Archive
14 March 2018
Vulnerabilities first published on this day (UTC), newest first.
144 results · Feed
-
Unscored —
A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control o…
-
Unscored —
SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend …
-
Unscored —CVE-2018-7707 Public exploit
Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbit…
-
Unscored —CVE-2018-7705 Public exploit
Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-ma…
-
Unscored —
RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TC…
-
Unscored —CVE-2018-7704 Public exploit
SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1…
-
Unscored —CVE-2018-7706 Public exploit
Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbi…
-
Unscored —CVE-2018-7703 Public exploit
Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbit…
-
Unscored —CVE-2018-7701 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attacker…
-
Unscored —
In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vuln…
-
Unscored —
The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function i…
-
Unscored —
joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save…
-
Unscored —
It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, …
-
Unscored —
It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL …
-
Unscored —
Under certain conditions SAP Business Process Automation (BPA) By Redwood, 9.00, 9.10, allows an attacker to access inf…
-
High 7.6
In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more…
-
Medium 6.7
Under certain conditions SAP Business Client 6.5 allows an attacker to access information which would otherwise be rest…
-
Medium 6.1
Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inef…
-
Medium 5.4
In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console (CMC) do…
-
Medium 5.4
SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrus…
-
Medium 4.3
SAP Business Process Automation (BPA) By Redwood, 9.0, 9.1, allows an attacker to exploit insufficient validation of pa…
-
Unscored —
A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordP…
-
Unscored —
An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is …
-
Unscored —
A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for Word…
-
Unscored —
A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker …
-
Critical 9.8CVE-2018-1000120 EPSS 12%
curl FTP path confusion leads to NIL byte out of bounds write
A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.
-
Unscored —
A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an atta…
-
Unscored —
A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Cross-site scripting may …
-
Unscored —
An Information Exposure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The server response header a…
-
Unscored —
An Improper Input Validation issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated u…
-
Unscored —
An Incorrect Default Permissions issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Insecure defa…
-
Unscored —
A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. P…
-
Unscored —
A Protection Mechanism Failure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The X-XSS-Protection …
-
Unscored —
A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenti…
-
Unscored —
Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information fr…
-
Unscored —
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Serve…
-
Unscored —
Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted…
-
Unscored —
The Cryptography Next Generation (CNG) kernel-mode driver (cng.sys) in Windows 10 Gold, 1511, 1607, 1703, and 1709. Win…
-
Unscored —
ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows R…
-
Unscored —CVE-2018-0876 EPSS 16%
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to…