Archive
April 2018
Vulnerabilities first published in this month (UTC), newest first.
1,670 results · Feed
-
Unscored —
The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbi…
-
Unscored —
The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of se…
-
Unscored —
The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users t…
-
Unscored —
Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote a…
-
Unscored —
The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local user…
-
Unscored —CVE-2018-10321 Public exploit
Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings.
-
Unscored —
app/tools/mac-lookup/index.php in phpIPAM 1.3.1 has Reflected XSS on /tools/mac-lookup/ via the mac parameter.
-
Unscored —CVE-2018-10309 Public exploit
The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS.
-
Unscored —
Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit snippet[name] parameter, aka Edit Snippet.
-
Unscored —
Netwide Assembler (NASM) 2.14rc0 has an endless while loop in the assemble_file function of asm/nasm.c because of a glo…
-
Unscored —CVE-2018-10311 Public exploit
A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbit…
-
Unscored —CVE-2018-10313 Public exploit
WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq_10%5D parameter to the /index.php?m=member&f=index&v=profile&se…
-
Unscored —CVE-2018-10312 Public exploit
index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member.
-
Unscored —
The MessageSearch2 function in PersonalMessage.php in Simple Machines Forum (SMF) before 2.0.15 does not properly use t…
-
Unscored —
Frog CMS 0.9.5 has XSS via the admin/?/layout/edit layout[name] parameter, aka Edit Layout.
-
Unscored —
Frog CMS 0.9.5 has XSS via the admin/?/page/edit page[keywords] parameter, aka Edit Page Metadata.
-
Unscored —
A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 allows remote attackers to execute arbitrary code…
-
Critical 9.8
SaltStack Salt allows compromised salt-minions to impersonate the salt-master
In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
-
High 8.1
MFSBGN03803 rev.1 - UCMDB, Installation File Access Control Privilege Escalation Vulnerability
Local Escalation of Privilege vulnerability to Micro Focus Universal CMDB, versions 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.00. The vulnerability could be remotely exploited to Local Escalation of Privilege.
-
High 7.1
puppet-tripleo before versions 5.5.0, 6.2.0 is vulnerable to an access-control flaw in the IPtables rules management, w…
-
Medium 5.3
ghostscript before version 9.21 is vulnerable to a heap based buffer overflow that was found in the ghostscript jbig2_d…
-
Unscored —
An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privil…
-
Unscored —
The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel version 3.4 and up to and including 4.15 h…
-
Unscored —
A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 allows remote attackers to execute arbitrary code…
-
Medium 6.5
curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good …
-
Unscored —
Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing t…
-
Unscored —
In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directo…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress …
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows r…
-
Medium 5.9
curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's imp…
-
Unscored —
OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest its…
-
Unscored —
A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4). Insufficient protection…
-
High 8.8
An exploitable use-after-free vulnerability exists in the JavaScript engine Foxit Software Foxit PDF Reader version 9.0…
-
High 8.8
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader versio…
-
Unscored —
The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site reque…
-
Unscored —
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "…
-
Unscored —
Cross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5.4.3, and their earlier…
-
Unscored —
IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2 is vulnerable to cross-site scripting. This vulnera…
-
Unscored —
IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized circumstances, could expose plai…
-
Unscored —
IBM Team Concert (RTC) 5.0, 5.0.1, 5.0.2, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, and 6.0.5 stores credentials for users using…