Archive
12 April 2018
Vulnerabilities first published on this day (UTC), newest first.
112 results · Feed
-
Unscored —
PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action.
-
Unscored —
Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature.
-
Unscored —
PHP Scripts Mall Image Sharing Script 1.3.3 has XSS via the Full Name field in an Edit Profile action.
-
Unscored —
PHP Scripts Mall Student Profile Management System Script v2.0.6 has XSS via the Name field to list_student.php.
-
Unscored —
PHP Scripts Mall Website Seller Script 2.0.3 uses the client side to enforce validation of an e-mail address, which all…
-
Unscored —
PHP Scripts Mall Website Broker Script 3.0.6 has XSS via the Last Name field on the My Profile page.
-
Unscored —
CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3.
-
Unscored —
PHP Scripts Mall Hot Scripts Clone Script Classified v3.1 uses the client side to enforce validation of an e-mail addre…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote a…
-
Unscored —
D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveragi…
-
Unscored —
D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveragi…
-
Unscored —
The remote administration UI in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to bypass …
-
Unscored —
Arista EOS before 4.20.2F allows remote BGP peers to cause a denial of service (Rib agent restart) via a malformed path…
-
Unscored —
WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approac…
-
Unscored —
IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.0 and 8.5.1 allows remote attackers to inj…
-
Unscored —
The web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices…
-
Unscored —
Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allow remote attackers to ga…
-
Unscored —
The remote administration interface in D-Link DIR-815 devices with firmware before 2.03.B02 allows remote attackers to …
-
Unscored —
CRLF injection vulnerability in the web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and Op…
-
High 8.8
A specially crafted PCX image processed via the application can lead to an out-of-bounds write, overwriting arbitrary d…
-
High 8.8
A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting
-
High 8.8
A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting arbitrary …
-
High 8.8
A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting arbitrary …
-
Unscored —CVE-2018-10063 Public exploit
The Convert Forms extension before 2.0.4 for Joomla! is vulnerable to Remote Command Execution using CSV Injection that…
-
Unscored —
windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a 0x953…
-
Unscored —
windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a 0x953…
-
Unscored —CVE-2018-10068 Public exploit
The jDownloads extension before 3.2.59 for Joomla! has XSS.
-
Unscored —
The hi3660_stub_clk_probe function in drivers/clk/hisilicon/clk-hi3660-stub.c in the Linux kernel before 4.16 allows lo…
-
Unscored —
joyplus-cms 1.6.0 has XSS in manager/admin_vod.php via the keyword parameter.
-
High 8.7
pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. Th…
-
High 7.5
corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.
-
Medium 4.3
pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd serv…
-
Unscored —
Cacti before 1.1.37 has XSS because the get_current_page function in lib/functions.php relies on $_SERVER['PHP_SELF'] i…
-
Unscored —
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_u…
-
Unscored —
Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENT_QUOTES flag (these calls oc…
-
Unscored —
rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (R…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the …
-
Unscored —CVE-2018-9155 Public exploit
Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary w…
-
Unscored —
The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute…