Archive
March 2018
Vulnerabilities first published in this month (UTC), newest first.
1,339 results · Feed
-
Unscored —
MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were …
-
Unscored —
Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL po…
-
Unscored —
Hashicorp vagrant-vmware-fusion 5.0.4 allows local users to steal root privileges if VMware Fusion is not installed.
-
Unscored —
It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5…
-
Unscored —
The vagrant update process in Hashicorp vagrant-vmware-fusion 5.0.2 through 5.0.4 allows local users to steal root priv…
-
Unscored —
Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access…
-
Unscored —
The on-demand plugin in IBM Endpoint Manager for Remote Control 9.0.1 and 9.1.0 allows user-assisted remote attackers t…
-
Unscored —
IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 makes it easier for man-in-the-middle attack…
-
Unscored —
The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveragi…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 In…
-
Unscored —
The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a…
-
Unscored —
The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by lever…
-
Unscored —
The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize meth…
-
Unscored —
The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method…
-
Unscored —
The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method …
-
Unscored —
Cross-site scripting (XSS) vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress…
-
Unscored —
The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote au…
-
Unscored —
The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveragi…
-
Unscored —
An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier. The attacker can rebo…
-
Unscored —
The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "if(pwd ==…
-
Unscored —
A vulnerability has been identified in TIM 1531 IRC (All versions < V1.1). A remote attacker with network access to por…
-
Unscored —
CA API Developer Portal 3.5 up to and including 3.5 CR6 has a reflected cross-site scripting vulnerability related to t…
-
Unscored —
CA API Developer Portal 3.5 up to and including 3.5 CR6 has a stored cross-site scripting vulnerability related to prof…
-
Unscored —
CA API Developer Portal 3.5 up to and including 3.5 CR5 has a reflected cross-site scripting vulnerability related to t…
-
Unscored —
Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows…
-
Unscored —
Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating sys…
-
Critical 9.8
Drupal Core Remote Code Execution Vulnerability
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
KEV Nov 3, 2021 -
Unscored —
An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and i…
-
Unscored —
WireMock before 2.16.0 contains a vulnerability that allows a remote unauthenticated attacker to access local files bey…
-
Unscored —
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a User Profile.
-
Unscored —
In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI.
-
Unscored —
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post.
-
Unscored —
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment.
-
High 7.5CVE-2018-0156 Exploited
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthentic…
KEV Mar 3, 2022 -
Unscored —
A vulnerability in the Zone-Based Firewall code of Cisco IOS XE Software could allow an unauthenticated, remote attacke…
-
Unscored —
A vulnerability in the Forwarding Information Base (FIB) code of Cisco IOS Software and Cisco IOS XE Software could all…
-
Unscored —
A vulnerability in the IP Version 4 (IPv4) processing code of Cisco IOS XE Software running on Cisco Catalyst 3850 and …
-
High 8.6CVE-2018-0158 Exploited
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software c…
KEV Mar 3, 2022 -
High 7.5CVE-2018-0154 Exploited
A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Softwa…
KEV Mar 3, 2022 -
Unscored —
A vulnerability in the Internet Group Management Protocol (IGMP) packet-processing functionality of Cisco IOS XE Softwa…