2 April 2018

25 results · Feed

• Unscored —
  CVE-2018-9230 EPSS 13%

  In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args fun…

  Apr 2, 2018
• Critical 9.8
  CVE-2018-1295

  Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization

  In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulne…

  Apache Software Foundation Apache Ignite org.apache.ignite:ignite-core Maven
  Apr 2, 2018
• Low 3.7
  CVE-2018-6659

  SB10228 ePO Reflected Cross-Site Scripting vulnerability

  Reflected Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows remote authenticated users to exploit an XSS issue via not sanitizing the user input.

  McAfee ePolicy Orchestrator (ePO)
  Apr 2, 2018
• Unscored —
  CVE-2018-9127

  Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as …

  botan botan botan Debian Ubuntu Alpine
  Apr 2, 2018
• Critical 10.0
  CVE-2016-8717

  An exploitable Use of Hard-coded Credentials vulnerability exists in the Moxa AWK-3131A Wireless Access Point running f…

  Talos Moxa
  Apr 2, 2018
• Unscored —
  CVE-2018-6252

  NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape where the…

  NVIDIA GPU Display Driver
  Apr 2, 2018
• Unscored —
  CVE-2018-6249

  NVIDIA GPU Display Driver contains a vulnerability in kernel mode layer handler where a NULL pointer dereference may le…

  NVIDIA GPU Display Driver nvidia-graphics-drivers-304 nvidia-graphics-drivers-340 Debian Ubuntu
  Apr 2, 2018
• Unscored —
  CVE-2018-6247

  NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiE…

  NVIDIA GPU Display Driver
  Apr 2, 2018
• Unscored —
  CVE-2018-6248

  NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape where the…

  NVIDIA GPU Display Driver
  Apr 2, 2018
• Unscored —
  CVE-2018-6250

  NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiE…

  NVIDIA GPU Display Driver
  Apr 2, 2018
• Unscored —
  CVE-2018-6253

  NVIDIA GPU Display Driver contains a vulnerability in the DirectX and OpenGL Usermode drivers where a specially crafted…

  NVIDIA GPU Display Driver nvidia-graphics-drivers-304 nvidia-graphics-drivers-340 Debian Ubuntu
  Apr 2, 2018
• Unscored —
  CVE-2018-6251

  NVIDIA Windows GPU Display Driver contains a vulnerability in the DirectX 10 Usermode driver, where a specially crafted…

  NVIDIA GPU Display Driver
  Apr 2, 2018
• Unscored —
  CVE-2018-9183 Public exploit

  The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS.

  Apr 2, 2018
• Unscored —
  CVE-2018-0194

  Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inj…

  iOS
  Apr 2, 2018
• Unscored —
  CVE-2018-1038 Public exploit

  The Windows kernel in Windows 7 SP1 and Windows Server 2008 R2 SP1 allows an elevation of privilege vulnerability due t…

  Microsoft Windows Windows
  Apr 2, 2018
• High 7.5
  CVE-2018-6661

  TS102801 True Key DLL Side-Loading vulnerability

  DLL Side-Loading vulnerability in Microsoft Windows Client in McAfee True Key before 4.20.110 allows local users to gain privilege elevation via not verifying a particular DLL file signature.

  McAfee True Key
  Apr 2, 2018
• Medium 6.2
  CVE-2018-6660

  SB10228 ePO Directory Traversal vulnerability

  Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when expo…

  McAfee ePolicy Orchestrator (ePO)
  Apr 2, 2018
• Unscored —
  CVE-2018-9163 Public exploit

  A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) al…

  Apr 2, 2018
• Unscored —
  CVE-2018-1093

  The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows attackers to cause …

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu
  Apr 2, 2018
• Unscored —
  CVE-2018-1095

  The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate…

  linux-raspi2 linux-hwe linux-azure linux-gcp Linux Debian Ubuntu
  Apr 2, 2018
• Unscored —
  CVE-2018-1092

  The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory w…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu
  Apr 2, 2018
• Unscored —
  CVE-2018-1094

  The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc3…

  linux-raspi2 linux-hwe linux-azure linux-gcp Linux Debian Ubuntu
  Apr 2, 2018
• Unscored —
  CVE-2018-9175

  DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect_m…

  Apr 2, 2018
• Unscored —
  CVE-2018-9174

  sys_verifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, …

  Apr 2, 2018
• Unscored —
  CVE-2018-9173 Public exploit

  Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows re…

  Apr 2, 2018