Archive
17 April 2018
Vulnerabilities first published on this day (UTC), newest first.
31 results · Feed
-
Unscored —
A weakness in access controls in CENTUM CS 1000 all versions, CENTUM CS 3000 versions R3.09.50 and earlier, CENTUM CS 3…
-
Unscored —
In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_…
-
Unscored —
IPVanish 3.0.11 for macOS suffers from a root privilege escalation vulnerability. The `com.ipvanish.osx.vpnhelper` Laun…
-
Unscored —
On Appear TV XC5000 and XC5100 devices with firmware 3.26.217, it is possible to read OS files with a specially crafted…
-
Unscored —
An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a h…
-
Unscored —CVE-2018-6913 EPSS 11%
Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arb…
-
Unscored —
An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow,…
-
Unscored —
A vulnerability in London Trust Media Private Internet Access (PIA) VPN Client v77 for Windows could allow an unauthent…
-
Unscored —
In radare2 2.5.0, there is a heap-based buffer over-read in the dalvik_op function (libr/anal/p/anal_dalvik.c). Remote …
-
Unscored —
In radare2 2.5.0, there is a heap-based buffer over-read in the r_hex_bin2str function (libr/util/hex.c). Remote attack…
-
High 7.5
Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID
An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systema…
-
Critical 9.6
Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application…
-
Unscored —
Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet…
-
Unscored —
Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet…
-
Unscored —
Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet…
-
Unscored —
An issue was discovered in TuziCMS v2.0.6. There is a CSRF vulnerability that can add an admin account, as demonstrated…
-
Unscored —
Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted ser…
-
High 8.8
TIBCO JasperReports Library Code Sandboxing Problem
A vulnerability in the report scripting component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library Comm…
-
High 7.7
TIBCO JasperReports Server Information Disclosure Vulnerability
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics …
KEV Dec 29, 2022 -
Medium 6.3
TIBCO JasperReports Server Cross Site Scripting Vulnerability
The domain designer component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and A…
-
Unscored —
An IBM WebSphere MQ 8.0.0.8, 9.0.0.2, and 9.0.4 Client connecting to a MQ Queue Manager can cause a SIGSEGV in the AMQR…
-
Unscored —
IBM WebSphere Portal 8.0.0 through 8.0.0.1, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allo…
-
Unscored —
An issue was discovered in BigTree 4.2.22. There is cross-site scripting (XSS) in /core/inc/lib/less.php/test/index.php…
-
Unscored —
BMC Medical Luna CPAP Machines released prior to July 1, 2017, contain an improper input validation vulnerability which…
-
Unscored —CVE-2017-6020 Public exploit
Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.323…
-
Unscored —
Mitsubishi E-Designer, Version 7.52 Build 344 contains five code sections which may be exploited to overwrite the heap.…
-
Unscored —
Mitsubishi E-Designer, Version 7.52 Build 344 contains two code sections which may be exploited to allow an attacker to…
-
Unscored —
Mitsubishi E-Designer, Version 7.52 Build 344 contains six code sections which may be exploited to overwrite the stack.…
-
Unscored —
PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accoun…
-
Unscored —
The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inj…
-
Unscored —
The FromDocToPDF extension before 13.611.13.2303 for Chrome allows remote attackers to discover visited web sites via v…