Archive
10 April 2018
Vulnerabilities first published on this day (UTC), newest first.
50 results · Feed
-
Unscored —
An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs i…
-
Unscored —
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR …
-
Unscored —
Editing restriction bypass for git revert
The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has been fixed in 3.20161229.
-
Medium 5.3
An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SD…
-
High 7.5
An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer…
-
Medium 5.3
An exploitable information disclosure vulnerability exists in the PCX image rendering functionality of Simple DirectMed…
-
Unscored —
YUNUCMS 1.0.7 has XSS via the content title on an admin/content/addcontent/cid/## page (aka a news center page).
-
Unscored —
ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() th…
-
Unscored —
ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that c…
-
Unscored —CVE-2018-8772 Public exploit
Coship RT3052 4.0.0.48 devices allow XSS via a crafted SSID field on the "Wireless Setting - Basic" screen.
-
Unscored —
Monstra CMS 3.0.4 allows remote code execution via an upload_file request for a .zip file, which is automatically extra…
-
Unscored —CVE-2018-9038 Public exploit
Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&delete_dir=./&path=upl…
-
Unscored —
libqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key but found non-name object" cases, allowing …
-
Unscored —
The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator.
-
Unscored —
IBM Security SiteProtector System 3.0, 3.1.0 and 3.1.1 allows remote attackers to bypass intended security restrictions…
-
Unscored —
IBM WebSphere MQ 7.5.x before 7.5.0.6 and 8.0.x before 8.0.0.3 allows remote authenticated users to obtain sensitive in…
-
Medium 5.4
SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cros…
-
Medium 5.4
Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise…
-
Medium 5.4
SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an…
-
Medium 4.3
SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation.
-
Medium 5.3
Unquoted windows search path (directory/path traversal) vulnerability in Crystal Reports Server, OEM Edition (CRSE), 4.…
-
High 7.3
Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Lau…
-
Medium 6.3
Improper session management when using SAP Cloud Platform 2.0 (Connectivity Service and Cloud Connector). Under certain…
-
Medium 5.4
SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in …
-
Low 3.8
SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in …
-
Unscored —
Heap-based buffer overflow in the JPEG2000 image tile decoder in OpenJPEG before 1.5.2 allows remote attackers to cause…
-
Unscored —
The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticat…
-
Unscored —
OpenDocMan 1.2.7 and earlier does not properly validate allowed actions, which allows remote authenticated users to byp…
-
Unscored —
The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gai…
-
Unscored —
The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticat…
-
Unscored —
The entity_access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users…
-
Unscored —
The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to …
-
Unscored —
The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge …
-
Unscored —
The backend in Open-Xchange (OX) AppSuite 7.4.2 before 7.4.2-rev9 allows remote attackers to obtain sensitive informati…
-
Unscored —
Stack-based buffer overflow in Dassault Systemes CATIA V5-6R2013 allows remote attackers to execute arbitrary code via …
-
Unscored —
SSRF (Server Side Request Forgery) in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers t…
-
Unscored —
SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffi…
-
Unscored —
Various administrative application link resources in Atlassian Application Links before version 5.4.4 allow remote atta…
-
Unscored —
Various administrative external system import resources in Atlassian JIRA Server (including JIRA Core) before version 7…
-
Unscored —
The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or J…