Archive
April 2018
Vulnerabilities first published in this month (UTC), newest first.
1,670 results · Feed
-
Unscored —
An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be e…
-
Unscored —
WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.
-
Unscored —
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earl…
-
Unscored —
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earl…
-
Unscored —
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earl…
-
Unscored —
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earl…
-
Unscored —
The TPM on Integrated Management Module II (IMM2) on IBM Flex System x222 servers with firmware 1.00 through 3.56 allow…
-
Unscored —
Integrated Management Module II (IMM2) on IBM Flex System, NeXtScale, System x3xxx, and System x iDataPlex systems migh…
-
Unscored —
The installation process in IBM Security Key Lifecycle Manager 2.5 stores unencrypted credentials, which might allow lo…
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is improper authorization leading to creati…
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is XSS in invitation mail received from a d…
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is improper authorization when listing the …
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. Enumeration of users is possible through the pass…
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is anonymous reflected XSS on the error pag…
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. An attacker can exploit Missing Authorization on …
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS on the file or folder downloa…
-
Unscored —
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS via the optional message fiel…
-
Unscored —
This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration…
-
Unscored —
This module enables you to monitor and manage any number of remote Drupal sites and aggregate useful information for ad…
-
Unscored —
The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands vi…
-
Unscored —
IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vu…
-
Unscored —
In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signa…
-
Unscored —
IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vu…
-
Unscored —
The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an au…
-
Unscored —
Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017 do not restrict or limit the number of correctly form…
-
Unscored —
Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient inform…
-
High 8.0
glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthent…
-
Unscored —
GitLab Community and Enterprise Editions version 8.3 up to 10.x before 10.3 are vulnerable to SSRF in the Services and …
-
Unscored —
An integer overflow in the transferProxy function of a smart contract implementation for SmartMesh (aka SMT), an Ethere…
-
Unscored —
An issue was discovered in WUZHI CMS 4.1.0. The content-management feature has Stored XSS via the title or content sect…
-
Unscored —
An issue was discovered in WUZHI CMS 4.1.0. The "Extension Module -> System Announcement" feature has Stored XSS via an…
-
Unscored —
process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based bu…
-
Unscored —
EasyCMS 1.3 has XSS via the s POST parameter (aka a search box value) in an index.php?s=/index/search/index.html reques…
-
Medium 6.1CVE-2018-10366 Public exploit
User Plugin for October CSS Allows XSS
An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.
-
Unscored —
concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.…
-
Unscored —CVE-2018-10310 Public exploit
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Cons…
-
Unscored —
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized …
-
Unscored —
An issue was discovered in KTextEditor 5.34.0 through 5.45.0. Insecure handling of temporary files in the KTextEditor's…
-
Unscored —
An issue was discovered in phpLiteAdmin 1.9.5 through 1.9.7.1. Due to loose comparison with '==' instead of '===' in cl…
-
Unscored —
The Backup Server component in SAP Sybase ASE 15.7 before SP51 allows remote attackers to bypass access restrictions an…