Archive
February 2018
Vulnerabilities first published in this month (UTC), newest first.
1,330 results · Feed
-
Unscored —
Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupm…
-
Unscored —
LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle…
-
Unscored —
Cross-site scripting vulnerability in FS010W firmware FS010W_00_V1.3.0 and earlier allows an attacker to inject arbitra…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in FS010W firmware FS010W_00_V1.3.0 and earlier allows an attacker to h…
-
Unscored —
The MP4Atom class in mp4atom.cpp in MP4v2 through 2.0.0 mishandles Entry Number validation for the MP4 Table Property, …
-
Unscored —
Cross Site Scripting (XSS) exists in PHP Scripts Mall Learning and Examination Management System Script 2.3.1 via a cra…
-
Unscored —
Cross Site Scripting (XSS) exists in PHP Scripts Mall Alibaba Clone Script 1.0.2 via a profile parameter.
-
Unscored —
Cross Site Scripting (XSS) exists in PHP Scripts Mall Slickdeals / DealNews / Groupon Clone Script 3.0.2 via a User Pro…
-
Unscored —
An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function allows command injection via a $(comm…
-
Unscored —
An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function does not block '/' characters in the …
-
Unscored —
Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or h…
-
Critical 9.8
AppFormix: Debug Shell Command Execution in AppFormix Agent
A malicious user with unrestricted access to the AppFormix application management platform may be able to access a Python debug console and execute system commands with root privilege. The AppFormix Agent exposes the debug console on a host where AppFormix Ag…
-
High 8.1
MFSBGN03798 rev.1 - Micro Focus Universal CMDB, Apache Struts Instance
Arbitrary Code Execution vulnerability in Micro Focus Universal CMDB, version 4.10, 4.11, 4.12. This vulnerability could be remotely exploited to allow Arbitrary Code Execution.
-
Unscored —
XML External Entity (XXE) vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vuln…
-
Unscored —
Remote Code Execution in the addon installation process in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows authenticat…
-
Unscored —
In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are d…
-
Unscored —
SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerabi…
-
Unscored —
Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allow…
-
Unscored —CVE-2018-7316 Public exploit
Arbitrary File Upload exists in the Proclaim 9.1.1 component for Joomla! via a mediafileform action.
-
Unscored —
eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. This can be exploited by sendi…
-
Unscored —CVE-2018-7318 Public exploit
SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, descri…
-
Unscored —CVE-2018-7317 Public exploit
Backup Download exists in the Proclaim 9.1.1 component for Joomla! via a direct request for a .sql file under backup/.
-
Unscored —
Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attacker…
-
Unscored —CVE-2018-7315 Public exploit
SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, cas…
-
Unscored —CVE-2018-7312 Public exploit
SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.
-
Unscored —
Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic …
-
Unscored —CVE-2018-7319 Public exploit
SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling_system1, heating_syste…
-
Unscored —
IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user…
-
Unscored —
IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user…
-
High 8.1
Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code …
-
Unscored —
IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to SQL injection. A remote attacker could send specially-crafted …
-
Unscored —
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra…
-
Unscored —CVE-2018-6890 Public exploit
Cross-site scripting (XSS) vulnerability in Wolf CMS 0.8.3.1 via the page editing feature, as demonstrated by /?/admin/…
-
Unscored —
In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.
-
High 7.8
Incorrect Permission Assignment for Critical Resource in NPM
An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow lo…
-
Unscored —
SQL injection vulnerability in users/signup.php in the "signup" component in HamayeshNegar CMS allows a remote attacker…
-
Unscored —
In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authoriz…
-
Unscored —
In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user …
-
Unscored —
In version 1012 and prior of Insteon's Insteon Hub, the radio transmissions used for communication between the hub and …
-
Unscored —
fs/f2fs/extent_cache.c in the Linux kernel before 4.13 mishandles extent trees, which allows local users to cause a den…