Skip to content
OpenAdvisories

Archive

7 March 2018

Vulnerabilities first published on this day (UTC), newest first.

← February 2018 2018 / March /7 April 2018 →
  1. 153
  2. 246
  3. 3 
  4. 412
  5. 551
  6. 658
  7. 724
  8. 859
  9. 9104
  10. 104
  11. 115
  12. 1247
  13. 1372
  14. 14144
  15. 1553
  16. 1642
  17. 173
  18. 189
  19. 1930
  20. 2061
  21. 2132
  22. 2267
  23. 2329
  24. 2413
  25. 2535
  26. 2651
  27. 2766
  28. 2856
  29. 2933
  30. 3071
  31. 319
All Critical High Medium Low Exploited only Public exploit

24 results · Feed

  • Critical 9.8
    CVE-2018-7753

    Bleach URI Scheme Restriction Bypass

    An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed …

    bleach python-bleach python-bleach Debian Ubuntu PyPI
  • Unscored —
    CVE-2018-7752

    GPAC through 0.7.1 has a Buffer Overflow in the gf_media_avc_read_sps function in media_tools/av_parsers.c, a different…

    gpac gpac Debian Ubuntu
  • Low 2.8
    CVE-2018-7675

    Potential Information Disclosure in Sentinel

    In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log out but does go idle for a period of time. This in turn causes the interface to timeout so that it req…

    NetIQ Sentinel
  • High 7.5
    CVE-2017-12174

    Uncontrolled Resource Consumption in Artemis and HornetQ

    It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryEr…

    Red Hat HornetQ/Artemis org.apache.activemq:artemis-native org.hornetq:hornetq-server Maven
  • Unscored —
    CVE-2018-7565

    CSRF exists on Polycom QDX 6000 devices.

  • Unscored —
    CVE-2018-7204

    inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /…

  • Unscored —
    CVE-2018-7564

    Stored XSS exists on Polycom QDX 6000 devices.

  • Critical 9.8
    CVE-2017-15367 Public exploit EPSS 23%

    Bacula-web SQL Injection Vulnerabilities

    Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server.

    bacula-web/bacula-web Packagist
  • Unscored —
    CVE-2018-5452

    A Stack-based Buffer Overflow issue was discovered in Emerson Process Management ControlWave Micro Process Automation C…

  • Unscored —
    CVE-2018-7745 Public exploit EPSS 12%

    An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/install/ins…

  • Unscored —
    CVE-2018-7746 Public exploit

    An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/manage/chan…

  • Unscored —
    CVE-2018-7473

    Open redirect vulnerability in the SO Connect SO WIFI hotspot web interface, prior to version 140, allows remote attack…

  • Unscored —
    CVE-2014-8780

    Cross-site scripting (XSS) vulnerability in Jease 2.11 allows remote authenticated users to inject arbitrary web script…

  • Unscored —
    CVE-2014-5044

    Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of s…

    gcc-arm-none-eabi gcc-mingw-w64 gcc-4.7-armhf-cross gcc-4.7 Ubuntu
  • High 8.8
    CVE-2018-1000118

    Electron protocol handler browser vulnerable to Command Injection

    Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their brow…

    electron npm
  • Unscored —
    CVE-2018-1000117 Public exploit

    Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in …

  • Medium 5.9
    CVE-2018-1000119

    rack-protection gem timing attack vulnerability when validating CSRF token

    Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby applicat…

    rack-protection ruby-rack-protection Ubuntu RubyGems
  • Unscored —
    CVE-2018-1000116

    NET-SNMP version 5.7.2 contains a heap corruption vulnerability in the UDP protocol handler that can result in command …

    net-snmp net-snmp Debian Ubuntu
  • Unscored —
    CVE-2018-1054

    An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all v…

    Red Hat 389-ds-base 389-ds-base 389-ds-base Debian Ubuntu
  • Unscored —
    CVE-2018-7741

    Eramba e1.0.6.033 has Reflected XSS in the Date Filter via the created parameter to the /crons URI.

  • Unscored —
    CVE-2018-7721

    Cross Site Scripting (XSS) exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.cla…

  • Unscored —
    CVE-2018-7740

    The resv_map_release function in mm/hugetlb.c in the Linux kernel through 4.15.7 allows local users to cause a denial o…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • Unscored —
    CVE-2018-7720

    A cross-site request forgery (CSRF) vulnerability exists in Western Bridge Cobub Razor 0.7.2 via /index.php?/user/creat…

  • Unscored —
    CVE-2017-18221

    The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of …

    linux-raspi2 linux-hwe linux-riscv linux-gcp Debian Ubuntu