Archive
February 2018
Vulnerabilities first published in this month (UTC), newest first.
1,330 results · Feed
-
Unscored —
The Ninja Forms plugin before 3.2.14 for WordPress has XSS.
-
Unscored —
The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechan…
-
Unscored —
IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 does not set the secure flag for th…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the My Reports component in IBM TRIRIGA Application Platform 3.3 before 3.3…
-
Unscored —
IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 might allow remote attackers to obt…
-
Unscored —
IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 allows remote authenticated users t…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3, 3.3.1, 3.3.2, and 3.4 allows r…
-
Unscored —
IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authentic…
-
Unscored —
XML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6 allows remote authenticated…
-
Unscored —
IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authentic…
-
Unscored —
The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon…
-
Unscored —
Race condition in the LoadBalancer module in the Atlassian Floodlight Controller before 1.2 allows remote attackers to …
-
Medium 5.4
phpMyAdmin Cross-site scripting (XSS) vulnerability in central columns feature
Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
-
Unscored —
An issue was discovered in Reprise License Manager 11.0. This vulnerability is a Path Traversal where the attacker, by …
-
Unscored —
The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 a…
-
Unscored —
This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL …
-
Unscored —
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-…
-
Unscored —
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-…
-
Unscored —
This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with…
-
Unscored —
An issue was discovered on Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) devices. Remote attackers can obtai…
-
Unscored —
An issue was discovered on RLE Wi-MGR/FDS-Wi 6.2 devices. Persistent XSS exists in the web server. Remote attackers can…
-
Unscored —
An issue was discovered on RLE Protocol Converter FDS-PC / FDS-PC-DP 2.1 devices. Persistent XSS exists in the web serv…
-
Medium 6.1
Yab Quarx persistent cross-site scripting vulnerability
Yab Quarx through 2.4.3 is prone to multiple persistent cross-site scripting vulnerabilities: Blog (Title), FAQ (Question), Pages (Title), Widgets (Name), and Menus (Name).
-
Unscored —
An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/config_db.php …
-
Unscored —CVE-2018-7273 Public exploit
In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables us…
-
Unscored —
The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain se…
-
Unscored —
OXID eShop Community Edition before 6.0.0 RC2 (development), 4.10.x before 4.10.5 (maintenance), and 4.9.x before 4.9.1…
-
Unscored —
OXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before 4.10.6 (maintenance), and 4.9.x before 4.9.1…
-
Unscored —
Shimmie 2 2.6.0 allows an attacker to upload a crafted SVG file that enables stored XSS.
-
Unscored —
Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before 17.10.2 are vulnerable to being forced, via a man-i…
-
Unscored —
Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnera…
-
Unscored —
The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denia…
-
Critical 9.8
MFSBGN03799 rev.1 - Micro Focus UCMDB, Remote Disclosure of Information
Remote Disclosure of Information in Micro Focus Universal CMDB Foundation Software, version numbers 10.10, 10.11, 10.20, 10.21, 10.22, 10.30, 10.31, 4.10, 4.11. This vulnerability could be remotely exploited to allow disclosure of information.
-
Unscored —
id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd numb…
-
Unscored —CVE-2015-6544 Scanner template
Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allow…
-
Unscored —
An Information Exposure issue was discovered in ABB netCADOPS Web Application Version 3.4 and prior, netCADOPS Web Appl…
-
Unscored —
In Knox SDS IAM (Identity Access Management) and EMM (Enterprise Mobility Management) 16.11 on Samsung mobile devices, …
-
Unscored —CVE-2017-6192 Public exploit
Buffer overflow in APNGDis 2.8 and earlier allows a remote attackers to cause denial of service and possibly execute ar…
-
Unscored —CVE-2017-6193 Public exploit
Buffer overflow in APNGDis 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute ar…
-
Unscored —
Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary o…