Archive
12 March 2018
Vulnerabilities first published on this day (UTC), newest first.
47 results · Feed
-
Unscored —
Remedy Mid Tier in BMC Remedy AR System 9.1 allows XSS via the ATTKey parameter in an arsys/servlet/AttachServlet reque…
-
Unscored —CVE-2018-7538 Public exploit
A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 …
-
Unscored —
An issue was discovered in GLPI through 9.2.1. The application is affected by XSS in the query string to front/preferen…
-
Unscored —
A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary acc…
-
Unscored —
Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged …
-
Unscored —
BitDefender Total Security 2018 allows local users to gain privileges or cause a denial of service by impersonating all…
-
Unscored —
Unquoted Windows search path vulnerability in the srvInventoryWebServer service in 10-Strike Network Monitor 5.4 allows…
-
Unscored —
Unquoted Windows search path vulnerability in the panda_url_filtering service in Panda Global Protection 17.0.1 allows …
-
Unscored —
An issue was discovered in Hola 1.79.859. An unprivileged user could modify or overwrite the executable with arbitrary …
-
Unscored —
Panda Global Protection 17.0.1 allows local users to gain privileges or cause a denial of service by impersonating all …
-
Unscored —
Kingsoft WPS Office Free 10.2.0.5978 allows local users to gain privileges or cause a denial of service by impersonatin…
-
Unscored —
The Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for an XML External Entity…
-
Unscored —
IBM Security Guardium Database Activity Monitor 10 allows local users to have unspecified impact by leveraging administ…
-
Unscored —
IBM Security Guardium Database Activity Monitor 10 allows local users to obtain sensitive information by reading cached…
-
Unscored —
XML external entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog 11.3 before 11.3.1.2 and 11.5 …
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0.0 before SP2 EP29, 6.0.4 before 6.0…
-
Unscored —
The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE usin…
-
High 8.1
The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE usin…
-
Critical 9.8
AsyncSSH SSH Server Authentication Bypass
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
-
Unscored —
Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to…
-
Unscored —CVE-2018-1323 EPSS 46%
The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path …
-
Medium —
Moderate severity vulnerability that affects org.keycloak:keycloak-core
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete…
-
Unscored —
JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000…
-
High 7.5
Red Hat Wildfly DoS
Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill m…
-
High 8.1
hammer_cli_foreman Improper Certificate Validation vulnerability
Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.
-
Medium 5.9
keycloak-core vulnerable to timing attacks against JWS token verification
Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.
-
Unscored —
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation…
-
Unscored —
Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access…
-
Unscored —
curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-201…
-
Unscored —
NVIDIA libnvrm contains a possible out of bounds read due to a missing bounds check which could lead to local informati…
-
Unscored —
NVIDIA libnvomx contains a possible out of bounds write due to a improper input validation which could lead to local es…
-
Unscored —
NVIDIA libnvomx contains a possible out of bounds write due to a missing bounds check which could lead to local escalat…
-
Unscored —
NVIDIA libnvrm contains a possible out of bounds read due to a missing bounds check which could lead to local informati…
-
Unscored —
NVIDIA libnvrm contains a possible out of bounds read due to a missing bounds check which could lead to local informati…
-
Medium 6.1
Cross-site Scripting in wicket-jquery-ui
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.
-
Unscored —
QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI.
-
Unscored —
QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI.
-
Unscored —
The Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router, jabberd2-s2s, and jab…
-
Unscored —
The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which mig…
-
Unscored —
TitanHQ WebTitan Gateway has incorrect certificate validation for the TLS interception feature.