Archive
May 2018
Vulnerabilities first published in this month (UTC), newest first.
1,164 results · Feed
-
Medium 4.3
Moodle Cross-site Scripting
An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerabil…
-
High 8.8
Moodle calculated question type allows remote code execution by Question authors
An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection.
-
Medium 6.5
Moodle Portfolio forum caller class allows a user to download any file
An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL.
-
Medium 6.5
Moodle Improper Privilege Management
An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL.
-
Unscored —
Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c.
-
Unscored —
An issue was discovered in Foxit Reader before 9.1 and PhantomPDF before 9.1. This vulnerability allows remote attacker…
-
Unscored —
An issue was discovered in Foxit Reader before 9.1 and PhantomPDF before 9.1. This vulnerability allows remote attacker…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before…
-
Unscored —
IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 might allow remote attacker…
-
Unscored —
IBM WebSphere Application Server (WAS) 8.5 through 8.5.0.2 on UNIX allows local users to gain privileges by leveraging …
-
Unscored —
The AXIS webapp in deploy-tomcat/axis in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 th…
-
Unscored —
In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, by accessing a specif…
-
Unscored —
In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with netw…
-
Unscored —
An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_code_unit_from_hex f…
-
Unscored —
An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_code_unit_from_utf8 …
-
Unscored —
jpegoptim.c in jpegoptim 1.4.5 (fixed in 1.4.6) has an invalid use of realloc() and free(), which allows remote attacke…
-
Unscored —
In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to…
-
Unscored —CVE-2017-14187 Public exploit
A local privilege escalation and local code execution vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8,…
-
Unscored —CVE-2018-11415 Public exploit
SAP Internet Transaction Server (ITS) 6200.X.X has Reflected Cross Site Scripting (XSS) via certain wgate URIs. NOTE: t…
-
Unscored —
An issue was discovered in BearAdmin 0.5. Remote attackers can download arbitrary files via /admin/databack/download.ht…
-
Unscored —
An issue was discovered in BearAdmin 0.5. There is admin/admin_log/index.html?user_id= SQL injection because admin\cont…
-
Unscored —
In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrust…
-
Unscored —CVE-2018-11332 Public exploit
Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations i…
-
Critical 9.8CVE-2018-8013 EPSS 19%
Deserialization of Untrusted Data in Apache Batik
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling n…
-
Unscored —
A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authoriz…
-
Unscored —
A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on …
-
Unscored —
Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote …
-
Unscored —
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have an authentication bypass vulnerabili…
-
Unscored —
Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote …
-
Unscored —
Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote …
-
Unscored —
NetApp OnCommand Unified Manager for Windows versions 7.2 through 7.3 are susceptible to a vulnerability which could le…
-
Unscored —
NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Meth…
-
Unscored —
Huawei DP300 V500R002C00; RP200 V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00;…
-
Unscored —
Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the ve…