Archive
February 2018
Vulnerabilities first published in this month (UTC), newest first.
157 results · Clear filters · Feed
-
Unscored —
Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metachara…
-
Unscored —
Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbi…
-
Unscored —CVE-2018-6947 Public exploit
An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with No…
-
Unscored —CVE-2015-3898 Public exploit
Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to ar…
-
Medium 5.9
Apache Tomcat unauthorized access vulnerability
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This …
-
Unscored —
The Pictview image processing library embedded in the ActivePDF toolkit through 2018.1.0.18321 is prone to multiple out…
-
Unscored —CVE-2018-7477 Public exploit
SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents…
-
Unscored —
A buffer overflow vulnerability in the control protocol of Disk Savvy Enterprise v10.4.18 allows remote attackers to ex…
-
Unscored —
An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier version…
-
Unscored —
An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier version…
-
High 7.5
uWSGI Directory Traversal vulnerability
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
-
Unscored —CVE-2018-7250 Public exploit
An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 befo…
-
Unscored —CVE-2018-7249 Public exploit
An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 befo…
-
Unscored —
Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remot…
-
Unscored —
An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enu…
-
Critical 9.8
FasterXML jackson-databind allows unauthenticated remote code execution
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JS…
-
Unscored —CVE-2018-7466 Public exploit
install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging …
-
Medium 6.5
Apache Tomcat information exposure vulnerability
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to th…
-
Unscored —
Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupm…
-
Unscored —
SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerabi…
-
Unscored —CVE-2018-7316 Public exploit
Arbitrary File Upload exists in the Proclaim 9.1.1 component for Joomla! via a mediafileform action.
-
Unscored —CVE-2018-7318 Public exploit
SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, descri…
-
Unscored —CVE-2018-7317 Public exploit
Backup Download exists in the Proclaim 9.1.1 component for Joomla! via a direct request for a .sql file under backup/.
-
Unscored —
Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attacker…
-
Unscored —CVE-2018-7315 Public exploit
SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, cas…
-
Unscored —CVE-2018-7312 Public exploit
SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.
-
Unscored —
Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic …
-
Unscored —CVE-2018-7319 Public exploit
SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling_system1, heating_syste…
-
Unscored —CVE-2018-6890 Public exploit
Cross-site scripting (XSS) vulnerability in Wolf CMS 0.8.3.1 via the page editing feature, as demonstrated by /?/admin/…
-
Unscored —
SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.
-
Unscored —
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and C…
-
Unscored —
An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asteri…
-
Unscored —CVE-2018-6936 Public exploit
Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account.
-
Unscored —CVE-2018-7289 Public exploit
An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames con…
-
Unscored —CVE-2018-7273 Public exploit
In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables us…
-
Unscored —CVE-2017-6192 Public exploit
Buffer overflow in APNGDis 2.8 and earlier allows a remote attackers to cause denial of service and possibly execute ar…
-
Unscored —CVE-2017-6193 Public exploit
Buffer overflow in APNGDis 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute ar…
-
Unscored —CVE-2018-6941 Public exploit
A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remo…
-
Unscored —CVE-2018-6940 Public exploit
A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remot…
-
Unscored —
XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing …