Archive
March 2018
Vulnerabilities first published in this month (UTC), newest first.
1,339 results · Feed
-
Unscored —
Z-BlogPHP 1.5.1 Zero has CSRF in plugin_edit.php, resulting in the ability to execute arbitrary PHP code.
-
Unscored —CVE-2018-8908 Public exploit
An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from C…
-
Unscored —CVE-2018-9161 EPSS 57%
Prisma Industriale Checkweigher PrismaWEB 1.21 allows remote attackers to discover the hardcoded prisma password for th…
-
Unscored —
Contec Smart Home 4.15 devices do not require authentication for new_user.php, edit_user.php, delete_user.php, and user…
-
Unscored —
In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files,…
-
High 7.5
Docker Notary Signature Algorithm Not Matched to Key vulnerability
In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might (for example) be able to forge a signature by forcing a misin…
-
Medium 5.3CVE-2018-9159 Public exploit
Moderate severity vulnerability that affects com.sparkjava:spark-core
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
-
Critical 9.8
SiCKRAGE Discloses Plaintext Credentials
SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.
-
Unscored —
The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11 allows local use…
-
Unscored —
The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/se…
-
Unscored —
Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of …
-
Unscored —CVE-2018-7203 Public exploit
Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrar…
-
Unscored —
RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-b…
-
Unscored —
RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are affected by a cross-s…
-
Unscored —
RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list (…
-
Unscored —CVE-2018-5708 Public exploit
An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthentica…
-
Unscored —
SSRF (Server Side Request Forgery) in tpshop 2.0.5 and 2.0.6 allows remote attackers to obtain sensitive information, a…
-
Unscored —
libOmxVenc in Android for MSM, Firefox OS for MSM, and QRD Android copies the output buffer to an application with the …
-
Unscored —
In wma_peer_info_event_handler() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-03, the value o…
-
Unscored —
In msm_isp_prepare_v4l2_buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of …
-
Unscored —
Information leakage in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the audio driver.
-
Unscored —
Information leak of the ISPIF base address in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the cam…
-
Unscored —
In spectral_create_samp_msg() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-11, some values fr…
-
Unscored —
Due to a race condition in MDSS rotator in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-20, a do…
-
Unscored —
While processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB vendor command, in which attribute QCA_WLAN_VE…
-
Unscored —
In the video_ioctl2() function in the camera driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017…
-
Unscored —
The touchscreen driver synaptics_dsx in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-05, the siz…
-
Unscored —
When an atomic commit is issued on a writeback panel with a NULL output_layer parameter in Android for MSM, Firefox OS …
-
Unscored —
There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free…
-
Unscored —
While parsing Netlink attributes in QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_LOST_AP_SAMPLE_SIZE in qcacld 2.0…
-
Unscored —
The length of attribute value for STA_EXT_CAPABILITY in __wlan_hdd_change_station in Android for MSM, Firefox OS for MS…
-
Unscored —
While the IPA driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-31 is processing IOCTL comm…
-
Unscored —
In the function msm_pcm_hw_params() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-19, the retu…
-
Unscored —
In the function wma_unified_power_debug_stats_event_handler() in Android for MSM, Firefox OS for MSM, and QRD Android b…
-
Unscored —
In the handler for the ioctl command VIDIOC_MSM_ISP_DUAL_HW_LPM_MODE in Android for MSM, Firefox OS for MSM, and QRD An…
-
Unscored —
In the KGSL driver function _gpuobj_map_useraddr() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-…
-
Unscored —
While calling the IPA IOCTL handler for IPA_IOC_ADD_HDR_PROC_CTX in Android for MSM, Firefox OS for MSM, and QRD Androi…
-
Unscored —
In msm_ispif_config_stereo() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-21, the parameter p…
-
Unscored —
Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that…
-
Unscored —
The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 …