Archive
January 2018
Vulnerabilities first published in this month (UTC), newest first.
163 results · Clear filters · Feed
-
Unscored —CVE-2018-5759 Public exploit
jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows r…
-
Unscored —CVE-2018-5705 Public exploit
Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine (the t parameter to …
-
Unscored —
RAVPower FileHub 2.000.056 allows remote users to steal sensitive information via a crafted HTTP request.
-
Unscored —
A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise …
-
Unscored —CVE-2017-1000475 Public exploit
FreeSSHd 1.3.1 version is vulnerable to an Unquoted Path Service allowing local users to launch processes with elevated…
-
Unscored —
SQL Injection exists in Wchat Fully Responsive PHP AJAX Chat Script 1.5 via the login.php User field.
-
Unscored —
SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request.
-
Unscored —CVE-2018-5978 Public exploit
SQL Injection exists in Facebook Style Php Ajax Chat Zechat 1.5 via the login.php User field.
-
Unscored —
SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobile_preview.php or index.php.
-
Unscored —CVE-2018-5986 Public exploit
SQL Injection exists in Easy Car Script 2014 via the s_order or s_row parameter to site_search.php.
-
Unscored —
SQL Injection exists in Classified Ads CMS Quickad 4.0 via the keywords, placeid, cat, or subcat parameter to the listi…
-
Unscored —CVE-2018-5969 Public exploit
Cross Site Request Forgery (CSRF) exists in Photography CMS 1.0 via clients/resources/ajax/ajax_new_admin.php, as demon…
-
Unscored —CVE-2018-5976 Public exploit
Cross Site Request Forgery (CSRF) exists in RSVP Invitation Online 1.0 via function/account.php, as demonstrated by mod…
-
Unscored —CVE-2018-5984 Public exploit
SQL Injection exists in the Tumder (An Arcade Games Platform) 2.1 component for Joomla! via the PATH_INFO to the catego…
-
Unscored —CVE-2018-5977 Public exploit
SQL Injection exists in Affiligator Affiliate Webshop Management System 2.1.0 via a search/?q=&price_type=range&price= …
-
Unscored —CVE-2018-5359 Public exploit
The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining syste…
-
Unscored —CVE-2017-17999 Public exploit
SQL injection vulnerability in RISE Ultimate Project Manager 1.9 allows remote attackers to execute arbitrary SQL comma…
-
Unscored —
A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmw…
-
Unscored —
Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for ex…
-
Unscored —CVE-2016-5345 Public exploit
Buffer overflow in the Qualcomm radio driver in Android before 2017-01-05 on Android One devices allows local users to …
-
Unscored —
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vp…
-
Unscored —
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, pr…
-
Medium 6.5
Moodle SSRF Vulnerability
Moodle 3.x has Server Side Request Forgery in the filepicker.
-
Unscored —
pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status…
-
Unscored —
Buffer Overflow in the FTP client in LabF nfsAxe 3.7 allows remote FTP servers to execute arbitrary code via a long rep…
-
Unscored —
An issue was discovered in GitStack through 2.3.10. User controlled input is not sufficiently filtered, allowing an una…
-
High 7.5
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon cr…
-
Unscored —CVE-2017-11398 Public exploit
A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 a…
-
Unscored —
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to p…
-
Unscored —
An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below cou…
-
Unscored —CVE-2017-14096 Public exploit
A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and …
-
Unscored —
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to p…
-
Unscored —
A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain mes…
-
Medium 6.1
Cross-Site Scripting (XSS) in jquery
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
-
Medium 6.1CVE-2012-6708 Public exploit
Cross-Site Scripting in jquery
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<…
-
Unscored —CVE-2014-2017 Public exploit
CRLF injection vulnerability in OXID eShop Professional Edition before 4.7.11 and 4.8.x before 4.8.4, Enterprise Editio…
-
Unscored —
Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Security).…
-
Unscored —CVE-2018-2698 Public exploit
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions t…
-
Unscored —CVE-2017-10273 Public exploit
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Deployment). Supported vers…
-
Unscored —CVE-2018-5764 Public exploit
The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses…