Archive
February 2018
Vulnerabilities first published in this month (UTC), newest first.
1,330 results · Feed
-
Medium 6.5
Moderate severity vulnerability that affects org.apache.karaf:apache-karaf
Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.
-
Unscored —
application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or addi…
-
Unscored —
IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the…
-
Unscored —
IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the…
-
Unscored —
IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the…
-
Medium 5.3
Converse.js Exposure of Sensitive Information
Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine whether safe publication of private data was configured or even intended. For example, users might have an expectation that …
-
Unscored —
Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0…
-
Unscored —
The print snippet resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 al…
-
Unscored —
The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 a…
-
Unscored —
An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST r…
-
Unscored —
An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in th…
-
Medium 6.5
Path Traversal in Apache Oozie
Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitiv…
-
Medium 6.5CVE-2018-5381 EPSS 30%
The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in…
-
Medium 4.3CVE-2018-5380 EPSS 15%
The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for …
-
High 7.1CVE-2018-5378 EPSS 74%
The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a pee…
-
High 7.5CVE-2018-5379 EPSS 38%
The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE mess…
-
Unscored —
Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attacker…
-
Unscored —CVE-2018-6024 Public exploit
SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.
-
Unscored —
In Bravo Tejari Procurement Portal, uploaded files are not properly validated by the application either on the client o…
-
Unscored —CVE-2018-7216 Public exploit
Cross-site request forgery (CSRF) vulnerability in esop/toolkit/profile/regData.do in Bravo Tejari Procurement Portal a…
-
Medium 5.3
Sinatra Path Traversal vulnerability
An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.
-
Unscored —
In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distribut…
-
Unscored —CVE-2018-7211 Public exploit
An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing…
-
Unscored —
An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct re…
-
Unscored —
An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct re…
-
High 8.8
JupyterHub OAuthenticator elevation of privilege
An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting for access control, group membership was not checked correctly, allowing members not in the wh…
-
Medium 6.1CVE-2018-7198 Public exploit
October CMS - RainLab Blog Plugin XSS
October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.
-
Unscored —CVE-2018-7197 Public exploit
An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthe…
-
Unscored —CVE-2018-7178 Public exploit
SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter.
-
Unscored —CVE-2018-7177 Public exploit
SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter.
-
Unscored —CVE-2018-7179 Public exploit
SQL Injection exists in the SquadManagement 1.0.3 component for Joomla! via the id parameter.
-
Unscored —CVE-2018-7180 Public exploit
SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter.
-
Unscored —
SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request.
-
Unscored —
SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter.
-
Unscored —CVE-2018-6394 Public exploit
SQL Injection exists in the InviteX 3.0.5 component for Joomla! via the invite_type parameter in a view=invites action.
-
Unscored —CVE-2018-6370 Public exploit
SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the (1) PATH_INFO or (2) name of a .html file unde…
-
Unscored —CVE-2018-6373 Public exploit
SQL Injection exists in the Fastball 2.5 component for Joomla! via the season parameter in a view=player action.
-
Unscored —CVE-2018-6584 Public exploit
SQL Injection exists in the DT Register 3.2.7 component for Joomla! via a task=edit&id= request.
-
Unscored —CVE-2018-6372 Public exploit
SQL Injection exists in the JB Bus 2.3 component for Joomla! via the order_number parameter.
-
Unscored —CVE-2018-6585 Public exploit
SQL Injection exists in the JTicketing 2.0.16 component for Joomla! via a view=events action with a filter_creator or f…