Archive
April 2018
Vulnerabilities first published in this month (UTC), newest first.
1,670 results · Feed
-
High 8.8
In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 Windows/Linux, a crafted OpenDocument document can lead to …
-
High 8.8
In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 Windows/Linux, a crafted OpenDocument document can lead to …
-
Unscored —
Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versio…
-
Unscored —CVE-2018-7465 Public exploit
An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed b…
-
High 7.6
Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user insid…
-
Unscored —
In SpiderControl MicroBrowser Windows XP, Vista 7, 8 and 10, Versions 1.6.30.144 and prior, an uncontrolled search path…
-
High 7.7
ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power …
-
Unscored —
D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the System / Tr…
-
Unscored —
Cosmo 1.0.0Beta6 allows attackers to execute arbitrary PHP code via the Database Prefix field on the Database Info scre…
-
Unscored —
An issue was discovered in DiliCMS (aka DiligentCMS) 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox o…
-
Medium 6.5
puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform dire…
-
Medium 6.5
Improper Restriction of XML External Entity Reference in Apache uimaj
In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of vari…
-
Unscored —
An issue was discovered on EDIMAX IC-3140W through 3.06, IC-5150W through 3.09, and IC-6220DC through 3.06 devices. The…
-
Medium 4.8
IDM 4.6 Identity Applications information leakage
IDM 4.6 Identity Applications prior to 4.6.2.1 may expose sensitive information.
-
Low 2.8
NetIQ Identity Reporting XSS exposure
NetIQ Identity Reporting, in versions prior to 5.5 Service Pack 1, is susceptible to an XSS attack.
-
Unscored —
IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IB…
-
Unscored —CVE-2018-6518 Public exploit
Composr CMS 10.0.13 has XSS via the site_name parameter in a page=admin-setupwizard&type=step3 request to /adminzone/in…
-
Unscored —
IBM Security QRadar SIEM 7.2 and 7.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL…
-
Unscored —
IBM Security QRadar SIEM 7.2 and 7.3 could allow a remote attacker to traverse directories on the system. An attacker c…
-
Unscored —
IBM Security QRadar SIEM 7.2 and 7.3 could allow an unauthenticated user to execute code remotely with lower level priv…
-
Unscored —
IBM Security QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar…
-
Medium 4.8
GeniXCMS Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the Menu ID when adding a menu.
-
Unscored —
An issue was discovered in Shanghai 2345 Security Guard 3.7.0. 2345MPCSafe.exe, 2345SafeTray.exe, and 2345Speedup.exe a…
-
Unscored —
Centers for Disease Control and Prevention MicrobeTRACE 0.1.11 allows remote attackers to execute arbitrary code, relat…
-
Unscored —
Centers for Disease Control and Prevention MicrobeTRACE 0.1.12 allows remote attackers to execute arbitrary code, relat…
-
Unscored —
An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register U…
-
Unscored —
mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of t…
-
Unscored —
An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field.
-
Unscored —
mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remot…
-
Unscored —
bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.
-
Unscored —
mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field.
-
Unscored —
TunnelBear 3.2.0.6 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "TunnelBearMaintena…
-
Unscored —
Heap-based buffer overflow vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing …
-
Unscored —
Processing specially crafted .pm3 files in Advantech WebAccess HMI Designer 2.1.7.32 and prior may cause the system to …
-
Unscored —
Double free vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially craft…
-
Medium 5.5
Moderate severity vulnerability that affects org.apache.tika:tika-core
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.
-
Medium 5.5
org.apache.tika:tika-parsers has an Infinite Loop vulnerability
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.
-
High 8.1
Command injection in org.apache.tika:tika-core
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a se…
-
Unscored —
NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enable…
-
Unscored —
There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going…