18 January 2018

217 results · Feed

• Medium 6.1
  CVE-2015-9251 Public exploit EPSS 30%

  Cross-Site Scripting (XSS) in jquery

  jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

  ruby ceph jquery-rails org.webjars.npm:jquery Ubuntu Azure Linux Alpine npm Maven NuGet RubyGems
  Jan 18, 2018
• Medium 6.1
  CVE-2012-6708 Public exploit

  Cross-Site Scripting in jquery

  jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<…

  ruby ceph jquery-rails org.webjars.npm:jquery Ubuntu Azure Linux Alpine npm Maven NuGet RubyGems
  Jan 18, 2018
• High 7.5
  CVE-2016-10707

  Denial of Service in jquery

  jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.

  jquery-rails org.webjars.npm:jquery jQuery jquery npm Maven NuGet RubyGems
  Jan 18, 2018
• Unscored —
  CVE-2018-5776

  WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).

  wordpress wordpress Debian Ubuntu
  Jan 18, 2018
• Unscored —
  CVE-2017-17860

  In Samsung Gear products, Bluetooth link key is updated to the different key which is same with attacker's link key. It…

  Jan 18, 2018
• Medium 6.1
  CVE-2018-5773

  markdown2 is vulnerable to cross-site scripting

  An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstr…

  markdown2 PyPI
  Jan 18, 2018
• Medium 6.5
  CVE-2017-12197

  Improper Input Validation in libpam4j

  It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.

  Red Hat libpam4j org.kohsuke:libpam4j libpam4j Ubuntu Maven
  Jan 18, 2018
• High 8.1
  CVE-2017-3158

  Apache Guacamole Race Condition vulnerability

  A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaini…

  Apache Software Foundation Apache Guacamole guacamole-client guacamole-server Ubuntu Maven
  Jan 18, 2018
• Unscored —
  CVE-2017-12729

  A SQL Injection issue was discovered in Moxa SoftCMS Live Viewer through 1.6. An improper neutralization of special ele…

  Jan 18, 2018
• Unscored —
  CVE-2017-5170

  An Uncontrolled Search Path Element issue was discovered in Moxa SoftNVR-IA Live Viewer, Version 3.30.3122 and prior ve…

  Jan 18, 2018
• Critical 9.8
  CVE-2016-6814 EPSS 17%

  Deserialization of Untrusted Data in Groovy

  When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an att…

  org.codehaus.groovy:groovy-all groovy groovy org.codehaus.groovy:groovy Debian Ubuntu Maven
  Jan 18, 2018
• Unscored —
  CVE-2017-16863

  The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScri…

  Atlassian Atlassian Jira Web / CMS
  Jan 18, 2018
• Unscored —
  CVE-2014-2017 Public exploit

  CRLF injection vulnerability in OXID eShop Professional Edition before 4.7.11 and 4.8.x before 4.8.4, Enterprise Editio…

  Jan 18, 2018
• Unscored —
  CVE-2017-18033

  The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abo…

  Atlassian Jira Web / CMS
  Jan 18, 2018
• Unscored —
  CVE-2017-15869

  Cross-site scripting (XSS) vulnerability in knowledgebase.php in LiveZilla before 7.0.8.9 allows remote attackers to in…

  Jan 18, 2018
• Unscored —
  CVE-2018-5772

  In Exiv2 0.26, there is a segmentation fault caused by uncontrolled recursion in the Exiv2::Image::printIFDStructure fu…

  Jan 18, 2018
• Unscored —
  CVE-2018-5766

  In Libav through 12.2, there is an invalid memcpy in the av_packet_ref function of libavcodec/avpacket.c. Remote attack…

  libav Ubuntu
  Jan 18, 2018
• Unscored —
  CVE-2018-0095

  A vulnerability in the administrative shell of Cisco AsyncOS on Cisco Email Security Appliance (ESA) and Content Securi…

  Jan 18, 2018
• Unscored —
  CVE-2018-0096

  A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Infrastructure could allow an auth…

  Jan 18, 2018
• Unscored —
  CVE-2018-0099

  A vulnerability in the web management GUI of the Cisco D9800 Network Transport Receiver could allow an authenticated, r…

  Jan 18, 2018
• Unscored —
  CVE-2018-0089

  A vulnerability in the Policy and Charging Rules Function (PCRF) of the Cisco Policy Suite (CPS) could allow an unauthe…

  Jan 18, 2018
• Unscored —
  CVE-2018-0093

  A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthentica…

  Jan 18, 2018
• Unscored —
  CVE-2018-0097

  A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to r…

  Jan 18, 2018
• Unscored —
  CVE-2018-0094

  A vulnerability in IPv6 ingress packet processing for Cisco UCS Central Software could allow an unauthenticated, remote…

  Jan 18, 2018
• Unscored —
  CVE-2018-0106

  A vulnerability in the ConfD server of the Cisco Elastic Services Controller (ESC) could allow an unauthenticated, loca…

  Jan 18, 2018
• Unscored —
  CVE-2018-0086

  A vulnerability in the application server of the Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticat…

  Jan 18, 2018
• Unscored —
  CVE-2018-0105

  A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote att…

  Jan 18, 2018
• Unscored —
  CVE-2018-0109

  A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access sensitive data a…

  Jan 18, 2018
• Unscored —
  CVE-2018-0102

  A vulnerability in the Pong tool of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a r…

  Jan 18, 2018
• Unscored —
  CVE-2018-0111

  A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data…

  Jan 18, 2018
• Unscored —
  CVE-2018-0100

  A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, lo…

  Jan 18, 2018
• Unscored —
  CVE-2018-0090

  A vulnerability in management interface access control list (ACL) configuration of Cisco NX-OS System Software could al…

  Jan 18, 2018
• Unscored —
  CVE-2018-0088

  A vulnerability in one of the diagnostic test CLI commands on Cisco Industrial Ethernet 4010 Series Switches running Ci…

  iOS
  Jan 18, 2018
• Unscored —
  CVE-2018-0091

  A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenti…

  Jan 18, 2018
• Unscored —
  CVE-2018-0108

  A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer file…

  Jan 18, 2018
• Unscored —
  CVE-2018-0110

  A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access the remote suppo…

  Jan 18, 2018
• Unscored —
  CVE-2018-0092

  A vulnerability in the network-operator user role implementation for Cisco NX-OS System Software could allow an authent…

  Jan 18, 2018
• Unscored —
  CVE-2018-0107

  A vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to …

  Jan 18, 2018
• Unscored —
  CVE-2018-0115

  A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series routers could allow an authen…

  Jan 18, 2018
• Unscored —
  CVE-2018-0098

  A vulnerability in the web-based management interface of Cisco WAP150 Wireless-AC/N Dual Radio Access Point with Power …

  Jan 18, 2018