Archive
April 2018
Vulnerabilities first published in this month (UTC), newest first.
142 results · Clear filters · Feed
-
Unscored —CVE-2018-10110 Public exploit
D-Link DIR-615 T1 devices allow XSS via the Add User feature.
-
Unscored —
A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/…
-
Unscored —CVE-2018-1088 Public exploit
A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster vo…
-
Unscored —CVE-2015-9222 Public exploit
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W…
-
Unscored —
SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacke…
-
Unscored —
A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an R…
-
Unscored —
Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execu…
-
Unscored —
Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an…
-
High 7.7
TIBCO JasperReports Server Information Disclosure Vulnerability
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics …
KEV Dec 29, 2022 -
Unscored —CVE-2017-6020 Public exploit
Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.323…
-
Unscored —
A vulnerability in MikroTik Version 6.41.4 could allow an unauthenticated remote attacker to exhaust all available CPU …
-
Unscored —CVE-2018-10118 Public exploit
Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages UR…
-
Unscored —CVE-2018-10109 Public exploit
Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload…
-
Unscored —CVE-2018-10097 Public exploit
XSS exists in Domain Trader 2.5.3 via the recoverlogin.php email_address parameter.
-
Unscored —
Absolute path traversal vulnerability in Eshtery CMS allows remote attackers to read arbitrary files via a full pathnam…
-
Unscored —
plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gamin…
-
Unscored —
Parameters injection in SyntaxHighlight results in multiple vulnerabilities
Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.
-
High 7.8CVE-2017-0358 Public exploit
ntfs-3g: Modprobe influence vulnerability via environment variables
Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.
-
Unscored —
On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Managem…
-
Unscored —CVE-2018-10063 Public exploit
The Convert Forms extension before 2.0.4 for Joomla! is vulnerable to Remote Command Execution using CSV Injection that…
-
Unscored —CVE-2018-10068 Public exploit
The jDownloads extension before 3.2.59 for Joomla! has XSS.
-
Unscored —CVE-2018-9155 Public exploit
Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary w…
-
Unscored —
The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute…
-
Unscored —
exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Direc…
-
Unscored —
CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by repla…
-
Unscored —CVE-2018-0970 Public exploit
An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve informati…
-
Unscored —CVE-2018-0969 Public exploit
An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve informati…
-
Unscored —CVE-2018-0974 Public exploit
An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve informati…
-
Unscored —CVE-2018-0975 Public exploit
An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve informati…
-
Unscored —CVE-2018-0966 Public exploit
A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security …
-
Unscored —CVE-2018-0971 Public exploit
An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve informati…
-
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
Unscored —CVE-2018-0972 Public exploit
An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve informati…
-
Unscored —CVE-2018-0973 Public exploit
An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve informati…
-
Unscored —CVE-2018-0968 Public exploit
An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve informati…
-
Unscored —
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedde…
-
Unscored —
A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle ob…
-
Critical 10.0
An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AW…
-
Unscored —CVE-2016-10258 Public exploit
Unrestricted file upload vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A…
-
Critical 9.8
Spring Data Commons remote code injection vulnerability
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can sup…
KEV Mar 25, 2022