Archive
March 2018
Vulnerabilities first published in this month (UTC), newest first.
1,339 results · Feed
-
Unscored —
The management panel in Piwigo 2.9.3 has stored XSS via the virtual_name parameter in a /admin.php?page=cat_list reques…
-
Unscored —
The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} r…
-
Unscored —
An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of …
-
Unscored —
An issue was discovered in ZZIPlib 0.13.68. An invalid memory address dereference was discovered in zzip_disk_fread in …
-
Unscored —
An issue was discovered in ZZIPlib 0.13.68. There is a memory leak triggered in the function zzip_mem_disk_new in memdi…
-
Unscored —
The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request. CSRF explo…
-
Unscored —
NVIDIA Security Engine contains a vulnerability in the RSA function where the keyslot read/write lock permissions are c…
-
Unscored —
NVIDIA TrustZone Software contains a TOCTOU issue in the DRM application which may lead to the denial of service or pos…
-
Unscored —
NVIDIA Security Engine contains a vulnerability in the Deterministic Random Bit Generator (DRBG) where the DRBG does no…
-
Unscored —
NVIDIA Tegra kernel driver contains a vulnerability in NVMAP where an attacker has the ability to write an arbitrary va…
-
Unscored —
NVIDIA TrustZone Software contains a vulnerability in the Keymaster implementation where the software reads data past t…
-
Unscored —
NVIDIA driver contains a possible out-of-bounds read vulnerability due to a leak which may lead to information disclosu…
-
Unscored —
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6…
-
Unscored —
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6…
-
High 8.8
Auth0-js bypasses CSRF checks
The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.
-
Unscored —
PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1 Application is vulnerable to stored XSS within the "Ad…
-
Unscored —
A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Dele…
-
Unscored —
The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to ca…
-
High 7.5
The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to ca…
-
Unscored —
PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privi…
-
Unscored —
PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privi…
-
Unscored —
The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to ca…
-
Unscored —
The htmlImageAddTitleAttribute function in sige.php in the Kubik-Rubik Simple Image Gallery Extended (SIGE) extension 3…
-
High 8.1
SimpleSAMLphp saml2 incorrect signature validation
HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This oc…
-
Unscored —
The ReadOneJNGImage and ReadJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 allow remote attackers to cause…
-
Unscored —
An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadOne…
-
Unscored —
CactusVPN through 6.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. T…
-
Unscored —
In drivers/net/ethernet/hisilicon/hns/hns_enet.c in the Linux kernel before 4.13, local users can cause a denial of ser…
-
Unscored —
An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web address parameters…
-
Unscored —
An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. The mydli…
-
Unscored —
PEM module of Huawei DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6…
-
Unscored —
Huawei Enjoy 5s and Y6 Pro smartphones with software the versions before TAG-AL00C92B170; the versions before TIT-L01C5…
-
Unscored —
SIP module in Huawei DP300 V500R002C00; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC400; V50…
-
Unscored —
Huawei VP9660 V500R002C10 has a uncontrolled format string vulnerability when the license module output the log informa…
-
Unscored —
PEM module of Huawei DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6…
-
Unscored —
Huawei S12700 V200R005C00; V200R006C00; V200R007C00; V200R007C01; V200R007C20; V200R008C00; V200R009C00;S1700 V200R006C…
-
Unscored —
Backup feature of SIP module in Huawei DP300 V500R002C00; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500…
-
Unscored —
XML parser in Huawei DP300 V500R002C00; RP200 V500R002C00SPC200; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C0…
-
Unscored —
SIP module in Huawei DP300 V500R002C00; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC400; V50…
-
Unscored —
Huawei VP9660 V500R002C10 has a null pointer reference vulnerability in license module due to insufficient verification…