Archive
February 2018
Vulnerabilities first published in this month (UTC), newest first.
1,330 results · Feed
-
Unscored —CVE-2018-6004 Public exploit
SQL Injection exists in the File Download Tracker 3.0 component for Joomla! via the dynfield[phone] or sess parameter.
-
Unscored —
SQL Injection exists in the Google Map Landkarten through 4.2.3 component for Joomla! via the cid or id parameter in a …
-
Unscored —CVE-2018-6005 Public exploit
SQL Injection exists in the Realpin through 1.5.04 component for Joomla! via the pinboard parameter.
-
Unscored —CVE-2018-6368 Public exploit
SQL Injection exists in the JomEstate PRO through 3.7 component for Joomla! via the id parameter in a task=detailed act…
-
Unscored —CVE-2018-5980 Public exploit
SQL Injection exists in the Solidres 2.5.1 component for Joomla! via the direction parameter in a hub.search action.
-
Unscored —CVE-2018-5993 Public exploit
SQL Injection exists in the Aist through 2.0 component for Joomla! via the id parameter in a view=showvacancy request.
-
Unscored —CVE-2018-5971 Public exploit
SQL Injection exists in the MediaLibrary Free 4.0.12 component for Joomla! via the id parameter or the mid array parame…
-
Unscored —CVE-2018-5981 Public exploit
SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.
-
Unscored —CVE-2018-5982 Public exploit
SQL Injection exists in the Advertisement Board 3.1.0 component for Joomla! via a task=show_rss_categories&catname= req…
-
Unscored —CVE-2018-5983 Public exploit
SQL Injection exists in the JquickContact 1.3.2.2.1 component for Joomla! via a task=refresh&sid= request.
-
Unscored —CVE-2018-5992 Public exploit
SQL Injection exists in the Staff Master through 1.0 RC 1 component for Joomla! via the name parameter in a view=staff …
-
Unscored —CVE-2018-5991 Public exploit
SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats r…
-
Unscored —CVE-2018-5987 Public exploit
SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id paramet…
-
Unscored —CVE-2018-5975 Public exploit
SQL Injection exists in the Smart Shoutbox 3.0.0 component for Joomla! via the shoutauthor parameter to the archive URI.
-
Unscored —CVE-2018-5974 Public exploit
SQL Injection exists in the SimpleCalendar 3.1.9 component for Joomla! via the catid array parameter.
-
Unscored —CVE-2018-5970 Public exploit
SQL Injection exists in the JGive 2.0.9 component for Joomla! via the filter_org_ind_type or campaign_countries paramet…
-
Unscored —CVE-2018-5989 Public exploit
SQL Injection exists in the ccNewsletter 2.x component for Joomla! via the id parameter in a task=removeSubscriber acti…
-
Unscored —CVE-2018-5990 Public exploit
SQL Injection exists in the AllVideos Reloaded 1.2.x component for Joomla! via the divid parameter.
-
Unscored —CVE-2018-5994 Public exploit
SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or …
-
Unscored —
A DLL Hijacking vulnerability in Trend Micro's User-Mode Hooking Module (UMH) could allow an attacker to run arbitrary …
-
Unscored —CVE-2018-3609 EPSS 21%
A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could a…
-
Unscored —CVE-2018-1049 Public exploit
In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from k…
-
Unscored —
An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges…
-
Unscored —
The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) an…
-
Unscored —
The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 all…
-
Unscored —
Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allo…
-
Unscored —
Untrusted search path vulnerability in "FLET'S Azukeru Backup Tool" version 1.5.2.6 and earlier allows an attacker to g…
-
Unscored —
Untrusted search path vulnerability in FLET'S v4 / v6 address selection tool allows an attacker to gain privileges via …
-
Unscored —CVE-2018-7187 EPSS 63%
Remote command execution via "go get" command with "-insecure" option in cmd/go
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted …
-
Unscored —
A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attack…
-
Unscored —
core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerabi…
-
Unscored —
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerabil…
-
Unscored —CVE-2018-7176 Public exploit
FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add …
-
Unscored —
F-Secure Radar (on-premises) before 2018-02-15 has XSS via vectors involving the Tags parameter in the JSON request bod…
-
Unscored —
F-Secure Radar (on-premises) before 2018-02-15 has an Unvalidated Redirect via the ReturnUrl parameter that triggers up…
-
Unscored —
trixbox 2.8.0.4 has XSS via the PATH_INFO to /maint/index.php or /user/includes/language/langChooser.php.
-
Unscored —
trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter…
-
Unscored —
trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.ph…
-
Medium 5.3
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins …
-
Medium 5.3
Server-Side Request Forgery in Jenkins
An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response.