Archive
9 February 2018
Vulnerabilities first published on this day (UTC), newest first.
77 results · Feed
-
Unscored —
An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service a…
-
Unscored —
Security Onion Solutions Squert version 1.0.1 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Eleme…
-
Unscored —
NASA Pyblock version v1.0 - v1.3 contains a CWE-502 vulnerability in Radar data parsing library that can result in remo…
-
Unscored —
Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the mine…
-
High 8.3
XXE vulnerability in Jenkins Android Lint Plugin
Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, o…
-
Unscored —
Linux kernel version after commit bdcf0a423ea1 - 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+ contains a Incorrect Access Cont…
-
High 8.3
Jenkins CCM Plugin vulnerable to Improper Restriction of XML External Entity Reference
Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-…
-
Unscored —
GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems in…
-
Unscored —
NASA Kodiak version v1.0 contains a CWE-502 vulnerability in Kodiak library's data processing function that can result …
-
Unscored —
GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulne…
-
Unscored —
Security Onion Solutions Squert version 1.1.1 through 1.6.7 contains a SQL Injection vulnerability in .inc/callback.php…
-
Unscored —
NASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval functionality of RtRetrieval …
-
High 8.1
Jerome Gamez Firebase Admin SDK for PHP Incorrect Access Control vulnerability
Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could …
-
Medium 4.3
Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials
Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided password values, e.g. replacing environment variable references, which could result in values different…
-
Unscored —
fmtlib version prior to version 4.1.0 (before commit 0555cea5fc0bf890afe0071a558e44625a34ba85) contains a Memory corrup…
-
Medium 5.3
Insight API transaction broadcast endpoint can result in Full Path Disclosure
Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request.
-
Unscored —CVE-2018-1000027 EPSS 13%
The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Derefere…
-
Unscored —
Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522…
-
Unscored —
The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointe…
-
Unscored —
An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service a…
-
Unscored —
Electrum Technologies GmbH Electrum Bitcoin Wallet version prior to version 3.0.5 contains a Missing Authorization vuln…
-
Unscored —
Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / P…
-
Unscored —
NASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library (Weather data) that can result i…
-
High 8.8
Arbitrary code execution due to incomplete sandbox protection in Pipeline: Supporting APIs Plugin
Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java deserialization like readResolve implemented in Pipeline scripts were not subject to sandbox protection, a…
-
Unscored —
Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnera…
-
Unscored —
A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of se…
-
Unscored —
Sean Barrett stb_vorbis version 1.12 and earlier contains a Buffer Overflow vulnerability in All vorbis decoding paths.…
-
High 8.3
Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin
Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or deni…
-
Unscored —
ValidFormBuilder version 4.5.4 contains a PHP Object Injection vulnerability in Valid Form unserialize method that can …
-
Unscored —CVE-2018-1000035 EPSS 30%
A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives …
-
Unscored —
LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Theme Uninstallation…
-
Unscored —
mcholste Enterprise Log Search and Archive (ELSA) version revision 1205, commit 2cc17f1 and earlier contains a Cross Si…
-
Unscored —
WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAc…
-
Unscored —
A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of se…
-
Unscored —
OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in fax_dispatch.php that can result in OS command i…
-
Unscored —
OpenEMR version 5.0.0 contains a Cross Site Scripting (XSS) vulnerability in open-flash-chart.swf and _posteddata.php t…
-
Unscored —
Security Onion Solutions Squert version 1.3.0 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Eleme…
-
Medium 5.4
Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code.
-
Unscored —
Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that ca…
-
Medium 6.1
Mautic Cross Site Scripting (XSS) vulnerability
Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code.