Archive
April 2018
Vulnerabilities first published in this month (UTC), newest first.
1,670 results · Feed
-
Unscored —
Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & T…
-
Unscored —CVE-2018-10576 Public exploit
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Improper authentic…
-
Unscored —CVE-2018-10575 Public exploit
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Hardcoded credenti…
-
Unscored —
BigTree before 4.2.22 has XSS in the Users management page via the name or company field.
-
Unscored —
Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers. A …
-
Unscored —
In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Applianc…
-
Unscored —
site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary P…
-
Unscored —
A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of t…
-
Unscored —
The Norton Core router prior to v237 may be susceptible to a command injection exploit. This is a type of attack in whi…
-
Unscored —
An issue was discovered in MagniComp SysInfo before 10-H82 if setuid root (the default). This vulnerability allows any …
-
Unscored —
interface/patient_file/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access r…
-
Unscored —
Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject …
-
Unscored —
interface/fax/fax_dispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access rest…
-
Unscored —
Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field.
-
Unscored —
The Milestone XProtect Video Management Software (Corporate, Expert, Professional+, Express+, Essential+) 2016 R1 (10.0…
-
Unscored —
Delta PMSoft versions 2.10 and prior have multiple stack-based buffer overflow vulnerabilities where a .ppm file can in…
-
Unscored —
Certain 802.11 network management messages have been determined to invoke wireless access point blacklisting security d…
-
Unscored —
Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN …
-
Unscored —
RCS module in Huawei ALP-AL00B smart phones with software versions earlier than 8.0.0.129, BLA-AL00B smart phones with …
-
Unscored —
IBM API Connect 5.0.0.0 through 5.0.8.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Unscored —
IBM API Connect 5.0.0.0 through 5.0.8.2 is impacted by generated LoopBack APIs for a Model using the BelongsTo/HasMany …
-
Unscored —
Huawei DP300 V500R002C00, RP200 V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00,…
-
Unscored —
Huawei MBB (Mobile Broadband) products E5771h-937 with the versions before E5771h-937TCPU-V200R001B328D62SP00C1133 and …
-
Unscored —
Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier …
-
Unscored —
Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any signed-in user through …
-
Low 3.7
389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config…
-
Unscored —
In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants t…
-
Unscored —
An issue was discovered in Nagios XI 5.4.13. There is XSS exploitable via CSRF in (1) the Schedule New Report screen vi…
-
Unscored —CVE-2018-10553 EPSS 38%
An issue was discovered in Nagios XI 5.4.13. A registered user is able to use directory traversal to read local files, …
-
Unscored —
An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpabl…
-
Unscored —
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exif_re…
-
Unscored —
An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7…
-
Unscored —
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. ext/lda…
-
Unscored —CVE-2018-10546 Public exploit
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infi…
-
Unscored —CVE-2018-9845 EPSS 13%
Etherpad Lite before 1.6.4 is exploitable for admin access.
-
Unscored —
The _bfd_XX_bfd_copy_private_bfd_data_common function in peXXigen.c in the Binary File Descriptor (BFD) library (aka li…
-
Unscored —
An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows wri…
-
Unscored —
An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64H…
-
Unscored —
An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHea…
-
Unscored —
The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GN…