Archive
26 February 2018
Vulnerabilities first published on this day (UTC), newest first.
30 results · Feed
-
Unscored —
Microsoft Identity Manager 2016 SP1 allows an attacker to gain elevated privileges when it does not properly sanitize a…
-
High 7.5
uWSGI Directory Traversal vulnerability
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
-
Medium 5.5
Ox gem stack overflow in sax_parse
In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the read_from_str function in sax_buf.c when a crafted input is supplied to sax_parse.
-
Unscored —
A Directory Traversal issue was discovered in the Foxit MobilePDF app before 6.1 for iOS. This occurs by abusing the UR…
-
Unscored —
A denial-of-service issue was discovered in the Foxit MobilePDF app before 6.1 for iOS. This occurs when a user uploads…
-
Unscored —
An issue was discovered on Wireless IP Camera 360 devices. Attackers can read recordings by navigating to /mnt/idea0 or…
-
Unscored —
An issue was discovered on Wireless IP Camera 360 devices. A root account with a known SHA-512 password hash exists, wh…
-
Unscored —
An issue was discovered on Wireless IP Camera 360 devices. Remote attackers can discover a weakly encoded admin passwor…
-
Unscored —
An issue was discovered on Wireless IP Camera 360 devices. Remote attackers can discover RTSP credentials by connecting…
-
Unscored —CVE-2018-7250 Public exploit
An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 befo…
-
Unscored —CVE-2018-7249 Public exploit
An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 befo…
-
Unscored —
A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function in the Linux kernel before 4.14.7 …
-
Unscored —
In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing i…
-
Unscored —
Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remot…
-
Unscored —
An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enu…
-
Critical 9.8
FasterXML jackson-databind allows unauthenticated remote code execution
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JS…
-
Unscored —
There is a heap-based buffer overflow in the LoadPCX function of in_pcx.cpp in sam2p 0.49.4. A Crafted input will lead …
-
Unscored —
The TLS implementation in the TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 58.1 before 58.16…
-
Unscored —
The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, …
-
Unscored —
Blue River Mura CMS before v7.0.7029 supports inline function calls with an [m] tag and [/m] end tag, without proper re…
-
Unscored —
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores user credentials in plain in clear text which can be re…
-
Unscored —
An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio…
-
Unscored —
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 discloses sensitive information to unauthorized users. The inf…
-
Unscored —
SQL injection vulnerability in files.php in the "files" component in ASANHAMAYESH CMS 3.4.6 allows a remote attacker to…
-
Unscored —
The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag action.
-
Unscored —
ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag …
-
Unscored —
YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.p…
-
Unscored —
The f2fs implementation in the Linux kernel before 4.14 mishandles reference counts associated with f2fs_wait_discard_b…
-
Unscored —
An issue was discovered in PureVPN through 5.19.4.0 on Windows. The client installation grants the Everyone group Full …
-
High 7.5
Apache Geode configuration request authorization vulnerability
When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data an…