Archive
February 2018
Vulnerabilities first published in this month (UTC), newest first.
1,330 results · Feed
-
Medium 5.3
Insight API transaction broadcast endpoint can result in Full Path Disclosure
Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request.
-
Unscored —CVE-2018-1000027 EPSS 13%
The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Derefere…
-
Unscored —
Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522…
-
Unscored —
The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointe…
-
Unscored —
An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service a…
-
Unscored —
Electrum Technologies GmbH Electrum Bitcoin Wallet version prior to version 3.0.5 contains a Missing Authorization vuln…
-
Unscored —
Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / P…
-
Unscored —
NASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library (Weather data) that can result i…
-
High 8.8
Arbitrary code execution due to incomplete sandbox protection in Pipeline: Supporting APIs Plugin
Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java deserialization like readResolve implemented in Pipeline scripts were not subject to sandbox protection, a…
-
Unscored —
Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnera…
-
Unscored —
A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of se…
-
Unscored —
Sean Barrett stb_vorbis version 1.12 and earlier contains a Buffer Overflow vulnerability in All vorbis decoding paths.…
-
High 8.3
Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin
Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or deni…
-
Unscored —
ValidFormBuilder version 4.5.4 contains a PHP Object Injection vulnerability in Valid Form unserialize method that can …
-
Unscored —CVE-2018-1000035 EPSS 30%
A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives …
-
Unscored —
LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Theme Uninstallation…
-
Unscored —
mcholste Enterprise Log Search and Archive (ELSA) version revision 1205, commit 2cc17f1 and earlier contains a Cross Si…
-
Unscored —
WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAc…
-
Unscored —
A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of se…
-
Unscored —
OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in fax_dispatch.php that can result in OS command i…
-
Unscored —
OpenEMR version 5.0.0 contains a Cross Site Scripting (XSS) vulnerability in open-flash-chart.swf and _posteddata.php t…
-
Unscored —
Security Onion Solutions Squert version 1.3.0 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Eleme…
-
Medium 5.4
Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code.
-
Unscored —
Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that ca…
-
Medium 6.1
Mautic Cross Site Scripting (XSS) vulnerability
Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code.
-
Medium 5.4
Cross site scripting in Croogo
Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript code.
-
Medium 5.4
Canvs Canvas XSS Vulnerability
Canvs Canvas version 3.4.2 contains a Cross Site Scripting (XSS) vulnerability in User's details that can result in denial of service and execution of javascript code.
-
Unscored —CVE-2015-1862 Public exploit
The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroo…
-
Unscored —
A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow …
-
Unscored —
A password hash usage authentication bypass vulnerability in Trend Micro Control Manager 6.0 could allow a remote attac…
-
Unscored —CVE-2018-3605 EPSS 20%
TopXXX, ViolationXXX, and IncidentXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro C…
-
Unscored —CVE-2018-3607 EPSS 14%
XXXTreeNode method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could a…
-
Unscored —
An AdHocQuery_Processor SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 coul…
-
Unscored —CVE-2018-3606 EPSS 49%
XXXStatusXXX, XXXSummary, TemplateXXX and XXXCompliance method SQL injection remote code execution (RCE) vulnerabilitie…
-
Unscored —
A CGGIServlet SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could allow a …
-
Unscored —CVE-2018-3604 EPSS 68%
GetXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could allow …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allo…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 2.x before 2.14.6 a…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Java number format exception handling in FortiGate FortiDB befor…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in FortiWeb before 4.4.4 allow remote attackers to inject arbitrary…