Archive
February 2018
Vulnerabilities first published in this month (UTC), newest first.
1,330 results · Feed
-
Unscored —
PHP Scripts Mall Multilanguage Real Estate MLM Script 3.0 has Stored XSS via every profile input field.
-
Unscored —
PHP Scripts Mall Doctor Search Script 1.0.2 has Stored XSS via an arbitrary profile field.
-
Unscored —CVE-2018-6574 Public exploit
Remote command execution via "go get" command with cgo in cmd/go
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.
-
Unscored —
This module enables you to show referenced entities in tabs. The module doesn't sufficiently sanitize the body fields o…
-
Unscored —
IBM Content Navigator 2.0 and 3.0 is vulnerable to Comma Separated Value (CSV) Injection. An attacker could exploit thi…
-
Unscored —
GSKit V7 may disclose side channel information via discrepancies between valid and invalid PKCS#1 padding. IBM X-Force …
-
Unscored —
IBM API Connect 5.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaS…
-
Unscored —
Cozy version 2 has XSS allowing remote attackers to obtain administrative access via JavaScript code in the url paramet…
-
Unscored —
Heap-based buffer overflow in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote attackers to c…
-
Unscored —
Use-after-free vulnerability in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote attackers to…
-
Unscored —
Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) vi…
-
Unscored —
Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) vi…
-
Unscored —
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to o…
-
Unscored —
IBM API Connect 5.0.7 and 5.0.8 could allow an authenticated remote user to modify query parameters to obtain sensitive…
-
Unscored —
/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks v…
-
Unscored —
The cnb_parse_lev function in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by lev…
-
Unscored —
ccn-lite-valid.c in CCN-lite before 2.00 allows context-dependent attackers to cause a denial of service (NULL pointer …
-
Unscored —
ccn-lite-ccnb2xml in CCN-lite before 2.0.0 allows context-dependent attackers to have unspecified impact via a crafted …
-
Unscored —
Multiple integer overflows in CCN-lite before 2.00 allow context-dependent attackers to have unspecified impact via vec…
-
Unscored —
Buffer overflow in util/ccnl-common.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified im…
-
Unscored —
ccnl_ccntlv_bytes2pkt in CCN-lite allows context-dependent attackers to cause a denial of service (application crash) v…
-
Unscored —
ccnl-ext-mgmt.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging mis…
-
Unscored —
Integer overflow in the ndn_parse_sequence function in CCN-lite before 2.00 allows context-dependent attackers to have …
-
Unscored —
CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact via vectors related to ssl_halen whe…
-
Unscored —
Memory leak in CCN-lite before 2.00 allows context-dependent attackers to cause a denial of service (memory consumption…
-
Unscored —
Buffer overflow in ccn-lite-ccnb2xml.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified i…
-
Unscored —
Memory leak in the ccnl_app_RX function in ccnl-uapi.c in CCN-lite before 2.00 allows context-dependent attackers to ca…
-
Unscored —
In the VPN client in Mailbutler Shimo before 4.1.5.1 on macOS, the com.feingeist.shimo.helper tool LaunchDaemon impleme…
-
Unscored —
In PureVPN 6.0.1 on macOS, HelperTool LaunchDaemon implements an unprotected XPC service that can be abused to execute …
-
Unscored —
An issue was discovered in OpenVMS through V8.4-2L2 on Alpha and through V8.4-2L1 on IA64, and VAX/VMS 4.0 and later. A…
-
Unscored —
Promise Technology WebPam Pro-E devices allow remote attackers to conduct XSS, HTTP Response Splitting, and CRLF Inject…
-
Unscored —
Marked 2 through 2.5.11 allows remote attackers to read arbitrary files via a crafted HTML document that triggers a red…
-
Unscored —
Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious s…
-
Unscored —
The AcquireCacheNexus function in magick/pixel_cache.c in GraphicsMagick before 1.3.28 allows remote attackers to cause…
-
Unscored —CVE-2018-6791 Public exploit
An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thu…
-
Unscored —
An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows…
-
Unscored —
Multiple SQL injection vulnerabilities in Saifor CVMS HUB 1.3.1 allow an authenticated user to execute arbitrary SQL co…
-
Unscored —
In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD)…
-
Unscored —
In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD)…
-
Unscored —
In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or …