Skip to content
OpenAdvisories

Archive

13 March 2018

Vulnerabilities first published on this day (UTC), newest first.

← February 2018 2018 / March /13 April 2018 →
  1. 153
  2. 246
  3. 3 
  4. 412
  5. 551
  6. 658
  7. 724
  8. 859
  9. 9104
  10. 104
  11. 115
  12. 1247
  13. 1372
  14. 14144
  15. 1553
  16. 1642
  17. 173
  18. 189
  19. 1930
  20. 2061
  21. 2132
  22. 2267
  23. 2329
  24. 2413
  25. 2535
  26. 2651
  27. 2766
  28. 2856
  29. 2933
  30. 3071
  31. 319
All Critical High Medium Low Exploited only Public exploit

72 results · Feed

  • Unscored —
    CVE-2018-1000126

    Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in use…

    ajenti-panel PyPI
  • Unscored —
    CVE-2018-1000125

    inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains…

  • Unscored —
    CVE-2018-1000124

    I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of impor…

  • Unscored —
    CVE-2018-1000127

    memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in …

    memcached memcached Debian Ubuntu
  • Unscored —
    CVE-2018-1000123

    Ionic Team Cordova plugin iOS Keychain version before commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf contains an Infor…

  • Unscored —
    CVE-2018-1227

    Pivotal Concourse after 2018-03-05 might allow remote attackers to have an unspecified impact, if a customer obtained t…

  • Unscored —
    CVE-2018-7405

    Cross-site scripting (XSS) in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to i…

  • Unscored —
    CVE-2017-16251

    A vulnerability in the conferencing component of Mitel ST 14.2, release GA28 and earlier, could allow an authenticated …

  • Unscored —
    CVE-2017-16250

    A vulnerability in Mitel ST 14.2, release GA28 and earlier, could allow an attacker to use the API function to enumerat…

  • Critical 9.8
    CVE-2018-7750 Public exploit EPSS 27%

    Paramiko not properly checking authentication before processing other requests

    transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed b…

    paramiko paramiko paramiko py3-paramiko Debian Ubuntu Alpine PyPI
  • Unscored —
    CVE-2017-17442

    In BlackBerry UEM Management Console version 12.7.1 and earlier, a reflected cross-site scripting vulnerability that co…

    BlackBerry UEM Management Console
  • Unscored —
    CVE-2018-6299

    Authentication bypass in Hanwha Techwin Smartcams

    Hanwha Techwin Hanwha Techwin Smartcams
  • Unscored —
    CVE-2018-6300

    Remote password change in Hanwha Techwin Smartcams

    Hanwha Techwin Hanwha Techwin Smartcams
  • Unscored —
    CVE-2018-6302

    Denial of service by blocking of new camera registration on the cloud server in Hanwha Techwin Smartcams

    Hanwha Techwin Hanwha Techwin Smartcams
  • Unscored —
    CVE-2018-6294

    Unsecured way of firmware update in Hanwha Techwin Smartcams

    Hanwha Techwin Hanwha Techwin Smartcams
  • Unscored —
    CVE-2018-6298

    Remote code execution in Hanwha Techwin Smartcams

    Hanwha Techwin Hanwha Techwin Smartcams
  • Unscored —
    CVE-2018-6305

    Denial of service in Gemalto's Sentinel LDK RTE version before 7.65

    Gemalto Gemalto's Sentinel LDK RTE
  • Unscored —
    CVE-2018-6295

    Unencrypted way of remote control and communications in Hanwha Techwin Smartcams

    Hanwha Techwin Hanwha Techwin Smartcams
  • Unscored —
    CVE-2018-6301

    Arbitrary camera access and monitoring via cloud in Hanwha Techwin Smartcams

    Hanwha Techwin Hanwha Techwin Smartcams
  • Unscored —
    CVE-2018-6303

    Denial of service by uploading malformed firmware in Hanwha Techwin Smartcams

    Hanwha Techwin Hanwha Techwin Smartcams
  • Unscored —
    CVE-2018-6304

    Stack overflow in custom XML-parser in Gemalto's Sentinel LDK RTE version before 7.65 leads to remote denial of service

    Gemalto Gemalto's Sentinel LDK RTE
  • Unscored —
    CVE-2018-6296

    An undocumented (hidden) capability for switching the web interface in Hanwha Techwin Smartcams

    Hanwha Techwin Hanwha Techwin Smartcams
  • Unscored —
    CVE-2018-6297

    Buffer overflow in Hanwha Techwin Smartcams

    Hanwha Techwin Hanwha Techwin Smartcams
  • High 7.1
    CVE-2017-1002102

    Kubernetes arbitrary file overwrite

    In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  • High 8.8
    CVE-2017-1002101 Public exploit EPSS 13%

    In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpat…

    Kubernetes Kubernetes kubernetes Debian
  • Unscored —
    CVE-2018-1050

    All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is c…

    Samba Samba samba samba Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2018-1057 EPSS 10%

    On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to mod…

    Samba Samba samba samba Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2018-1000085

    ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_…

    clamav clamav clamav Debian Ubuntu Alpine
  • High 7.5
    CVE-2018-1000075

    RubyGems Infinite Loop vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ru…

    ruby2.3 jruby ruby2.0 ruby1.9.1 Debian Ubuntu Maven RubyGems
  • Critical 9.8
    CVE-2018-1000076

    RubyGems Improper Verification of Cryptographic Signature vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerab…

    ruby2.3 jruby ruby2.0 rubygems Debian Ubuntu Maven RubyGems
  • Medium 6.1
    CVE-2018-1000088

    Doorkeeper is vulnerable to stored XSS and code execution

    Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will exec…

    doorkeeper ruby-doorkeeper ruby-doorkeeper Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2018-1000078

    RubyGems Cross-site Scripting vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server di…

    ruby2.3 jruby ruby2.0 ruby1.9.1 Debian Ubuntu Maven RubyGems
  • Unscored —
    CVE-2018-1000091

    KadNode version version 2.2.0 contains a Buffer Overflow vulnerability in Arguments when starting up the binary that ca…

  • Unscored —
    CVE-2018-1000087

    WolfCMS version version 0.8.3.1 contains a Reflected Cross Site Scripting vulnerability in "Create New File" and "Creat…

  • Unscored —
    CVE-2018-1000090

    textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denia…

  • Unscored —
    CVE-2018-1000092

    CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page …

  • High 7.4
    CVE-2018-1000089

    django-anymail Includes Sensitive Information in Log Files

    Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be ex…

    django-anymail django-anymail Debian PyPI
  • Unscored —
    CVE-2018-1000084

    WOlfCMS WolfCMS version version 0.8.3.1 contains a Stored Cross-Site Scripting vulnerability in Layout Name (from Layou…

  • Unscored —
    CVE-2018-1000071

    roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in …

    roundcube roundcube Debian Ubuntu
  • Unscored —
    CVE-2018-1000072

    iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can re…