Archive
March 2018
Vulnerabilities first published in this month (UTC), newest first.
133 results · Clear filters · Feed
-
High 7.2
High severity vulnerability that affects org.apache.syncope:syncope-core
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, includin…
-
Unscored —
Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could s…
-
Unscored —CVE-2017-8176 Public exploit
Huawei IPTV STB with earlier than IPTV STB V100R003C01LMYTa6SPC001 versions has an authentication bypass vulnerability.…
-
Unscored —CVE-2018-8811 Public exploit
Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allo…
-
Unscored —CVE-2018-8815 Public exploit
Cross-site scripting (XSS) vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to i…
-
Critical 9.8
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remo…
KEV Sep 8, 2022 -
Unscored —
Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attacke…
-
Unscored —CVE-2018-8732 Public exploit
Cross-site scripting (XSS) vulnerability in WampServer 3.1.1 allows remote attackers to inject arbitrary web script or …
-
Unscored —
In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the …
-
Unscored —
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to r…
-
Unscored —
Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, contr…
-
Unscored —CVE-2014-4613 Public exploit
Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attack…
-
Medium 5.5CVE-2018-1324 Public exploit
Apache Commons Compress vulnerable to denial of service due to infinite loop
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack ag…
-
Unscored —CVE-2018-6226 Public exploit
Reflected cross-site scripting (XSS) vulnerabilities in two Trend Micro Email Encryption Gateway 5.5 configuration file…
-
Unscored —
A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker…
-
Unscored —CVE-2018-6230 Public exploit
A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 search configuration script could allow an…
-
Unscored —CVE-2018-6225 Public exploit
An XML external entity injection (XXE) vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an authent…
-
Unscored —CVE-2018-6224 Public exploit
A lack of cross-site request forgery (CSRF) protection vulnerability in Trend Micro Email Encryption Gateway 5.5 could …
-
Unscored —CVE-2018-6227 Public exploit
A stored cross-site scripting (XSS) vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker t…
-
Unscored —
A missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could all…
-
Unscored —CVE-2018-6219 Public exploit
An Insecure Update via HTTP vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to eavesd…
-
Unscored —CVE-2018-6221 Public exploit
An unvalidated software update vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a man-in-the-middl…
-
Unscored —
A SQL injection vulnerability in a Trend Micro Email Encryption Gateway 5.5 policy script could allow an attacker to ex…
-
Unscored —CVE-2018-6220 Public exploit
An arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arb…
-
Unscored —CVE-2018-6222 Public exploit
Arbitrary logs location in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to change location of log f…
-
Unscored —CVE-2018-8729 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote …
-
Unscored —CVE-2018-7886 Public exploit
An issue was discovered in CloudMe 1.11.0. An unauthenticated local attacker that can connect to the "CloudMe Sync" cli…
-
Unscored —
SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend …
-
Unscored —CVE-2018-7707 Public exploit
Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbit…
-
Unscored —CVE-2018-7705 Public exploit
Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-ma…
-
Unscored —
RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TC…
-
Unscored —CVE-2018-7704 Public exploit
SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1…
-
Unscored —CVE-2018-7706 Public exploit
Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbi…
-
Unscored —CVE-2018-7703 Public exploit
Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbit…
-
Unscored —CVE-2018-7701 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attacker…
-
Unscored —
In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vuln…
-
Unscored —
The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function i…
-
Unscored —
It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, …
-
Unscored —
It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL …
-
Unscored —
ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows R…