Archive
27 February 2018
Vulnerabilities first published on this day (UTC), newest first.
77 results · Feed
-
Unscored —
In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p.
-
Unscored —
In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.
-
Unscored —
zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of…
-
Unscored —
In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.
-
Unscored —
In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the ">& fd" syntax.
-
Unscored —
In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.
-
Unscored —
In utils.c in zsh before 5.4, symlink expansion had a buffer overflow.
-
Unscored —
In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processi…
-
Unscored —
lyadmin 1.x has XSS via the config[WEB_SITE_TITLE] parameter to the /admin.php?s=/admin/config/groupsave.html URI.
-
Unscored —
AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI.
-
Unscored —
When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the …
-
Unscored —
The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users to cause a denial of…
-
Unscored —
The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to cause a deni…
-
Unscored —
There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the T…
-
Unscored —
There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and li…
-
Unscored —
An issue was discovered in Xen through 4.10.x allowing guest OS users to cause a denial of service (hypervisor crash) o…
-
Unscored —
An issue was discovered in Xen 4.8.x through 4.10.x allowing x86 PVH guest OS users to cause a denial of service (NULL …
-
Unscored —
An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (host OS CPU …
-
Unscored —
An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted (authenticated and unauthenticated) r…
-
Unscored —
A buffer overflow vulnerability in the control protocol of Disk Savvy Enterprise v10.4.18 allows remote attackers to ex…
-
Unscored —
An issue was discovered in Icinga 2.x through 2.8.1. By editing the init.conf file, Icinga 2 can be run as root. Follow…
-
Unscored —
An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an attacker can cause a NUL…
-
Unscored —
An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can discl…
-
Medium 6.1
Apache James Hupa Webmail application Cross-site Scripting Vulnerabilities
Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. An attacker could send a carefully crafted email to a user of Hupa which would trigger a XSS when the email was opened or when a list of…
-
Unscored —
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 uses weaker than expected cryptographic algorithms that could …
-
Unscored —
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5 and 5.0 is vulnerable to cross-site scripting. This vulnerabil…
-
Unscored —
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to e…
-
Unscored —
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not require that users should have strong passwords by de…
-
Unscored —
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other produc…
-
Unscored —
In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal.
-
Unscored —
File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Su…
-
Unscored —
Cross-site scripting (XSS) vulnerability in User Profile in Synology Surveillance Station before 8.1.2-5469 allows remo…
-
Unscored —
An XSS issue was discovered in Designer Studio in Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1, an…
-
High 7.5
Apache Geode unsafe deserialization of application objects
In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized. A user with DATA:WRITE access to the cluster may be able to cause remote code…
-
Critical 9.8
Apache Geode unsafe deserialization in TcpServer
In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the Geode locator, they may be able to cause remote code execution if certain classes are present on the…
-
Unscored —
The __oom_reap_task_mm function in mm/oom_kill.c in the Linux kernel before 4.14.4 mishandles gather operations, which …
-
Unscored —CVE-2018-4915 EPSS 15%
An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier version…
-
Unscored —CVE-2018-4892 EPSS 12%
An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier version…
-
Unscored —CVE-2018-4872 EPSS 12%
An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier version…
-
Unscored —CVE-2018-4898 EPSS 15%
An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier version…