Skip to content
OpenAdvisories

Archive

18 April 2018

Vulnerabilities first published on this day (UTC), newest first.

← March 2018 2018 / April /18 May 2018 →
  1. 18
  2. 225
  3. 3170
  4. 4163
  5. 557
  6. 614
  7. 710
  8. 85
  9. 914
  10. 1050
  11. 1188
  12. 12112
  13. 1346
  14. 148
  15. 157
  16. 1641
  17. 1731
  18. 18282
  19. 19200
  20. 2036
  21. 2110
  22. 2210
  23. 2327
  24. 2497
  25. 2547
  26. 2636
  27. 2729
  28. 283
  29. 2915
  30. 3029
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.1
    CVE-2018-1000162

    Cross-site Scripting in Parsedown

    Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to s…

    erusev/parsedown Packagist
  • Medium 6.1
    CVE-2018-1000160

    Cross-Site Scripting in @risingstack/protect

    RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in isXss() function in lib/rules/xss.js that can result in dangerous XSS strings being validated as safe. This attack appears to be exploitable via A number of X…

    @risingstack/protect npm
  • Medium 5.9
    CVE-2018-1000159

    tlslite-ng off-by-one error on mac checking

    tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ct_check_cbc_mac_and_pad(); line "…

    tlslite-ng tlslite-ng Ubuntu PyPI
  • Medium 6.1
    CVE-2018-1325

    Cross-site Scripting in wicket-jquery-ui

    In Apache wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display.

    Apache Software Foundation Wicket jQuery UI com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent Maven
  • Medium 6.1
    CVE-2018-8071

    XSS vulnerability in theme config file in Mautic

    Mautic before v2.13.0 has stored XSS via a theme config file.

    mautic/core Packagist
  • Medium 4.8
    CVE-2017-12196

    Incorrect Authorization in Undertow

    undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker t…

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven