Skip to content
OpenAdvisories

Archive

22 January 2018

Vulnerabilities first published on this day (UTC), newest first.

← December 2017 2018 / January /22 February 2018 →
  1. 111
  2. 240
  3. 357
  4. 466
  5. 527
  6. 64
  7. 71
  8. 859
  9. 933
  10. 10105
  11. 1149
  12. 12118
  13. 1326
  14. 1420
  15. 154
  16. 1645
  17. 176
  18. 18217
  19. 1932
  20. 205
  21. 217
  22. 2227
  23. 2364
  24. 2452
  25. 2539
  26. 2655
  27. 277
  28. 281
  29. 2936
  30. 3023
  31. 3139
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.5
    CVE-2018-6010

    Yii Framework reflected Cross-site Scripting

    In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/…

    yiisoft/yii2 Packagist
  • High 8.8
    CVE-2018-6009

    Yii Framework Cross-Site Request Forgery (CSRF)

    In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.

    yiisoft/yii2 yiisoft/yii2-dev Packagist
  • High 8.1
    CVE-2018-5968

    Deserialization of Untrusted Data in jackson-databind

    FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypa…

    jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  • High 8.8
    CVE-2018-5960

    SQL Injection in Zenario 7.1-7.6

    Zenario v7.1 - v7.6 has SQL injection via the `Name` input field of organizer.php or admin_boxes.ajax.php in the `Categories - Edit` module.

    tribalsystems/zenario Packagist