Archive
25 April 2018
Vulnerabilities first published on this day (UTC), newest first.
47 results · Feed
-
Unscored —
Heap-based buffer overflow vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing …
-
Unscored —
Processing specially crafted .pm3 files in Advantech WebAccess HMI Designer 2.1.7.32 and prior may cause the system to …
-
Unscored —
Double free vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially craft…
-
Medium 5.5
Moderate severity vulnerability that affects org.apache.tika:tika-core
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.
-
Medium 5.5
org.apache.tika:tika-parsers has an Infinite Loop vulnerability
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.
-
High 8.1
Command injection in org.apache.tika:tika-core
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a se…
-
Unscored —
NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enable…
-
Unscored —
There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going…
-
Unscored —
An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be e…
-
Unscored —
WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.
-
Unscored —
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earl…
-
Unscored —
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earl…
-
Unscored —
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earl…
-
Unscored —
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earl…
-
Unscored —
The TPM on Integrated Management Module II (IMM2) on IBM Flex System x222 servers with firmware 1.00 through 3.56 allow…
-
Unscored —
Integrated Management Module II (IMM2) on IBM Flex System, NeXtScale, System x3xxx, and System x iDataPlex systems migh…
-
Unscored —
The installation process in IBM Security Key Lifecycle Manager 2.5 stores unencrypted credentials, which might allow lo…
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is improper authorization leading to creati…
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is XSS in invitation mail received from a d…
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is improper authorization when listing the …
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. Enumeration of users is possible through the pass…
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is anonymous reflected XSS on the error pag…
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. An attacker can exploit Missing Authorization on …
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS on the file or folder downloa…
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS via the optional message fiel…
-
Unscored —
This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration…
-
Unscored —
This module enables you to monitor and manage any number of remote Drupal sites and aggregate useful information for ad…
-
Unscored —
The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands vi…
-
Unscored —
IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vu…
-
Unscored —
In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signa…
-
Unscored —
IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vu…
-
Unscored —
The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an au…
-
Unscored —
Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017 do not restrict or limit the number of correctly form…
-
Unscored —
Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient inform…
-
High 8.0
glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthent…
-
Unscored —
GitLab Community and Enterprise Editions version 8.3 up to 10.x before 10.3 are vulnerable to SSRF in the Services and …
-
Unscored —
An integer overflow in the transferProxy function of a smart contract implementation for SmartMesh (aka SMT), an Ethere…
-
Unscored —
An issue was discovered in WUZHI CMS 4.1.0. The content-management feature has Stored XSS via the title or content sect…
-
Unscored —
An issue was discovered in WUZHI CMS 4.1.0. The "Extension Module -> System Announcement" feature has Stored XSS via an…
-
Unscored —
process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based bu…