Archive
May 2018
Vulnerabilities first published in this month (UTC), newest first.
1,164 results · Feed
-
Unscored —
In Artifex MuPDF 1.12.0 and earlier, multiple memory leaks in the PDF parser allow an attacker to cause a denial of ser…
-
Unscored —
In Artifex MuPDF 1.12.0 and earlier, multiple use of uninitialized value bugs in the PDF parser could allow an attacker…
-
Critical 9.1
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of s…
-
Unscored —CVE-2018-1000199 Public exploit
The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result…
-
Medium 5.5
In Artifex MuPDF 1.12.0 and earlier, multiple reachable assertions in the PDF parser allow an attacker to cause a denia…
-
Unscored —
OpenFlow version 1.0 onwards contains a Denial of Service and Improper authorization vulnerability in OpenFlow handshak…
-
Unscored —
curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in d…
-
Unscored —
In Artifex MuPDF 1.12.0 and earlier, a stack buffer overflow in function pdf_lookup_cmap_full in pdf/pdf-cmap.c could a…
-
Medium 6.3
In Artifex MuPDF 1.12.0 and earlier, multiple heap use after free bugs in the PDF parser could allow an attacker to exe…
-
Unscored —
Server side request forgery exists in the runtime application in K2 smartforms 4.6.11 via a modified hostname in an htt…
-
Unscored —
Authentication Bypass vulnerability in Accellion kiteworks before 2017.01.00 allows remote attackers to execute certain…
-
Unscored —
The transferFrom function of a smart contract implementation for DimonCoin (FUD), an Ethereum ERC20 token, allows attac…
-
Unscored —CVE-2018-11403 Public exploit
DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter.
-
Unscored —CVE-2018-11404 Public exploit
DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter.
-
Unscored —
Kliqqi 2.0.2 has CSRF in admin/admin_users.php.
-
Unscored —
An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in compileTranslationTable.c allo…
-
Unscored —
In SimpliSafe Original, the Base Station fails to detect tamper attempts: it does not send a notification if a physical…
-
Unscored —
SimpliSafe Original has Unencrypted Sensor Transmissions, which allows physically proximate attackers to obtain potenti…
-
Unscored —
SimpliSafe Original has Unencrypted Keypad Transmissions, which allows physically proximate attackers to discover the P…
-
Unscored —
In SimpliSafe Original, RF Interference (e.g., an extremely strong 433.92 MHz signal) by a physically proximate attacke…
-
Unscored —
ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vuln…
-
Medium 6.3
MFSBGN03808 rev.1 - Micro Focus UCMDB, Cross-Site Scripting
Cross-Site Scripting (XSS) in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulner…
-
Unscored —
There is an Insufficient Path Validation Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
-
Unscored —
There is a Sensitive Data Leakage issue in Citrix XenMobile Server 10.7 before RP3.
-
Unscored —
There are Open Redirect Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
-
Unscored —
There is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 bef…
-
Unscored —CVE-2018-10653 Public exploit
There is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 befo…
-
Unscored —
There are Unauthenticated File Upload Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
-
Unscored —
There is a Cross-Site Scripting Vulnerability in Citrix XenMobile Server 10.7 before RP3.
-
Unscored —CVE-2018-11231 Scanner template
In the Divido plugin for OpenCart, there is SQL injection. Attackers can use SQL injection to get some confidential inf…
-
Unscored —
A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B…
-
Unscored —
A SQL injection information disclosure vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote a…
-
Unscored —
A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL stat…
-
Unscored —
A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL stat…
-
Unscored —
An authentication weakness vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to recover…
-
Unscored —CVE-2018-10357 EPSS 64%
A directory traversal vulnerability in Trend Micro Endpoint Application Control 2.0 could allow a remote attacker to ex…
-
Unscored —CVE-2018-10354 EPSS 13%
A command injection remote command execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a re…
-
Unscored —
A SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker…
-
Unscored —
Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto header…
-
Unscored —
Privilege escalation vulnerability found in some Dahua IP devices. Attacker in possession of low privilege account can …