Archive
21 February 2018
Vulnerabilities first published on this day (UTC), newest first.
47 results · Feed
-
Unscored —
CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme.…
-
High 8.8
PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged …
-
Unscored —CVE-2018-6936 Public exploit
Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account.
-
Unscored —
A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote user…
-
Unscored —
IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Tr…
-
Unscored —
IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra…
-
Unscored —
IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…
-
Unscored —
This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration…
-
Unscored —
Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE …
-
Unscored —
MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts.
-
Unscored —
The Calendar component in Tiki 17.1 allows HTML injection.
-
Medium 5.4
Tiki Wiki CMS XSS Vulnerability
Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS.
-
Unscored —
This module enables you to drag and drop or paste images into CKEditor. The module does not sufficiently verify users p…
-
Unscored —CVE-2018-7289 Public exploit
An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames con…
-
Medium —
Moderate severity vulnerability that affects org.keycloak:keycloak-core
It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading t…
-
Unscored —
This security advisory fixes multiple vulnerabilities in both Drupal 7 and Drupal 8. See below for a list. #### Comment…
-
Unscored —
SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote a…
-
Unscored —
The eap_pwd_process function in eap_server/eap_server_pwd.c in hostapd 2.x before 2.6 does not validate that the reasse…
-
Unscored —
The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6 does not validate that the reassemb…
-
Unscored —
The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6, when EAP-pwd is e…
-
Medium 5.4
radiant vulnerable to Cross-site Scripting
There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4. They affect Personal Preferences (Name and Username) and Configuration (Site Title, Dev Site Domain, Page Parts, and Page Fields).
-
Unscored —
The Ninja Forms plugin before 3.2.14 for WordPress has XSS.
-
Unscored —
The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechan…
-
Unscored —
IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 does not set the secure flag for th…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the My Reports component in IBM TRIRIGA Application Platform 3.3 before 3.3…
-
Unscored —
IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 might allow remote attackers to obt…
-
Unscored —
IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 allows remote authenticated users t…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3, 3.3.1, 3.3.2, and 3.4 allows r…
-
Unscored —
IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authentic…
-
Unscored —
XML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6 allows remote authenticated…
-
Unscored —
IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authentic…
-
Unscored —
The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon…
-
Unscored —
Race condition in the LoadBalancer module in the Atlassian Floodlight Controller before 1.2 allows remote attackers to …
-
Medium 5.4
phpMyAdmin Cross-site scripting (XSS) vulnerability in central columns feature
Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
-
Unscored —
An issue was discovered in Reprise License Manager 11.0. This vulnerability is a Path Traversal where the attacker, by …
-
Unscored —
The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 a…
-
Unscored —
This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL …
-
Unscored —
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-…
-
Unscored —
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-…
-
Unscored —
This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with…