Archive
March 2018
Vulnerabilities first published in this month (UTC), newest first.
133 results · Clear filters · Feed
-
Low 3.1
Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windo…
-
Unscored —
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows S…
-
Unscored —CVE-2018-0894 Public exploit
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serv…
-
Unscored —
The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 …
-
High 7.5
ChakraCore RCE Vulnerability
ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE I…
-
Unscored —CVE-2018-0897 Public exploit
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serv…
-
Unscored —CVE-2018-0880 Public exploit
The Desktop Bridge in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an e…
-
Unscored —CVE-2018-0877 Public exploit
The Desktop Bridge Virtual File System (VFS) in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server…
-
Unscored —CVE-2018-0895 Public exploit
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serv…
-
High 7.5
ChakraCore RCE Vulnerability
ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE I…
-
Unscored —CVE-2018-0901 Public exploit
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serv…
-
Unscored —CVE-2018-0882 Public exploit
The Desktop Bridge in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an e…
-
Unscored —
A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14…
-
Unscored —CVE-2018-7474 Public exploit
An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" o…
-
Medium 6.1
Cross-site Scripting in Jolokia agent
An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
-
Unscored —CVE-2018-8108 Public exploit
The select component in bui through 2018-03-13 has XSS because it performs an escape operation on already-escaped text,…
-
Critical 9.8CVE-2018-8097 Public exploit
Eve allows execution of arbitrary code
io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter.
-
Unscored —
Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Nam…
-
Critical 9.8
Paramiko not properly checking authentication before processing other requests
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed b…
-
High 8.8
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpat…
-
Unscored —CVE-2018-8078 Public exploit
YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html.
-
Unscored —
CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows …
-
Unscored —CVE-2018-7538 Public exploit
A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 …
-
Unscored —
Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access…
-
Unscored —
An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. There is a user mode write access …
-
Unscored —
Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via an invalid channel_name parameter to /index.php?/m…
-
Unscored —
A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in …
-
Unscored —CVE-2018-7581 Public exploit
\ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has weak permissions (BUI…
-
Unscored —
WebLog Expert Web Server Enterprise 9.4 allows Remote Denial Of Service (daemon crash) via a long HTTP Accept Header to…
-
Unscored —CVE-2018-8002 Public exploit
In PoDoFo 0.9.5, there exists an infinite loop vulnerability in PdfParserObject::ParseFileComplete() in PdfParserObject…
-
Unscored —
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The p…
-
Unscored —CVE-2018-0208 Public exploit
A vulnerability in the web-based management interface of the (cloud based) Cisco Registered Envelope Service could allo…
-
Critical 9.8
Bacula-web SQL Injection Vulnerabilities
Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server.
-
Unscored —
An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/install/ins…
-
Unscored —CVE-2018-7746 Public exploit
An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/manage/chan…
-
Unscored —CVE-2018-1000117 Public exploit
Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in …
-
Unscored —
antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and…
-
Unscored —CVE-2018-7737 Public exploit
In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.p…
-
Unscored —CVE-2018-7736 Public exploit
In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter. NOTE: the s…
-
Unscored —
Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the tran…