Archive
22 February 2018
Vulnerabilities first published on this day (UTC), newest first.
48 results · Feed
-
Critical 9.8
AppFormix: Debug Shell Command Execution in AppFormix Agent
A malicious user with unrestricted access to the AppFormix application management platform may be able to access a Python debug console and execute system commands with root privilege. The AppFormix Agent exposes the debug console on a host where AppFormix Ag…
-
High 8.1
MFSBGN03798 rev.1 - Micro Focus Universal CMDB, Apache Struts Instance
Arbitrary Code Execution vulnerability in Micro Focus Universal CMDB, version 4.10, 4.11, 4.12. This vulnerability could be remotely exploited to allow Arbitrary Code Execution.
-
Unscored —
XML External Entity (XXE) vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vuln…
-
Unscored —
Remote Code Execution in the addon installation process in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows authenticat…
-
Unscored —
In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are d…
-
Unscored —
SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerabi…
-
Unscored —
Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allow…
-
Unscored —CVE-2018-7316 Public exploit
Arbitrary File Upload exists in the Proclaim 9.1.1 component for Joomla! via a mediafileform action.
-
Unscored —
eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. This can be exploited by sendi…
-
Unscored —CVE-2018-7318 Public exploit
SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, descri…
-
Unscored —CVE-2018-7317 Public exploit
Backup Download exists in the Proclaim 9.1.1 component for Joomla! via a direct request for a .sql file under backup/.
-
Unscored —
Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attacker…
-
Unscored —CVE-2018-7315 Public exploit
SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, cas…
-
Unscored —CVE-2018-7312 Public exploit
SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.
-
Unscored —
Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic …
-
Unscored —CVE-2018-7319 Public exploit
SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling_system1, heating_syste…
-
Unscored —
IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user…
-
Unscored —
IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user…
-
High 8.1
Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code …
-
Unscored —
IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to SQL injection. A remote attacker could send specially-crafted …
-
Unscored —
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra…
-
Unscored —CVE-2018-6890 Public exploit
Cross-site scripting (XSS) vulnerability in Wolf CMS 0.8.3.1 via the page editing feature, as demonstrated by /?/admin/…
-
Unscored —
In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.
-
High 7.8
Incorrect Permission Assignment for Critical Resource in NPM
An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow lo…
-
Unscored —
SQL injection vulnerability in users/signup.php in the "signup" component in HamayeshNegar CMS allows a remote attacker…
-
Unscored —
In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authoriz…
-
Unscored —
In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user …
-
Unscored —
In version 1012 and prior of Insteon's Insteon Hub, the radio transmissions used for communication between the hub and …
-
Unscored —
fs/f2fs/extent_cache.c in the Linux kernel before 4.13 mishandles extent trees, which allows local users to cause a den…
-
Unscored —
SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.
-
Unscored —
A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenti…
-
Unscored —
A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could al…
-
Unscored —
A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacke…
-
Unscored —
A vulnerability in the User Provisioning tab in the Cisco Prime Collaboration Provisioning Tool could allow an unauthen…
-
Unscored —
A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send uns…
-
Unscored —
A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Co…
-
Unscored —
A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Soft…
-
Unscored —
A vulnerability in Cisco Jabber Client Framework (JCF) could allow an unauthenticated, remote attacker to conduct a cro…
-
Unscored —
A vulnerability in the web-based interface of Cisco Prime Service Catalog could allow an unauthenticated, remote attack…
-
Unscored —
A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, re…