Archive
February 2018
Vulnerabilities first published in this month (UTC), newest first.
1,330 results · Feed
-
Unscored —
SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.
-
Unscored —
A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenti…
-
Unscored —
A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could al…
-
Unscored —
A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacke…
-
Unscored —
A vulnerability in the User Provisioning tab in the Cisco Prime Collaboration Provisioning Tool could allow an unauthen…
-
Unscored —
A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send uns…
-
Unscored —
A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Co…
-
Unscored —
A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Soft…
-
Unscored —
A vulnerability in Cisco Jabber Client Framework (JCF) could allow an unauthenticated, remote attacker to conduct a cro…
-
Unscored —
A vulnerability in the web-based interface of Cisco Prime Service Catalog could allow an unauthenticated, remote attack…
-
Unscored —
A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, re…
-
Unscored —
A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypas…
-
Unscored —
A vulnerability in the Interactive Voice Response (IVR) management connection interface for Cisco Unified Customer Voic…
-
Unscored —
A vulnerability in Cisco Jabber Client Framework (JCF) could allow an authenticated, remote attacker to conduct a cross…
-
Unscored —
A vulnerability in the authentication functionality of the web-based service portal of Cisco Elastic Services Controlle…
-
Unscored —
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and C…
-
Unscored —
An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asteri…
-
Unscored —CVE-2018-7287 EPSS 11%
An issue was discovered in res_http_websocket.c in Asterisk 15.x through 15.2.1. If the HTTP server is enabled (default…
-
Unscored —
A NULL pointer access issue was discovered in Asterisk 15.x through 15.2.1. The RTP support in Asterisk maintains its o…
-
Unscored —
CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme.…
-
High 8.8
PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged …
-
Unscored —CVE-2018-6936 Public exploit
Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account.
-
Unscored —
A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote user…
-
Unscored —
IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Tr…
-
Unscored —
IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra…
-
Unscored —
IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…
-
Unscored —
This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration…
-
Unscored —
Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE …
-
Unscored —
MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts.
-
Unscored —
The Calendar component in Tiki 17.1 allows HTML injection.
-
Medium 5.4
Tiki Wiki CMS XSS Vulnerability
Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS.
-
Unscored —
This module enables you to drag and drop or paste images into CKEditor. The module does not sufficiently verify users p…
-
Unscored —CVE-2018-7289 Public exploit
An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames con…
-
Medium —
Moderate severity vulnerability that affects org.keycloak:keycloak-core
It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading t…
-
Unscored —
This security advisory fixes multiple vulnerabilities in both Drupal 7 and Drupal 8. See below for a list. #### Comment…
-
Unscored —
SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote a…
-
Unscored —
The eap_pwd_process function in eap_server/eap_server_pwd.c in hostapd 2.x before 2.6 does not validate that the reasse…
-
Unscored —
The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6 does not validate that the reassemb…
-
Unscored —
The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6, when EAP-pwd is e…
-
Medium 5.4
radiant vulnerable to Cross-site Scripting
There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4. They affect Personal Preferences (Name and Username) and Configuration (Site Title, Dev Site Domain, Page Parts, and Page Fields).