Archive

February 2018

Vulnerabilities first published in this month (UTC), newest first.

← January 2018 2018 / February March 2018 →

All Critical High Medium Low Exploited only Public exploit

157 results · Clear filters · Feed

Unscored —

CVE-2017-16356 Public exploit

Reflected XSS in Kubik-Rubik SIGE (aka Simple Image Gallery Extended) before 3.3.0 allows attackers to execute JavaScri…

Feb 20, 2018
Unscored —

CVE-2018-7254 Public exploit

The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-o…

wavpack wavpack Debian Alpine

Feb 19, 2018
Critical 9.8

CVE-2018-7251 Public exploit Scanner template EPSS 72%

Anchor CMS Logs Credentials

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.

anchorcms/anchor-cms Packagist

Feb 19, 2018
Unscored —

CVE-2017-7376 Public exploit EPSS 23%

Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port …

libxml2 libxml2 Debian Ubuntu

Feb 19, 2018
Unscored —

CVE-2018-6024 Public exploit

SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.

Feb 18, 2018
Unscored —

CVE-2018-7216 Public exploit

Cross-site request forgery (CSRF) vulnerability in esop/toolkit/profile/regData.do in Bravo Tejari Procurement Portal a…

Feb 18, 2018
Unscored —

CVE-2018-7211 Public exploit

An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing…

Feb 18, 2018
Medium 6.1

CVE-2018-7198 Public exploit

October CMS - RainLab Blog Plugin XSS

October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.

rainlab/blog-plugin Packagist

Feb 18, 2018
Unscored —

CVE-2018-7197 Public exploit

An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthe…

Feb 18, 2018
Unscored —

CVE-2018-7178 Public exploit

SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter.

Feb 17, 2018
Unscored —

CVE-2018-7177 Public exploit

SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter.

Feb 17, 2018
Unscored —

CVE-2018-7179 Public exploit

SQL Injection exists in the SquadManagement 1.0.3 component for Joomla! via the id parameter.

Feb 17, 2018
Unscored —

CVE-2018-7180 Public exploit

SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter.

Feb 17, 2018
Unscored —

CVE-2018-6583 Public exploit EPSS 19%

SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request.

Feb 17, 2018
Unscored —

CVE-2018-6006 Public exploit EPSS 19%

SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter.

Feb 17, 2018
Unscored —

CVE-2018-6394 Public exploit

SQL Injection exists in the InviteX 3.0.5 component for Joomla! via the invite_type parameter in a view=invites action.

Feb 17, 2018
Unscored —

CVE-2018-6370 Public exploit

SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the (1) PATH_INFO or (2) name of a .html file unde…

Feb 17, 2018
Unscored —

CVE-2018-6373 Public exploit

SQL Injection exists in the Fastball 2.5 component for Joomla! via the season parameter in a view=player action.

Feb 17, 2018
Unscored —

CVE-2018-6584 Public exploit

SQL Injection exists in the DT Register 3.2.7 component for Joomla! via a task=edit&id= request.

Feb 17, 2018
Unscored —

CVE-2018-6372 Public exploit

SQL Injection exists in the JB Bus 2.3 component for Joomla! via the order_number parameter.

Feb 17, 2018
Unscored —

CVE-2018-6585 Public exploit

SQL Injection exists in the JTicketing 2.0.16 component for Joomla! via a view=events action with a filter_creator or f…

Feb 17, 2018
Unscored —

CVE-2018-6004 Public exploit

SQL Injection exists in the File Download Tracker 3.0 component for Joomla! via the dynfield[phone] or sess parameter.

Feb 17, 2018
Unscored —

CVE-2018-6396 Public exploit EPSS 24%

SQL Injection exists in the Google Map Landkarten through 4.2.3 component for Joomla! via the cid or id parameter in a …

Feb 17, 2018
Unscored —

CVE-2018-6005 Public exploit

SQL Injection exists in the Realpin through 1.5.04 component for Joomla! via the pinboard parameter.

Feb 17, 2018
Unscored —

CVE-2018-6368 Public exploit

SQL Injection exists in the JomEstate PRO through 3.7 component for Joomla! via the id parameter in a task=detailed act…

Feb 17, 2018
Unscored —

CVE-2018-5980 Public exploit

SQL Injection exists in the Solidres 2.5.1 component for Joomla! via the direction parameter in a hub.search action.

Feb 17, 2018
Unscored —

CVE-2018-5993 Public exploit

SQL Injection exists in the Aist through 2.0 component for Joomla! via the id parameter in a view=showvacancy request.

Feb 17, 2018
Unscored —

CVE-2018-5971 Public exploit

SQL Injection exists in the MediaLibrary Free 4.0.12 component for Joomla! via the id parameter or the mid array parame…

Feb 17, 2018
Unscored —

CVE-2018-5981 Public exploit

SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.

Feb 17, 2018
Unscored —

CVE-2018-5982 Public exploit

SQL Injection exists in the Advertisement Board 3.1.0 component for Joomla! via a task=show_rss_categories&catname= req…

Feb 17, 2018
Unscored —

CVE-2018-5983 Public exploit

SQL Injection exists in the JquickContact 1.3.2.2.1 component for Joomla! via a task=refresh&sid= request.

Feb 17, 2018
Unscored —

CVE-2018-5992 Public exploit

SQL Injection exists in the Staff Master through 1.0 RC 1 component for Joomla! via the name parameter in a view=staff …

Feb 17, 2018
Unscored —

CVE-2018-5991 Public exploit

SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats r…

Feb 17, 2018
Unscored —

CVE-2018-5987 Public exploit

SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id paramet…

Feb 17, 2018
Unscored —

CVE-2018-5975 Public exploit

SQL Injection exists in the Smart Shoutbox 3.0.0 component for Joomla! via the shoutauthor parameter to the archive URI.

Feb 17, 2018
Unscored —

CVE-2018-5974 Public exploit

SQL Injection exists in the SimpleCalendar 3.1.9 component for Joomla! via the catid array parameter.

Feb 17, 2018
Unscored —

CVE-2018-5970 Public exploit

SQL Injection exists in the JGive 2.0.9 component for Joomla! via the filter_org_ind_type or campaign_countries paramet…

Feb 17, 2018
Unscored —

CVE-2018-5989 Public exploit

SQL Injection exists in the ccNewsletter 2.x component for Joomla! via the id parameter in a task=removeSubscriber acti…

Feb 17, 2018
Unscored —

CVE-2018-5990 Public exploit

SQL Injection exists in the AllVideos Reloaded 1.2.x component for Joomla! via the divid parameter.

Feb 17, 2018
Unscored —

CVE-2018-5994 Public exploit

SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or …

Feb 17, 2018