Archive
16 February 2018
Vulnerabilities first published on this day (UTC), newest first.
22 results · Feed
-
Unscored —
A DLL Hijacking vulnerability in Trend Micro's User-Mode Hooking Module (UMH) could allow an attacker to run arbitrary …
-
Unscored —CVE-2018-3609 EPSS 21%
A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could a…
-
Unscored —CVE-2018-1049 Public exploit
In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from k…
-
Unscored —
An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges…
-
Unscored —
The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) an…
-
Unscored —
The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 all…
-
Unscored —
Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allo…
-
Unscored —
Untrusted search path vulnerability in "FLET'S Azukeru Backup Tool" version 1.5.2.6 and earlier allows an attacker to g…
-
Unscored —
Untrusted search path vulnerability in FLET'S v4 / v6 address selection tool allows an attacker to gain privileges via …
-
Unscored —CVE-2018-7187 EPSS 63%
Remote command execution via "go get" command with "-insecure" option in cmd/go
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted …
-
Unscored —
A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attack…
-
Unscored —
core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerabi…
-
Unscored —
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerabil…
-
Unscored —CVE-2018-7176 Public exploit
FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add …
-
Unscored —
F-Secure Radar (on-premises) before 2018-02-15 has XSS via vectors involving the Tags parameter in the JSON request bod…
-
Unscored —
F-Secure Radar (on-premises) before 2018-02-15 has an Unvalidated Redirect via the ReturnUrl parameter that triggers up…
-
Unscored —
trixbox 2.8.0.4 has XSS via the PATH_INFO to /maint/index.php or /user/includes/language/langChooser.php.
-
Unscored —
trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter…
-
Unscored —
trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.ph…
-
Medium 5.3
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins …
-
Medium 5.3
Server-Side Request Forgery in Jenkins
An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response.
-
Unscored —
Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allo…