Skip to content
OpenAdvisories

Archive

1 January 2018

Vulnerabilities first published on this day (UTC), newest first.

← December 2017 2018 / January /1 February 2018 →
  1. 111
  2. 240
  3. 357
  4. 466
  5. 527
  6. 64
  7. 71
  8. 859
  9. 933
  10. 10105
  11. 1149
  12. 12118
  13. 1326
  14. 1420
  15. 154
  16. 1645
  17. 176
  18. 18217
  19. 1932
  20. 205
  21. 217
  22. 2227
  23. 2364
  24. 2452
  25. 2539
  26. 2655
  27. 277
  28. 281
  29. 2936
  30. 3023
  31. 3139
All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • High 8.8
    CVE-2018-3814

    Craft CMS PHP Code Injection Vulnerability

    Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension.

    craftcms/cms Packagist
  • Unscored —
    CVE-2018-3813

    getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0 4.1.53.166 has Incorrect Access Control, as demonstrated b…

  • Unscored —
    CVE-2017-18012

    The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter.

  • Unscored —
    CVE-2017-18008

    In ImageMagick 7.0.7-17 Q16, there is a Memory Leak in ReadPWPImage in coders/pwp.c.

    imagemagick imagemagick Debian Ubuntu
  • Unscored —
    CVE-2017-18011

    The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the text_ads_ajax.php b…

  • Unscored —
    CVE-2017-18013

    In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated b…

    tiff tiff tiff Debian Ubuntu Alpine
  • High 7.5
    CVE-2017-18009

    Out-of-bounds Read in OpenCV

    In OpenCV 3.3.1, a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp.

    opencv-contrib-python opencv-python opencv Debian PyPI
  • Unscored —
    CVE-2017-18010

    The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/cu…

  • Unscored —
    CVE-2018-3811 Public exploit EPSS 42%

    SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthentic…

  • Unscored —
    CVE-2018-3810 Public exploit Scanner template EPSS 91%

    Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows una…

  • Unscored —
    CVE-2017-18006

    netpub/server.np in Extensis Portfolio NetPublish has XSS in the quickfind parameter, aka Open Bug Bounty ID OBB-290447.