Archive
18 April 2018
Vulnerabilities first published on this day (UTC), newest first.
282 results · Feed
-
Unscored —
PureVPN 6.0.1 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "sevpnclient" service. When c…
-
Unscored —CVE-2018-10110 Public exploit
D-Link DIR-615 T1 devices allow XSS via the Add User feature.
-
Unscored —
The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.…
-
Unscored —
An improper authorization vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse ins…
-
Unscored —
A cleartext transmission of sensitive information vulnerability exists in Schneider Electric's 66074 MGE Network Manage…
-
Unscored —
An information disclosure vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse ins…
-
Unscored —
An authorization bypass vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC…
-
Unscored —
A vulnerability exists in the HTTP request parser in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantu…
-
Unscored —
A buffer overflow vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXN…
-
Unscored —
Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 contro…
-
Unscored —
A vulnerability exists in Schneider Electric's Modicon Quantum in all versions of the communication modules which could…
-
Unscored —
An authorization bypass vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse insta…
-
Unscored —
A vulnerability exists in the web services to process SOAP requests in Schneider Electric's Modicon M340, Modicon Premi…
-
Unscored —
Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR020…
-
Unscored —
A denial of service vulnerability exists in Schneider Electric's MiCOM Px4x (P540 range excluded) with legacy Ethernet …
-
Unscored —
A remote attacker could send a carefully crafted packet in InduSoft Web Studio v8.1 and prior versions, and/or InTouch …
-
Medium 6.1
Cross-site Scripting in Parsedown
Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to s…
-
Unscored —
Floodlight version 1.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in the web console that can resu…
-
Unscored —
cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in…
-
Medium 6.1
Cross-Site Scripting in @risingstack/protect
RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in isXss() function in lib/rules/xss.js that can result in dangerous XSS strings being validated as safe. This attack appears to be exploitable via A number of X…
-
High 7.5
Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers
gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. Th…
-
Medium 5.9
tlslite-ng off-by-one error on mac checking
tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ct_check_cbc_mac_and_pad(); line "…
-
High 7.5
LightSAML Incorrect Access Control vulnerability
LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been …
-
Unscored —
nmap version 6.49BETA6 through 7.60, up to and including SVN revision 37147 contains a Directory Traversal vulnerabilit…
-
High 7.8
OISF suricata-update unsafely deserializes YAML data
OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the following files: config.py:136, config.py:142, sources.py:99 and sources.py:131. The "list-sources"-command is affected b…
-
Medium 6.1
Cross-site Scripting in wicket-jquery-ui
In Apache wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display.
-
Unscored —
A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/…
-
Unscored —CVE-2018-1088 Public exploit
A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster vo…
-
High 7.5
Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation
Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests agains…
-
Unscored —
Dell EMC ViPR Controller, versions after 3.0.0.38, contain an information exposure vulnerability in the VRRP. VRRP defa…
-
Unscored —
Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions prior to v237, contain a b…
-
Unscored —
Pivotal Gemfire for PCF, versions 1.6.x prior to 1.6.5.0 and 1.7.x prior to 1.7.1.0, contain an information disclosure …
-
Unscored —
This module helps in exporting and importing Menu Items via the administrative interface. The module does not properly …
-
Unscored —
There is a buffer overflow in the Hikvision Camera DS-2CD9111-S of V4.1.2 build 160203 and before, and this vulnerabili…
-
Unscored —
In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilialize_co…
-
Unscored —
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and …
-
Unscored —
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and …
-
Unscored —
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MD…
-
Unscored —
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and …
-
Unscored —
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and …