Archive
29 January 2018
Vulnerabilities first published on this day (UTC), newest first.
36 results · Feed
-
Unscored —
A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Soft…
-
Unscored —
FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order para…
-
High 8.8
An exploitable out of bounds write vulnerability exists in version 2.2 of the Per Face Texture mapping application know…
-
Unscored —
Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751.
-
Unscored —
A cross-site request forgery web vulnerability has been discovered on Netis WF2419 V2.2.36123 devices. A remote attacke…
-
Unscored —
The WStr::assign function in kso.dll in Kingsoft WPS Office 10.1.0.7106 and 10.2.0.5978 does not validate the size of t…
-
Unscored —
The filter_slice function in libavfilter/vf_transpose.c in FFmpeg through 3.4.1 allows remote attackers to cause a deni…
-
High 7.5
Denial of Service in miekg-dns
A denial of service flaw was found in miekg-dns before 1.0.4. A remote attacker could use carefully timed TCP packets to block the DNS server from accepting new connections.
-
Unscored —
Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated att…
-
Unscored —
iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices have a hardcoded password of admin for the admin account, a hard…
-
Unscored —
Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but…
-
Unscored —CVE-2018-6388 Public exploit
iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices allow remote authenticated users to execute arbitrary OS command…
-
Unscored —
In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.5…
-
Medium 6.5
Deserialization of Untrusted Data in Jenkins
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.
-
Critical 9.8
Deserialization of Untrusted Data in Jenkins
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the…
KEV Oct 2, 2025 -
High 8.8
Improper Authentication in Jenkins
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkins user. The `login` command available in the remoting-based CLI stored the encrypted user name of the successfully auth…
-
High 8.8
Cross-Site Request Forgery in Jenkins
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication realm: create an account if signup is enabled; or create an account if the victim is an administrator, possibly deleting…
-
High 7.5CVE-2017-12626 EPSS 10%
Denial of Service in Apache POI
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI …
-
Unscored —
IBM Content Navigator 2.0 and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML dat…
-
Unscored —
IBM Cognos Analytics 11.0 could store cached credentials locally that could be obtained by a local user. IBM X-Force ID…
-
Unscored —
IBM Cognos Analytics 11.0 could allow a local user to change parameters set from the Cognos Analytics menus without pro…
-
Unscored —
IBM Cognos Analytics 11.0 could produce results in temporary files that contain highly sensitive information that can b…
-
Unscored —
VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization v…
-
Unscored —
VMware AirWatch Console (9.2.x before 9.2.2 and 9.1.x before 9.1.5) contains a Cross Site Request Forgery vulnerability…
-
Unscored —
Multiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N…
-
Unscored —
ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14…
-
Unscored —
A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attack…
-
Unscored —
Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file paramete…
-
Unscored —CVE-2018-6363 Public exploit
SQL Injection exists in Task Rabbit Clone 1.0 via the single_blog.php id parameter.
-
Unscored —CVE-2018-6365 Public exploit
SQL Injection exists in TSiteBuilder 1.0 via the id parameter to /site.php, /pagelist.php, or /page_new.php.
-
Unscored —CVE-2018-6364 Public exploit
SQL Injection exists in Multilanguage Real Estate MLM Script through 3.0 via the /product-list.php srch parameter.
-
Unscored —CVE-2018-6007 Public exploit
CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket.
-
Unscored —CVE-2018-6367 Public exploit
SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chat_im/chat_window.php request_id param…
-
Unscored —CVE-2018-5720 Public exploit
An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices. A …
-
Unscored —CVE-2017-18078 Public exploit
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the…
-
Unscored —
drivers/input/serio/i8042.c in the Linux kernel before 4.12.4 allows attackers to cause a denial of service (NULL point…