Archive
February 2018
Vulnerabilities first published in this month (UTC), newest first.
1,330 results · Feed
-
Unscored —
fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tm…
-
Unscored —
The memory resource controller (aka memcg) in the Linux kernel allows local users to cause a denial of service (deadloc…
-
Unscored —
Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" com…
-
Unscored —
Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string w…
-
Unscored —
In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was no…
-
Medium 5.5
Tarball permission preservation in puppet
In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.
-
High 8.1
Apache juddi-client vulnerable to XML External Entity (XXE)
In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD t…
-
Unscored —
Cross Site Scripting (XSS) exists in the review section in PHP Scripts Mall Hot Scripts Clone Script Classified 3.1 via…
-
Unscored —
The OLEProperty class in ole/oleprop.cpp in libfpx 1.3.1-10, as used in ImageMagick 7.0.7-22 Q16 and other products, al…
-
Unscored —
IBM WebSphere Portal 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed …
-
Unscored —
IBM Security Guardium Database Activity Monitor 9.0, 9.1, and 9.5 could allow a local user with low privileges to view …
-
Unscored —
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to e…
-
Unscored —
VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which allows man-in-the-middle at…
-
Unscored —
An issue was discovered on VOBOT CLOCK before 0.99.30 devices. Cleartext HTTP is used to download a breakout program, a…
-
Unscored —
An issue was discovered on VOBOT CLOCK before 0.99.30 devices. An SSH server exists with a hardcoded vobot account that…
-
Medium 5.9
Moderate severity vulnerability that affects org.apache.qpid:apache-qpid-broker-j
A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows unauthenticated atta…
-
Unscored —
In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, p…
-
Unscored —
Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticat…
-
Unscored —
The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU B…
-
Unscored —
In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function …
-
Unscored —
LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in …
-
Unscored —
In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can b…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers t…
-
Unscored —
The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Ser…
-
Critical 9.8
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted me…
KEV Nov 3, 2021 -
Unscored —CVE-2018-6180 Public exploit
A flaw in the profile section of Online Voting System 1.0 allows an unauthenticated user to set an arbitrary password f…
-
Unscored —
SBLIM Small Footprint CIM Broker (SFCB) 1.4.9 has a null pointer (DoS) vulnerability via a crafted POST request to the …
-
Unscored —
Nitro Pro 7.5.0.22 and earlier and Nitro Reader 2.5.0.36 and earlier allow remote attackers to execute arbitrary code v…
-
Unscored —
Nitro Pro 7.5.0.29 and earlier and Nitro Reader 2.5.0.45 and earlier allow remote attackers to execute arbitrary code v…
-
Unscored —
Use-after-free vulnerability in SumatraPDF Reader 2.x before 2.2.1 allows remote attackers to execute arbitrary code vi…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiGate UTM WAF appliances with FortiOS 4.3.x before …
-
Unscored —
IBM Sametime allows remote attackers to obtain sensitive information from the Sametime Log database via a direct reques…
-
Unscored —
IBM XIV Storage System 2810-A14 and 2812-A14 devices before level 10.2.4.e-2 and 2810-114 and 2812-114 devices before l…
-
Unscored —
Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted QT file.
-
Unscored —
Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted ASF file.
-
Unscored —
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory c…
-
Unscored —
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory c…
-
Unscored —
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory c…
-
Unscored —
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory c…
-
High 8.8
Borg Improper Access Control vulnerability
Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3.