Archive
9 February 2018
Vulnerabilities first published on this day (UTC), newest first.
77 results · Feed
-
Medium 5.4
Cross site scripting in Croogo
Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript code.
-
Medium 5.4
Canvs Canvas XSS Vulnerability
Canvs Canvas version 3.4.2 contains a Cross Site Scripting (XSS) vulnerability in User's details that can result in denial of service and execution of javascript code.
-
Unscored —CVE-2015-1862 Public exploit
The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroo…
-
Unscored —
A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow …
-
Unscored —
A password hash usage authentication bypass vulnerability in Trend Micro Control Manager 6.0 could allow a remote attac…
-
Unscored —CVE-2018-3605 EPSS 20%
TopXXX, ViolationXXX, and IncidentXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro C…
-
Unscored —CVE-2018-3607 EPSS 14%
XXXTreeNode method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could a…
-
Unscored —
An AdHocQuery_Processor SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 coul…
-
Unscored —CVE-2018-3606 EPSS 49%
XXXStatusXXX, XXXSummary, TemplateXXX and XXXCompliance method SQL injection remote code execution (RCE) vulnerabilitie…
-
Unscored —
A CGGIServlet SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could allow a …
-
Unscored —CVE-2018-3604 EPSS 68%
GetXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could allow …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allo…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 2.x before 2.14.6 a…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Java number format exception handling in FortiGate FortiDB befor…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in FortiWeb before 4.4.4 allow remote attackers to inject arbitrary…
-
Unscored —
fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tm…
-
Unscored —
The memory resource controller (aka memcg) in the Linux kernel allows local users to cause a denial of service (deadloc…
-
Unscored —
Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" com…
-
Unscored —
Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string w…
-
Unscored —
In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was no…
-
Medium 5.5
Tarball permission preservation in puppet
In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.
-
High 8.1
Apache juddi-client vulnerable to XML External Entity (XXE)
In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD t…
-
Unscored —
Cross Site Scripting (XSS) exists in the review section in PHP Scripts Mall Hot Scripts Clone Script Classified 3.1 via…
-
Unscored —
The OLEProperty class in ole/oleprop.cpp in libfpx 1.3.1-10, as used in ImageMagick 7.0.7-22 Q16 and other products, al…
-
Unscored —
IBM WebSphere Portal 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed …
-
Unscored —
IBM Security Guardium Database Activity Monitor 9.0, 9.1, and 9.5 could allow a local user with low privileges to view …
-
Unscored —
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to e…
-
Unscored —
VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which allows man-in-the-middle at…
-
Unscored —
An issue was discovered on VOBOT CLOCK before 0.99.30 devices. Cleartext HTTP is used to download a breakout program, a…
-
Unscored —
An issue was discovered on VOBOT CLOCK before 0.99.30 devices. An SSH server exists with a hardcoded vobot account that…
-
Medium 5.9
Moderate severity vulnerability that affects org.apache.qpid:apache-qpid-broker-j
A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows unauthenticated atta…
-
Unscored —
In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, p…
-
Unscored —
Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticat…
-
Unscored —
The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU B…
-
Unscored —
In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function …
-
Unscored —
LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in …
-
Unscored —
In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can b…