Archive
January 2018
Vulnerabilities first published in this month (UTC), newest first.
1,275 results · Feed
-
High 7.5CVE-2018-6184 Scanner template
Directory traversal vulnerability in Next.js
ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.
-
Unscored —
SQL Injection exists in Wchat Fully Responsive PHP AJAX Chat Script 1.5 via the login.php User field.
-
Unscored —
SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request.
-
Unscored —CVE-2018-5978 Public exploit
SQL Injection exists in Facebook Style Php Ajax Chat Zechat 1.5 via the login.php User field.
-
Unscored —
SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobile_preview.php or index.php.
-
Unscored —CVE-2018-5986 Public exploit
SQL Injection exists in Easy Car Script 2014 via the s_order or s_row parameter to site_search.php.
-
Unscored —
SQL Injection exists in Classified Ads CMS Quickad 4.0 via the keywords, placeid, cat, or subcat parameter to the listi…
-
Unscored —CVE-2018-5969 Public exploit
Cross Site Request Forgery (CSRF) exists in Photography CMS 1.0 via clients/resources/ajax/ajax_new_admin.php, as demon…
-
Unscored —CVE-2018-5976 Public exploit
Cross Site Request Forgery (CSRF) exists in RSVP Invitation Online 1.0 via function/account.php, as demonstrated by mod…
-
Unscored —CVE-2018-5984 Public exploit
SQL Injection exists in the Tumder (An Arcade Games Platform) 2.1 component for Joomla! via the PATH_INFO to the catego…
-
Unscored —CVE-2018-5977 Public exploit
SQL Injection exists in Affiligator Affiliate Webshop Management System 2.1.0 via a search/?q=&price_type=range&price= …
-
Unscored —
crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user able to access t…
-
High 7.5
Apache NiFi host header poisoning issue
A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x rele…
-
Critical 9.8
Apache NiFi XSS issue in context path handling
A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x rel…
-
Unscored —
Symantec Reporter 9.5 prior to 9.5.4.1 and 10.1 prior to 10.1.5.5 does not restrict excessive authentication attempts f…
-
Unscored —
install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does n…
-
Unscored —
The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds r…
-
Unscored —CVE-2018-5359 Public exploit
The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining syste…
-
Unscored —
The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged users to caus…
-
Unscored —CVE-2017-17999 Public exploit
SQL injection vulnerability in RISE Ultimate Project Manager 1.9 allows remote attackers to execute arbitrary SQL comma…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbit…
-
Unscored —
A potential security vulnerability has been identified with the command line shell of the HP ThinPro operating system 6…
-
Unscored —
Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1. The vulnera…
-
Unscored —
A potential security vulnerability has been identified with HP Web Jetadmin before 10.4 SR2. This vulnerability could p…
-
Unscored —
Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1. The vulnera…
-
Unscored —
HP has identified a potential security vulnerability with HP Enterprise LaserJet Printers and MFPs, HP OfficeJet Enterp…
-
Unscored —
The vulnerability allows attacker to extract binaries into protected file system locations in HP Support Assistant befo…
-
Unscored —
Insufficient Solution DLL Signature Validation allows potential execution of arbitrary code in HP LaserJet Enterprise p…
-
Unscored —
HP has identified a potential security vulnerability before IG_11_00_00.10 for DesignJet T790, T795, T1300, T2300, befo…
-
Unscored —
A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmw…
-
Unscored —
A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSE…
-
Unscored —
A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated w…
-
Unscored —
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.…
-
Unscored —
An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.…
-
Unscored —
An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and …
-
Unscored —
When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up …
-
Unscored —
An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to…
-
Unscored —
On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the P…
-
High 8.8
CSRF vulnerability in Jenkins Translation Assistance plugin
Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to override localized strings displayed to all users on the current Jenkins instance if the …
-
High 8.8
XXE vulnerability in Jenkins PMD Plugin
Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial…