Archive
March 2018
Vulnerabilities first published in this month (UTC), newest first.
133 results · Clear filters · Feed
-
Unscored —CVE-2018-8908 Public exploit
An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from C…
-
Medium 5.3CVE-2018-9159 Public exploit
Moderate severity vulnerability that affects com.sparkjava:spark-core
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
-
Critical 9.8
SiCKRAGE Discloses Plaintext Credentials
SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.
-
Unscored —
Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of …
-
Unscored —CVE-2018-7203 Public exploit
Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrar…
-
Unscored —CVE-2018-5708 Public exploit
An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthentica…
-
Critical 9.8
Drupal Core Remote Code Execution Vulnerability
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
KEV Nov 3, 2021 -
High 7.5
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthentic…
KEV Nov 3, 2021 -
Unscored —CVE-2018-8820 Public exploit
An issue was discovered in Square 9 GlobalForms 6.2.x. A Time Based SQL injection vulnerability in the "match" paramete…
-
Unscored —CVE-2018-9107 Public exploit
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcyMailing ext…
-
Unscored —CVE-2018-9106 Public exploit
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcySMS extensi…
-
Unscored —CVE-2018-9092 Public exploit
There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password.
-
High 8.0CVE-2018-8718 Public exploit
Cross-Site Request Forgery in Jenkins Mailer Plugin
Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.
-
Unscored —CVE-2018-0202 Public exploit
clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause…
-
Unscored —
An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Vers…
-
Unscored —
NTSServerSvc.exe in the server in Softros Network Time System 2.3.4 allows remote attackers to cause a denial of servic…
-
Unscored —CVE-2018-7543 Public exploit
Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 fo…
-
Unscored —CVE-2018-1186 Public exploit
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and ver…
-
Unscored —CVE-2018-1203 Public exploit
In Dell EMC Isilon OneFS, the compadmin is able to run tcpdump binary with root privileges. In versions between 8.1.0.0…
-
Unscored —CVE-2018-1204 Public exploit
Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, a…
-
Unscored —CVE-2018-1202 Public exploit
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and version 7.1.1.11 is a…
-
Unscored —CVE-2018-1188 Public exploit
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and versions 7.2.1.x is a…
-
Unscored —CVE-2018-1187 Public exploit
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6 is affected by a cross-sit…
-
Unscored —
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and ver…
-
Unscored —CVE-2018-1201 Public exploit
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and ver…
-
Unscored —CVE-2018-1213 Public exploit
Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, a…
-
Unscored —
In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a m…
-
Unscored —CVE-2018-8817 Public exploit
Wampserver before 3.1.3 has CSRF in add_vhost.php.
-
Unscored —CVE-2018-8979 Public exploit
Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the cr…
-
Unscored —CVE-2018-9010 Public exploit
Intelbras TELEFONE IP TIP200/200 LITE 60.0.75.29 devices allow remote authenticated admins to read arbitrary files via …
-
Unscored —
Acrolinx Server before 5.2.5 on Windows allows Directory Traversal.
-
High 7.5
Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0
rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.
-
Unscored —CVE-2018-8970 Public exploit
The int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c in LibreSSL 2.7.0 before 2.7.1 does not support …
-
Unscored —
Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visi…
-
Unscored —
Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execut…
-
Unscored —CVE-2018-1000140 Public exploit
rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificate…
-
Unscored —CVE-2018-8903 Public exploit
Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.
-
Unscored —CVE-2014-4912 Public exploit
An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation.
-
Unscored —CVE-2014-1665 Public exploit
Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary…
-
Medium 4.9
Exposure of Sensitive Information to an Unauthorized Actor in Apache syncope-cope
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.