Archive
January 2018
Vulnerabilities first published in this month (UTC), newest first.
1,275 results · Feed
-
Unscored —
An issue was discovered in Skybox Platform before 7.5.401. Reflected cross-site scripting vulnerabilities exist in /sky…
-
Unscored —
In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the unzip_match function in runz…
-
Unscored —
In ImageMagick 7.0.7-1 Q16, a memory exhaustion vulnerability was found in the function ReadTIFFImage in coders/tiff.c,…
-
Unscored —
In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which a…
-
Unscored —
In ImageMagick 7.0.6-10 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which …
-
Unscored —
An Information Exposure issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running…
-
Unscored —
An issue was discovered in WECON Technology LEVI Studio HMI Editor v1.8.29 and prior. A specially-crafted malicious fil…
-
Unscored —
An issue was discovered in WECON Technology LEVI Studio HMI Editor v1.8.29 and prior. Specially-crafted malicious files…
-
Unscored —
An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products runni…
-
Unscored —
An issue was discovered in Moxa MXview v2.8 and prior. The unquoted service path escalation vulnerability could allow a…
-
Unscored —
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module.
-
Unscored —
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link.
-
Unscored —
Jolla Sailfish OS before 1.1.2.16 allows remote attackers to spoof phone numbers and trigger calls to arbitrary numbers…
-
Unscored —
The Yodobashi App for Android 1.2.1.0 and earlier does not verify X.509 certificates from SSL servers, which allows man…
-
Unscored —
node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive informatio…
-
Unscored —
A stack-based buffer overflow in Flexense DiskBoss 8.8.16 and earlier allows unauthenticated remote attackers to execut…
-
Unscored —CVE-2018-5315 Public exploit
The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.
-
Unscored —
The backup mechanism in the adb tool in Android might allow attackers to inject additional applications (APKs) and exec…
-
Unscored —
cgi-bin/AZ_Retrain.cgi in Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices does not check for authentication…
-
Unscored —
Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices allow remote attackers to obtain sensitive device configura…
-
Unscored —
Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices improperly manage sessions, which allows remote attackers t…
-
Unscored —
Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denia…
-
Unscored —
The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 throu…
-
Unscored —
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows local…
-
Unscored —
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 do not prope…
-
Unscored —
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remot…
-
Unscored —
An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthe…
-
Unscored —CVE-2017-16886 Public exploit
The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interac…
-
Unscored —
The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interac…
-
Unscored —
Improper Permissions Handling in the Portal on FiberHome LM53Q1 VH519R05C01S38 devices (intended for obtaining informat…
-
Unscored —CVE-2017-17970 Public exploit
Multiple SQL injection vulnerabilities in Muviko 1.1 allow remote attackers to execute arbitrary SQL commands via the (…
-
Unscored —
NVIDIA driver contains an integer overflow vulnerability which could cause a use after free and possibly lead to an ele…
-
Unscored —
The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming…
-
Unscored —
The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or Ja…
-
Unscored —
Improper verification when expanding ZIP64 archives in Lhaplus versions 1.73 and earlier may lead to unintended content…
-
Unscored —
The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 …
-
Medium 4.8
WPGlobus plugin Stored XSS & CSRF security vulnerability
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php.
-
Medium 4.8
WPGlobus plugin Stored XSS & CSRF security vulnerability
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language) parameter to wp-admin/options.php.