Archive
March 2018
Vulnerabilities first published in this month (UTC), newest first.
1,339 results · Feed
-
Unscored —
Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project impo…
-
Unscored —
Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in …
-
Unscored —
Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component r…
-
Unscored —
Gitlab Community and Enterprise Editions version 10.1, 10.2, and 10.2.4 are vulnerable to a SQL injection in the Milest…
-
Unscored —
Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulti…
-
Unscored —
Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsCon…
-
Unscored —
Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through…
-
Unscored —
Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project s…
-
Unscored —
Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component…
-
Unscored —
Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService …
-
Unscored —
Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resul…
-
Unscored —
Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the labels component resulting in …
-
Critical 9.8
Yii SQL injection vulnerability
The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne() or findAll() call, unless a developer recognizes an undocumented need to sanitize array input.
-
High 8.1
Yii Framework Code Injection
Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension.
-
Critical 9.8
yii2-redis Potential Remote code execution
Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension.
-
Unscored —
This module enables you to retrieve image metadata and use them in fields or title. The module doesn't sufficiently res…
-
Unscored —
This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration…
-
Unscored —
fs/f2fs/segment.c in the Linux kernel before 4.13 allows local users to cause a denial of service (NULL pointer derefer…
-
Low 3.1
NetIQ eDirectory Denial of Service
Addresses denial of service attack to eDirectory versions prior to 9.1.
-
Medium 5.3
NetIQ iManager, versions prior to 3.1, reflected XSS issue
The administrative web interface in NetIQ iManager, versions prior to 3.1, are vulnerable to reflected cross site scripting.
-
Medium 5.9
iManager elevation of privilege
NetIQ iManager, versions prior to 3.1, under some circumstances could be susceptible to an elevation of privilege attack.
-
Low 3.1
NetIQ iManager Communication Downgrade Attack
Addresses potential communication downgrade attack in NetIQ iManager versions prior to 3.1
-
Unscored —
Netwide Assembler (NASM) 2.13.02rc2 has a heap-based buffer over-read in the function tokenize in asm/preproc.c, relate…
-
Unscored —
Netwide Assembler (NASM) 2.13.02rc2 has a buffer over-read in the parse_line function in asm/parser.c via uncontrolled …
-
Unscored —
Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a l…
-
Unscored —
In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or p…
-
Unscored —
In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or p…
-
Unscored —
In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or p…
-
Unscored —
In 2345 Security Guard 3.6, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD…
-
Unscored —
XML external entity (XXE) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows rem…
-
Unscored —
IBM Rational Collaborative Lifecycle Management (CLM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x befor…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows re…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows re…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows re…
-
Unscored —
enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack l…
-
Unscored —
Multiple buffer overflows in Core FTP Server before 1.2 build 508 allow local users to gain privileges via vectors rela…
-
Unscored —
Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which makes it easier for remote attack…
-
Unscored —CVE-2014-1665 Public exploit
Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary…
-
Unscored —
SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execu…
-
Unscored —
The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to cond…