Archive
April 2018
Vulnerabilities first published in this month (UTC), newest first.
1,670 results · Feed
-
Unscored —
IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6 and 9.0.0 through 9.0.3.1 uses weaker than expected cryptog…
-
Unscored —
IBM WebSphere MQ 8.0 through 8.0.0.8 and 9.0 through 9.0.4 under special circumstances could allow an authenticated use…
-
Unscored —CVE-2018-10299 Public exploit
An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin (BEC), t…
-
Unscored —
Discuz! DiscuzX through X3.4 has reflected XSS via forum.php?mod=post&action=newthread because data/template/1_diy_port…
-
Unscored —
Discuz! DiscuzX through X3.4 has stored XSS via the portal.php?mod=portalcp&ac=article URI, related to mishandling of I…
-
Unscored —
SQL Injection exists in Kliqqi CMS 3.5.2 via the randkey parameter of a new story at the pligg/story.php?title= URI.
-
Unscored —
Kliqqi CMS 3.5.2 has XSS via a crafted group name in pligg/groups.php, a crafted Homepage string in a profile, or a cra…
-
Unscored —
ChemCMS v1.0.6 has CSRF by using public/admin/user/addpost.html to add an administrator account.
-
Unscored —
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter.
-
Unscored —CVE-2018-9245 Public exploit
The Ericsson-LG iPECS NMS A.1Ac login portal has a SQL injection vulnerability in the User ID and password fields that …
-
Unscored —CVE-2018-10286 Public exploit
The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and t…
-
Unscored —
The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since the app does not use an…
-
Unscored —
In MuPDF 1.13.0, there is an infinite loop in the fz_skip_space function of the pdf/pdf-xref.c file. A remote adversary…
-
Unscored —
ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a ce…
-
Unscored —
app/sections/user-menu.php in phpIPAM before 1.3.1 has XSS via the ip parameter.
-
Unscored —
Adaltech G-Ticket v70 EME104 has SQL Injection via the mobile-loja/mensagem.asp eve_cod parameter.
-
Unscored —
CliqueMania loja virtual 14 has SQL Injection via the patch/remote.php id parameter in a recomendar action.
-
Unscored —
An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the …
-
Unscored —
BEESCMS 4.0 has a CSRF vulnerability to add an administrator account via the admin/admin_admin.php?nav=list_admin_user&…
-
Unscored —
WTCMS 1.0 has a CSRF vulnerability to add an administrator account via the index.php?admin&m=user&a=add_post URI.
-
Unscored —
An issue was discovered in FastAdmin V1.0.0.20180417_beta. There is XSS via the application\api\controller\User.php ava…
-
Unscored —
Netwide Assembler (NASM) 2.13 has a stack-based buffer over-read in the disasm function of the disasm/disasm.c file. Re…
-
Unscored —CVE-2018-10253 Public exploit
Paessler PRTG Network Monitor before 18.1.39.1648 mishandles stack memory during unspecified API calls.
-
Unscored —CVE-2018-7747 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow r…
-
Unscored —
Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code…
-
Unscored —
Digital Guardian Management Console 7.1.2.0015 allows authenticated remote code execution because of Arbitrary File Upl…
-
Unscored —
Digital Guardian Management Console 7.1.2.0015 has a Directory Traversal issue.
-
Unscored —CVE-2018-10079 Public exploit
Geist WatchDog Console 3.2.2 uses a weak ACL for the C:\ProgramData\WatchDog Console directory, which allows local user…
-
Unscored —
Digital Guardian Management Console 7.1.2.0015 has an XXE issue.
-
Unscored —
Digital Guardian Management Console 7.1.2.0015 has an SSRF issue that allows remote attackers to read arbitrary files v…
-
Unscored —CVE-2018-10078 Public exploit
Cross-site scripting (XSS) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to …
-
Unscored —CVE-2018-10077 Public exploit
XML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to r…
-
Unscored —
The Device Administrator code in Android before 4.4.1_r1 might allow attackers to spoof device administrators and conse…
-
Unscored —
The ActiveMQ admin user interface in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allo…
-
Unscored —
Multiple XML external entity (XXE) vulnerabilities in (1) CQWeb / CM Server, (2) ClearQuest Native client, (3) ClearQue…
-
Unscored —
Multiple XML external entity (XXE) vulnerabilities in the (1) CCRC WAN Server / CM Server, (2) Perl CC/CQ integration t…
-
Unscored —
IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote attackers to obtain sensitiv…
-
Medium 4.3
IBM Power Hardware Management Console cross-site scripting
IBM Power HMC 7.1.0 through 7.8.0 and 7.3.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
-
Unscored —
In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic check…
-
Unscored —
ASUS RT-AC51U, RT-AC58U, RT-AC66U, RT-AC1750, RT-ACRH13, and RT-N12 D1 routers with firmware before 3.0.0.4.380.8228; R…