Archive
22 May 2018
Vulnerabilities first published on this day (UTC), newest first.
63 results · Feed
-
Unscored —
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the RRC dissector and other dissectors could crash. This was a…
-
Unscored —
In Wireshark 2.6.0, the RTCP dissector could crash. This was addressed in epan/dissectors/packet-rtcp.c by avoiding a b…
-
Unscored —
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the DNS dissector could crash. This was addressed in epan/diss…
-
Unscored —
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive…
-
Unscored —
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. This was addressed in epan/dis…
-
Unscored —
In Wireshark 2.6.0, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/dot11decrypt.c by …
-
Unscored —
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the GSM A DTAP dissector could crash. This was addressed in ep…
-
Unscored —
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the Q.931 dissector could crash. This was addressed in epan/di…
-
Unscored —
In Wireshark 2.6.0, the IEEE 1905.1a dissector could crash. This was addressed in epan/dissectors/packet-ieee1905.c by …
-
Critical 9.8
Dolibarr SQL Injection vulnerability
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categories_list.php, /accountancy/admin/journals_list…
-
Medium 6.1
Dolibarr Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.
-
High 8.0
Dolibarr arbitrary commands execution
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.
-
Critical 9.8
Dolibarr SQL injection vulnerability
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.
-
Unscored —
The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-…
-
Unscored —
The _inst__sts() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-boun…
-
Unscored —
The wasm_dis() function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM fi…
-
Unscored —
The sh_op() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds re…
-
Unscored —
The r_strbuf_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and ap…
-
Unscored —
The _inst__lds() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-boun…
-
Unscored —
The parse_import_ptr() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-o…
-
Unscored —
The string_scan_range() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-…
-
Unscored —
The get_debug_info() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-…
-
Unscored —
The r_read_le32() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bou…
-
Medium 4.7
MFSBGN03806 rev.1 - HP Network Automation Software, Network Operations Management (NOM) Suite, Multiple Vulnerabilities
Persistent Cross-Site Scripting, and non-persistent HTML Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation, version 10.00, 10.10, 10.11, 10.20, 10.30, 10.40, 10.50. This vulnerability could be …
-
High 8.7
MFSBGN03806 rev.1 - HP Network Automation Software, Network Operations Management (NOM) Suite, Multiple Vulnerabilities
SQL Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation, version 10.00, 10.10, 10.11, 10.20, 10.30, 10.40, 10.50. This vulnerability could be remotely exploited to allow Remote SQL Injection.
-
Unscored —
Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web si…
-
Medium 6.1
Cross-Site Scripting in @ckeditor/ckeditor5-link
Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link (A) element.
-
Medium 6.4
MFSBGN03807 rev.1 - HP Service Manager Software, Multiple Vulnerabilities
Remote SQL Injection against the HP Service Manager Software Web Tier, version 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, may lead to unauthorized disclosure of data.
-
Unscored —
iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter.
-
Unscored —
iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter.
-
High 7.0
Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script…
-
Medium 4.3
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autocomplete feature on the search box discloses the names of the views in its suggestions, including the ones for which th…
-
High 7.6
hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerab…
-
Unscored —
SkyCaiji 1.2 allows CSRF to add an Administrator user.
-
Unscored —
An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances (a redirect issued with a URI contai…
-
Unscored —
An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to modify the access levels of us…
-
Unscored —
An issue was discovered in PbootCMS v1.0.9. There is a SQL Injection that can get important information from the databa…
-
Unscored —
An issue was discovered in Joomla! Core before 3.8.8. A long running background process, such as remote checks for core…
-
Unscored —
An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after …
-
Unscored —
An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to see the names of tags that wer…