Archive
March 2018
Vulnerabilities first published in this month (UTC), newest first.
102 results · Clear filters · Feed
-
Medium 5.3CVE-2018-9159 Public exploit
Moderate severity vulnerability that affects com.sparkjava:spark-core
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
-
Medium 6.1
rails-html-sanitizer Cross-site Scripting vulnerability
There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to…
-
Medium 5.4
IBM Financial Transaction Manager for Check Services for Multi-Platform 3.0, 3.0.2, and 3.0.2.1 is vulnerable to cross-…
-
Medium 5.4
IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr…
-
Medium 5.3
A specially crafted message could cause a denial of service in IBM WebSphere MQ 9.0, 9.0.0.1, 9.0.0.2, 9.0.1, 9.0.2, 9.…
-
Medium 4.0
IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system.…
-
Medium 4.3
Due to incorrect authorization in IBM Business Process Manager 8.6 an attacker can claim and work on ad hoc tasks he is…
-
Medium 5.4
IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr…
-
Medium 4.3
IBM Security Privileged Identity Manager 2.1.0 contains left-over, sensitive information in page comments. While this i…
-
Medium 6.3CVE-2018-0161 Exploited
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain mod…
KEV Mar 3, 2022 -
Medium 6.8CVE-2018-0179 Exploited
Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthent…
KEV Mar 3, 2022 -
Medium 6.8CVE-2018-0180 Exploited
Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthent…
KEV Mar 3, 2022 -
Medium 6.1
Cross-site Scripting in loofah
In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.
-
Medium 6.1
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Su…
KEV Apr 19, 2022 -
Medium 5.9CVE-2017-12319 Exploited
A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE S…
KEV Mar 3, 2022 -
Medium 5.1
NetIQ Identity Manager DoS Attack
The NetIQ Identity Manager communication channel, in versions prior to 4.7, is susceptible to a DoS attack.
-
Medium 5.3
NetIQ Identity Manager SSL Renegotiation
NetIQ Identity Manager driver, in versions prior to 4.7, allows for an SSL handshake renegotiation which could result in a MITM attack.
-
Medium 5.4
IBM MQ Appliance 9.0.1, 9.0.2, 9.0.3, amd 9.0.4 is vulnerable to cross-site scripting. This vulnerability allows users …
-
Medium 5.4
IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting…
-
Medium 5.4
IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting…
-
Medium 4.3
IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access se…
-
Medium 5.4
IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting…
-
Medium 4.3
IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to …
-
Medium 6.2
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) uses weaker than expected cryptographic algor…
-
Medium 6.2
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) contains several environment variables that a…
-
Medium 5.3
IBM Predictive Solutions Foundation (IBM Cognos Analytics 11.0) reveals sensitive information in detailed error message…
-
Medium 5.1
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 uses weaker than expected c…
-
Medium 5.3
IBM WebSphere Application Server 9 installations using Form Login could allow a remote attacker to conduct spoofing att…
-
Medium 6.1
Cross-site Scripting in Pivotal Spring Batch Admin
Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script that would be executed by other users. Th…
-
Medium 5.3
NetIQ iManager, versions prior to 3.1, reflected XSS issue
The administrative web interface in NetIQ iManager, versions prior to 3.1, are vulnerable to reflected cross site scripting.
-
Medium 5.9
iManager elevation of privilege
NetIQ iManager, versions prior to 3.1, under some circumstances could be susceptible to an elevation of privilege attack.
-
Medium 4.9
Exposure of Sensitive Information to an Unauthorized Actor in Apache syncope-cope
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.
-
Medium 6.5
A vulnerability has been identified in SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 41…
-
Medium 6.1
Grav CMS Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/tools.
-
Medium 5.9
Moderate severity vulnerability that affects org.springframework.boot:spring-boot
Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which a…
-
Medium 5.3
Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core
Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path …
-
Medium 5.5CVE-2018-1324 Public exploit
Apache Commons Compress vulnerable to denial of service due to infinite loop
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack ag…
-
Medium 6.7
Under certain conditions SAP Business Client 6.5 allows an attacker to access information which would otherwise be rest…
-
Medium 6.1
Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inef…
-
Medium 5.4
In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console (CMC) do…