22 January 2018

27 results · Feed

• Unscored —
  CVE-2018-0845 EPSS 20%

  Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Micr…

  Microsoft Equation Editor
  Jan 22, 2018
• Unscored —
  CVE-2018-0862 EPSS 19%

  Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Micr…

  Microsoft Equation Editor
  Jan 22, 2018
• Unscored —
  CVE-2018-0849 EPSS 19%

  Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Micr…

  Microsoft Equation Editor
  Jan 22, 2018
• Unscored —
  CVE-2018-0848 EPSS 20%

  Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Micr…

  Microsoft Equation Editor
  Jan 22, 2018
• Unscored —
  CVE-2017-1000417

  MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs (e.g. in E…

  Jan 22, 2018
• Unscored —
  CVE-2017-1000416

  axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year (19)50 of UTCTime being misinterpreted…

  Jan 22, 2018
• High 7.5
  CVE-2018-6010

  Yii Framework reflected Cross-site Scripting

  In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/…

  yiisoft/yii2 Packagist
  Jan 22, 2018
• High 8.8
  CVE-2018-6009

  Yii Framework Cross-Site Request Forgery (CSRF)

  In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.

  yiisoft/yii2 yiisoft/yii2-dev Packagist
  Jan 22, 2018
• Unscored —
  CVE-2018-6001

  The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templat…

  Jan 22, 2018
• Unscored —
  CVE-2018-6003

  An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited re…

  libtasn1-6 libtasn1-6 libtasn1 Debian Ubuntu Alpine
  Jan 22, 2018
• Unscored —
  CVE-2018-6000 Public exploit EPSS 85%

  An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vp…

  Jan 22, 2018
• Unscored —
  CVE-2018-6002

  The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\tem…

  Jan 22, 2018
• Unscored —
  CVE-2018-5999 Public exploit EPSS 88%

  An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, pr…

  Jan 22, 2018
• Unscored —
  CVE-2018-1000003

  Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-m…

  pdns-recursor pdns-recursor Debian Alpine
  Jan 22, 2018
• Unscored —
  CVE-2018-1000002

  Improper input validation bugs in DNSSEC validators components in Knot Resolver (prior version 1.5.2) allow attacker in…

  knot-resolver Debian
  Jan 22, 2018
• Unscored —
  CVE-2018-5761

  A man-in-the-middle vulnerability related to vCenter access was found in Rubrik CDM 3.x and 4.x before 4.0.4-p2. This v…

  Jan 22, 2018
• Unscored —
  CVE-2017-17858

  Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote …

  mupdf mupdf Ubuntu Alpine
  Jan 22, 2018
• Medium 5.4
  CVE-2018-1045

  Moodle XSS Vulnerability

  In Moodle 3.x, there is XSS via a calendar event name.

  moodle/moodle moodle Web / CMS Ubuntu Packagist
  Jan 22, 2018
• Medium 6.5
  CVE-2018-1042 Public exploit EPSS 16%

  Moodle SSRF Vulnerability

  Moodle 3.x has Server Side Request Forgery in the filepicker.

  moodle/moodle moodle Web / CMS Ubuntu Packagist
  Jan 22, 2018
• Medium 4.3
  CVE-2018-1044

  Moodle Privilege escalation in quiz web services

  In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.

  moodle/moodle moodle Web / CMS Ubuntu Packagist
  Jan 22, 2018
• Medium 6.5
  CVE-2018-1043

  Moodle Setting for blocked hosts list can be bypassed with multiple A record hostnames

  In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.

  moodle/moodle moodle Web / CMS Ubuntu Packagist
  Jan 22, 2018
• High 8.1
  CVE-2018-5968

  Deserialization of Untrusted Data in jackson-databind

  FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypa…

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Jan 22, 2018
• Unscored —
  CVE-2016-10709 Public exploit EPSS 34%

  pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status…

  Jan 22, 2018
• Unscored —
  CVE-2017-18047 Public exploit EPSS 20%

  Buffer Overflow in the FTP client in LabF nfsAxe 3.7 allows remote FTP servers to execute arbitrary code via a long rep…

  Jan 22, 2018
• High 8.8
  CVE-2018-5960

  SQL Injection in Zenario 7.1-7.6

  Zenario v7.1 - v7.6 has SQL injection via the `Name` input field of organizer.php or admin_boxes.ajax.php in the `Categories - Edit` module.

  tribalsystems/zenario Packagist
  Jan 22, 2018
• Unscored —
  CVE-2018-5961

  CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the `module` value of the `index.php` file.

  Jan 22, 2018
• Unscored —
  CVE-2018-5962

  index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpin…

  Jan 22, 2018