Archive
February 2018
Vulnerabilities first published in this month (UTC), newest first.
157 results · Clear filters · Feed
-
Unscored —CVE-2018-6845 Public exploit
PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field.
-
Unscored —
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe S…
-
Unscored —
Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the mine…
-
Unscored —CVE-2015-1862 Public exploit
The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroo…
-
Unscored —
LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in …
-
Critical 9.8
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted me…
KEV Nov 3, 2021 -
Unscored —CVE-2018-6180 Public exploit
A flaw in the profile section of Online Voting System 1.0 allows an unauthenticated user to set an arbitrary password f…
-
Unscored —CVE-2017-17417 Public exploit
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Back…
-
Low 3.6CVE-2018-1000030 Public exploit
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14…
-
Unscored —CVE-2017-15394 Public exploit
Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perfo…
-
Unscored —CVE-2017-5124 Public exploit
Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject…
-
Unscored —CVE-2018-6574 Public exploit
Remote command execution via "go get" command with cgo in cmd/go
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.
-
Unscored —
Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious s…
-
Unscored —CVE-2018-6791 Public exploit
An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thu…
-
High 7.8
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to…
KEV Nov 3, 2021 -
Unscored —CVE-2016-3957 Public exploit
The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information…
-
Unscored —
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the…
-
Critical 9.8
jackson-databind is vulnerable to a deserialization flaw
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
-
Unscored —CVE-2018-6609 Public exploit
SQL Injection exists in the JSP Tickets 1.1 component for Joomla! via the ticketcode parameter in a ticketlist edit act…
-
Unscored —CVE-2018-6610 Public exploit
Information Leakage exists in the jLike 1.0 component for Joomla! via a task=getUserByCommentId request.
-
Unscored —CVE-2018-6604 Public exploit
SQL Injection exists in the Zh YandexMap 6.2.1.0 component for Joomla! via the id parameter in a task=getPlacemarkDetai…
-
Unscored —
SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, ge…
-
Unscored —CVE-2018-6582 Public exploit
SQL Injection exists in the Zh GoogleMap 8.4.0.0 component for Joomla! via the id parameter in a getPlacemarkDetails, g…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote att…
-
Unscored —CVE-2018-6606 Public exploit
An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows…
-
Unscored —CVE-2018-6593 Public exploit
An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows…
-
Unscored —CVE-2018-1185 Public exploit
An issue was discovered in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.…
-
Unscored —
The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated format stri…
-
Unscored —CVE-2018-6578 Public exploit
SQL Injection exists in the JE PayperVideo 3.0.0 component for Joomla! via the usr_plan parameter in a view=myplans&tas…
-
Unscored —CVE-2018-6576 Public exploit
SQL Injection exists in Event Manager 1.0 via the event.php id parameter or the page.php slug parameter.
-
Unscored —CVE-2018-6579 Public exploit
SQL Injection exists in the JEXTN Reverse Auction 3.1.0 component for Joomla! via a view=products&uid= request.
-
Unscored —CVE-2018-6581 Public exploit
SQL Injection exists in the JMS Music 1.1.1 component for Joomla! via a search with the keyword, artist, or username pa…
-
Unscored —CVE-2018-6575 Public exploit
SQL Injection exists in the JEXTN Classified 1.0.0 component for Joomla! via a view=boutique&sid= request.
-
Unscored —CVE-2018-6577 Public exploit
SQL Injection exists in the JEXTN Membership 3.1.0 component for Joomla! via the usr_plan parameter in a view=myplans&t…
-
Unscored —
Arbitrary file upload exists in the Jimtawl 2.1.6 and 2.2.5 component for Joomla! via a view=upload&task=upload&pop=tru…
-
Unscored —CVE-2017-1000408 Public exploit
A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environm…
-
Unscored —CVE-2017-1000409 Public exploit
A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH enviro…