Archive
6 February 2018
Vulnerabilities first published on this day (UTC), newest first.
64 results · Feed
-
Unscored —
tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie.
-
Unscored —
A buffer overflow vulnerability in "Add command" functionality exists in Flexense SyncBreeze Enterprise <= 10.3.14. The…
-
Unscored —
A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203. A remote…
-
Unscored —
A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-addres…
-
Unscored —
The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to c…
-
Unscored —
Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox back…
-
Unscored —
Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1.
-
Unscored —
WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1.
-
Unscored —
Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1.
-
Unscored —
Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1.
-
Critical 9.8
jackson-databind is vulnerable to a deserialization flaw
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
-
Critical 9.8
jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This i…
-
Unscored —
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote a…
-
Unscored —
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote a…
-
Unscored —
The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php.
-
Unscored —
Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories.
-
Unscored —
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote a…
-
Unscored —
In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-admini…
-
Unscored —
Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer…
-
Unscored —
NVIDIA libnvmmlite_audio.so contains an elevation of privilege vulnerability when running in media server which may cau…
-
Unscored —
In versions 13.0.0, 12.0.0-12.1.3, or 11.6.0-11.6.2, an F5 BIG-IP virtual server using the URL categorization feature m…
-
Unscored —
NVIDIA libnvmmlite_audio.so contains an elevation of privilege vulnerability when running in media server which may cau…
-
Unscored —
The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an '…
-
Unscored —
West Wind Web Server 6.x does not require authentication for /ADMIN.ASP.