
1266 CVE-2015-2796 79 XSS 2018-02-02 2020-05-06
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Project-Pier ProjectPier-Core allow remote attackers to inject arbitrary web script or HTML via the search_for parameter to (1) search_by_tag.php, (2) search_contacts.php, or (3) search.php.
1267 CVE-2015-2329 79 XSS 2018-02-08 2018-02-26
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order.
1268 CVE-2015-2324 79 XSS 2018-02-19 2019-07-08
3.5
None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authenticated users with edit permission to inject arbitrary web script or HTML via unspecified vectors.
1269 CVE-2015-2204 200 Bypass +Info 2018-02-01 2018-02-15
5.0
None Remote Low Not required Partial None None
Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive information about org unit settings by leveraging failure of open-ils.actor.ou_setting.ancestor_default to enforce view_perm when no auth token is provided.
1270 CVE-2015-2203 200 +Info 2018-02-01 2018-02-15
4.0
None Remote Low ??? Partial None None
Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sensitive settings history information by leveraging listing of open-ils.pcrud as a controller in the IDL.
1271 CVE-2015-2186 20 2018-02-03 2018-03-02
5.0
None Remote Low Not required None Partial None
The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead of a boolean False for the CORS_ORIGIN_ALLOW_ALL setting. Note: this vulnerability was fixed on 2015-03-06, but the version number was not changed.
1272 CVE-2015-2081 20 Exec Code 2018-02-20 2018-03-19
7.5
None Remote Low Not required Partial Partial Partial
Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.
1273 CVE-2015-1862 362 +Priv 2018-02-09 2018-03-08
6.9
None Local Medium Not required Complete Complete Complete
The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environment.
1274 CVE-2015-1418 200 Exec Code +Info 2018-02-05 2018-04-07
9.3
None Remote Medium Not required Complete Complete Complete
The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10.2-RC1-p2, and 0.2-RC2 before 10.2-RC2-p1, allows remote attackers to execute arbitrary commands via a crafted patch file, because a '!' character can be passed to the ed program.
1275 CVE-2015-1416 264 Exec Code 2018-02-05 2018-03-13
9.3
None Remote Medium Not required Complete Complete Complete
Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other patch variants allow remote attackers to execute arbitrary shell commands via a crafted patch file.
1276 CVE-2015-0203 19 DoS 2018-02-21 2018-03-18
4.0
None Remote Low ??? None None Partial
The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via an AMQP message with (1) an invalid range in a sequence set, (2) content-bearing methods other than message-transfer, or (3) a session-gap control before a corresponding session-attach.
1277 CVE-2014-10072 119 Overflow 2018-02-27 2018-10-31
7.5
None Remote Low Not required Partial Partial Partial
In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.
1278 CVE-2014-10071 119 Overflow 2018-02-27 2019-06-11
7.5
None Remote Low Not required Partial Partial Partial
In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the ">& fd" syntax.
1279 CVE-2014-10070 264 2018-02-27 2018-03-21
4.6
None Local Low Not required Partial Partial Partial
zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where "env_reset" has been disabled.
1280 CVE-2014-9504 284 2018-02-01 2018-02-27
5.0
None Remote Low Not required None Partial None
The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child groups via vectors related to membership inheritance.
1281 CVE-2014-9503 264 2018-02-01 2018-02-27
5.5
None Remote Low ??? None Partial Partial
The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with "access content" permissions to modify arbitrary nodes by leveraging improper access checks on unspecified ajax callbacks.
1282 CVE-2014-9502 352 CSRF 2018-02-01 2018-02-27
6.8
None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in unspecified sub modules in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allow remote attackers to hijack the authentication of unknown victims via vectors related to menu callbacks.
1283 CVE-2014-8985 119 DoS Exec Code Overflow Mem. Corr. 2018-02-08 2018-02-23
7.6
None Remote High Not required Complete Complete Complete
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2810, CVE-2014-2811, CVE-2014-2822, CVE-2014-2823, CVE-2014-4057, and CVE-2014-4145.
1284 CVE-2014-8171 399 DoS 2018-02-09 2019-04-22
4.9
None Local Low Not required None None Complete
The memory resource controller (aka memcg) in the Linux kernel allows local users to cause a denial of service (deadlock) by spawning new processes within a memory-constrained cgroup.
1285 CVE-2014-5282 20 2018-02-06 2019-04-29
5.5
None Remote Low ??? Partial Partial None
Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'.
1286 CVE-2014-5280 352 CSRF 2018-02-06 2020-01-30
9.3
None Remote Medium Not required Complete Complete Complete
boot2docker 1.2 and earlier allows attackers to conduct cross-site request forgery (CSRF) attacks by leveraging Docker daemons enabling TCP connections without TLS authentication.
1287 CVE-2014-5279 284 Exec Code +Priv 2018-02-06 2019-04-29
9.0
None Remote Low ??? Complete Complete Complete
The Docker daemon managed by boot2docker 1.2 and earlier improperly enables unauthenticated TCP connections by default, which makes it easier for remote attackers to gain privileges or execute arbitrary code from children containers.
1288 CVE-2014-4145 119 DoS Exec Code Overflow Mem. Corr. 2018-02-08 2018-03-08
7.6
None Remote High Not required Complete Complete Complete
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2810, CVE-2014-2811, CVE-2014-2822, CVE-2014-2823, CVE-2014-4057, and CVE-2014-8985.
1289 CVE-2014-4112 119 DoS Exec Code Overflow Mem. Corr. 2018-02-08 2018-03-08
7.6
None Remote High Not required Complete Complete Complete
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0304.
1290 CVE-2014-4066 119 DoS Exec Code Overflow Mem. Corr. 2018-02-08 2018-03-08
7.6
None Remote High Not required Complete Complete Complete
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2787, CVE-2014-2790, CVE-2014-2802, and CVE-2014-2806.
1291 CVE-2014-3972 22 Dir. Trav. 2018-02-19 2018-03-19
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Apexis APM-J601-WS cameras with firmware before 17.35.2.49 allows remote attackers to read arbitrary files via unspecified vectors.
1292 CVE-2014-3752 264 Exec Code 2018-02-01 2018-10-09
7.2
None Local Low Not required Complete Complete Complete
The MiniIcpt.sys driver in G Data TotalProtection 2014 24.0.2.1 and earlier allows local users with administrator rights to execute arbitrary code with SYSTEM privileges via a crafted 0x83170180 call.
1293 CVE-2014-3519 284 Bypass 2018-02-01 2018-02-27
4.9
None Local Low Not required Complete None None
The open_by_handle_at function in vzkernel before 042stab090.5 in the OpenVZ modification for the Linux kernel 2.6.32, when using simfs, might allow local container users with CAP_DAC_READ_SEARCH capability to bypass an intended container protection mechanism and access arbitrary files on a filesystem via vectors related to use of the file_handle structure.
1294 CVE-2014-3244 611 Exec Code 2018-02-01 2018-02-15
7.5
None Remote Low Not required Partial Partial Partial
XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.
1295 CVE-2014-3219 59 2018-02-09 2019-09-24
4.3
None Local Low ??? Partial Partial Partial
fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.
1296 CVE-2014-3206 20 Exec Code 2018-02-23 2018-03-19
10.0
None Remote Low Not required Complete Complete Complete
Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name parameter to localhost/backupmgmt/pre_connect_check.php.
1297 CVE-2014-3205 798 2018-02-23 2018-03-18
10.0
None Remote Low Not required Complete Complete Complete
backupmgt/pre_connect_check.php in Seagate BlackArmor NAS contains a hard-coded password of '!~@##$$%FREDESWWSED' for a backdoor user.
1298 CVE-2014-3005 611 Exec Code 2018-02-01 2018-02-21
7.5
None Remote Low Not required Partial Partial Partial
XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.
1299 CVE-2014-1835 255 2018-02-02 2018-02-14
2.1
None Local Low Not required Partial None None
The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table.
1300 CVE-2014-1834 77 2018-02-02 2018-02-14
4.6
None Local Low Not required Partial Partial Partial
The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi-colon in their username or password.
Total number of vulnerabilities : 1328   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 (This Page)27
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.