Archive
February 2018
Vulnerabilities first published in this month (UTC), newest first.
1,330 results · Feed
-
Unscored —
A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-addres…
-
Unscored —
The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to c…
-
Unscored —
Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox back…
-
Unscored —
Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1.
-
Unscored —
WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1.
-
Unscored —
Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1.
-
Unscored —
Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1.
-
Critical 9.8
jackson-databind is vulnerable to a deserialization flaw
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
-
Critical 9.8
jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This i…
-
Unscored —
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote a…
-
Unscored —
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote a…
-
Unscored —
The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php.
-
Unscored —
Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories.
-
Unscored —
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote a…
-
Unscored —
In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-admini…
-
Unscored —
Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer…
-
Unscored —
NVIDIA libnvmmlite_audio.so contains an elevation of privilege vulnerability when running in media server which may cau…
-
Unscored —
In versions 13.0.0, 12.0.0-12.1.3, or 11.6.0-11.6.2, an F5 BIG-IP virtual server using the URL categorization feature m…
-
Unscored —
NVIDIA libnvmmlite_audio.so contains an elevation of privilege vulnerability when running in media server which may cau…
-
Unscored —
The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an '…
-
Unscored —
West Wind Web Server 6.x does not require authentication for /ADMIN.ASP.
-
Unscored —
In the uncurl_ws_accept function in uncurl.c in uncurl before 0.07, as used in Parsec before 140-3, insufficient Origin…
-
Unscored —CVE-2018-6609 Public exploit
SQL Injection exists in the JSP Tickets 1.1 component for Joomla! via the ticketcode parameter in a ticketlist edit act…
-
Unscored —CVE-2018-6610 Public exploit
Information Leakage exists in the jLike 1.0 component for Joomla! via a task=getUserByCommentId request.
-
Unscored —CVE-2018-6604 Public exploit
SQL Injection exists in the Zh YandexMap 6.2.1.0 component for Joomla! via the id parameter in a task=getPlacemarkDetai…
-
Unscored —
SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, ge…
-
Unscored —CVE-2018-6582 Public exploit
SQL Injection exists in the Zh GoogleMap 8.4.0.0 component for Joomla! via the id parameter in a getPlacemarkDetails, g…
-
Unscored —
In WatchDog Anti-Malware 2.74.186.150, the driver file (ZAMGUARD32.SYS) allows local users to cause a denial of service…
-
Unscored —
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a d…
-
Unscored —
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a d…
-
Unscored —
System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows re…
-
Unscored —
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a d…
-
Unscored —
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110009.sys) allows local users to cause a d…
-
Unscored —
In WatchDog Anti-Malware 2.74.186.150, the driver file (ZAMGUARD32.SYS) allows local users to cause a denial of service…
-
Unscored —
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a d…
-
Unscored —
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a d…
-
Unscored —
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a d…
-
Unscored —
OMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct request to the .html file…
-
Unscored —
A Stack-based Buffer Overflow issue was discovered in Fuji Electric V-Server VPR 4.0.1.0 and prior. The stack-based buf…
-
Unscored —
The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 …