Archive
May 2018
Vulnerabilities first published in this month (UTC), newest first.
1,164 results · Feed
-
Unscored —
iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter.
-
Unscored —
iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter.
-
High 7.0
Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script…
-
Medium 4.3
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autocomplete feature on the search box discloses the names of the views in its suggestions, including the ones for which th…
-
High 7.6
hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerab…
-
Unscored —
SkyCaiji 1.2 allows CSRF to add an Administrator user.
-
Unscored —
An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances (a redirect issued with a URI contai…
-
Unscored —
An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to modify the access levels of us…
-
Unscored —
An issue was discovered in PbootCMS v1.0.9. There is a SQL Injection that can get important information from the databa…
-
Unscored —
An issue was discovered in Joomla! Core before 3.8.8. A long running background process, such as remote checks for core…
-
Unscored —
An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after …
-
Unscored —
An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to see the names of tags that wer…
-
Unscored —
An issue was discovered in Joomla! Core before 3.8.8. Depending on the server configuration, PHAR files might be handle…
-
Medium 4.8
Joomla! XSS Vulnerability
An issue was discovered in Joomla! Core before 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attac…
-
Unscored —
An issue was discovered in com_fields in Joomla! Core before 3.8.8. Inadequate filtering allows users authorised to cre…
-
Unscored —
In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the …
-
Unscored —
init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS…
-
Unscored —
An issue was discovered in CppCMS before 1.2.1. There is a denial of service in the JSON parser module.
-
Unscored —
IBM StoredIQ 7.6 could allow an authenticated attacker to bypass certain security restrictions. By sending a specially-…
-
Unscored —
VMware Workstation (14.x before 14.1.2) and Fusion (10.x before 10.1.2) contain multiple denial-of-service vulnerabilit…
-
Unscored —
VMware Fusion (10.x before 10.1.2) contains a signature bypass vulnerability which may lead to a local privilege escala…
-
Unscored —
Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may…
-
Medium 5.5
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addre…
-
Unscored —
The DrugDealer function of a smart contract implementation for Ether Cartel, an Ethereum game, allows attackers to take…
-
Unscored —
jpeg_size in pdfgen.c in PDFGen before 2018-04-09 has a heap-based buffer over-read.
-
Unscored —
sav_parse_machine_integer_info_record in spss/readstat_sav_read.c in libreadstat.a in ReadStat 0.1.1 has a memory leak …
-
Unscored —
sas/readstat_sas7bcat_read.c in libreadstat.a in ReadStat 0.1.1 has an infinite loop.
-
Unscored —
A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specif…
-
Unscored —
Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system vi…
-
Unscored —CVE-2018-11339 Public exploit
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.
-
Unscored —
An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload su…
-
Unscored —
A persistent cross site scripting vulnerability in playlistmanger.cgi in the ASUSTOR SoundsGood application allows atta…
-
Unscored —
An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to uploa…
-
Unscored —
An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability …
-
Unscored —
A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily sp…
-
Medium 4.2
Improper Neutralization of Input During Web Page Generation in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the …
-
Unscored —
An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filename…
-
Unscored —
An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed file…
-
Medium 5.9
kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed…
-
High 7.8
Client for OES Elevation of Privilege via Buffer Overflow
The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys.