Archive
2 February 2018
Vulnerabilities first published on this day (UTC), newest first.
66 results · Feed
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Project-Pier ProjectPier-Core allow remote attackers to inject a…
-
Unscored —
In Sophos Tester Tool 3.2.0.7 Beta, the driver accepts a special DeviceIoControl code that doesn't check its argument. …
-
Unscored —
The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated format stri…
-
Unscored —
In Sophos Tester Tool 3.2.0.7 Beta, the driver loads (in the context of the application used to test an exploit or rans…
-
Unscored —
An issue was discovered in Flexense DiskBoss 8.8.16 and earlier. Due to the usage of plaintext information from the han…
-
High 7.8
Echor Ruby Gem credentials can be stolen via process table monitoring
The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table.
-
High 7.8
Echor contains Command Injection
The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi-colon in their username or password.
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 6.1.0 before 6.1.0-TIV-BSM-FP0004 and 6…
-
Unscored —
IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authentic…
-
Unscored —
IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 might allow remote atta…
-
Unscored —
Open redirect vulnerability in IBM Emptoris Sourcing 10.0.0.x before 10.0.0.1_iFix3, 10.0.1.x before 10.0.1.3_iFix3, 10…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Tivoli Integrated Portal 2.2.0.0 through 2.2.0.15 allows remote attacke…
-
Unscored —
IBM TRIRIGA Application Platform before 3.3.2 allows remote attackers to obtain sensitive information via vectors relat…
-
Unscored —CVE-2018-6578 Public exploit
SQL Injection exists in the JE PayperVideo 3.0.0 component for Joomla! via the usr_plan parameter in a view=myplans&tas…
-
Unscored —CVE-2018-6576 Public exploit
SQL Injection exists in Event Manager 1.0 via the event.php id parameter or the page.php slug parameter.
-
Unscored —CVE-2018-6579 Public exploit
SQL Injection exists in the JEXTN Reverse Auction 3.1.0 component for Joomla! via a view=products&uid= request.
-
Unscored —CVE-2018-6581 Public exploit
SQL Injection exists in the JMS Music 1.1.1 component for Joomla! via a search with the keyword, artist, or username pa…
-
Unscored —CVE-2018-6575 Public exploit
SQL Injection exists in the JEXTN Classified 1.0.0 component for Joomla! via a view=boutique&sid= request.
-
Unscored —CVE-2018-6577 Public exploit
SQL Injection exists in the JEXTN Membership 3.1.0 component for Joomla! via the usr_plan parameter in a view=myplans&t…
-
Unscored —
Arbitrary file upload exists in the Jimtawl 2.1.6 and 2.2.5 component for Joomla! via a view=upload&task=upload&pop=tru…
-
Medium 6.1
dijit editor cross-site scripting vulnerability
dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element.
-
Medium 6.1
SimpleSAMLphp XSS Vulnerability
The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute arbitrary JavaScript code on the victim's web browser.
-
High 8.1
SimpleSAMLphp Signature validation bypass
A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at l…
-
Unscored —
Pointer dereference in subsystem in Intel Graphics Driver 15.40.x.x, 15.45.x.x, 15.46.x.x allows unprivileged user to e…
-
Unscored —
The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in …
-
Unscored —
In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to th…
-
High 7.3
MFSBGN03797 rev.1 - Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), XML External Entity Injection
XML External Entity (XXE) vulnerability in Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), versions 16.10, 16.20, 17.10. This vulnerability could be exploited to allow a XML External Entity (XXE) injection.
-
Unscored —
The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user…
-
Unscored —
The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attack…
-
Unscored —
The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to i…
-
Unscored —
The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject ar…
-
Unscored —
The repository settings resource in Atlassian Bitbucket Server before version 5.6.0 allows remote attackers to read the…
-
Unscored —
The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject…
-
Unscored —
The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitra…
-
Unscored —
The Github repository importer in Atlassian Bitbucket Server before version 5.3.0 allows remote attackers to determine …
-
Unscored —
The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or Ja…
-
Unscored —
Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML o…
-
Unscored —
The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version…
-
Unscored —
The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security …
-
Unscored —
The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to …