Archive
June 2018
Vulnerabilities first published in this month (UTC), newest first.
1,787 results · Feed
-
Unscored —
Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers …
-
Unscored —
phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field.
-
Unscored —
quickersort is deprecated and unmaintained
The author of the `quickersort` crate has deprecated it and does not recommend using it anymore. Everything in it has been incorporated into [std::sort_unstable] in the standard library as of Rust 1.20. [std::sort_unstable]: https://doc.rust-lang.org/stable/s…
-
Unscored —
An issue was discovered in jpeg-compressor 0.1. The build_huffman function in stb_image.c allows remote attackers to ca…
-
Unscored —
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function G…
-
Medium 5.4CVE-2018-10860 EPSS 42%
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did …
-
Unscored —
Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter …
-
Unscored —
An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code ex…
-
Unscored —
protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files vi…
-
Critical 9.1
Remote Code Execution in Micro Focus Secure Messaging Gateway
An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in co…
-
Critical 10.0
Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway
A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an ad…
-
Unscored —
Improper check of unusual conditions when launching msiexec.exe in safensec.com (SysWatch service) in SAFE'N'SEC SoftCo…
-
Unscored —
Download of code with improper integrity check in snsupd.exe and upd.exe in SAFE'N'SEC SoftControl/SafenSoft SysWatch, …
-
Unscored —
Storing password in recoverable format in safensec.com (SysWatch service) in SAFE'N'SEC SoftControl/SafenSoft SysWatch,…
-
Unscored —
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function G…
-
Unscored —
An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. A local user with database access pri…
-
Unscored —
An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. The impacted products used a single s…
-
Unscored —
An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in…
-
Unscored —
An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buf…
-
Unscored —
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function G…
-
Unscored —
An issue was discovered in MP4Box in GPAC 0.7.1. There is a heap-based buffer over-read in the isomedia/box_dump.c func…
-
Unscored —
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function G…
-
Medium 6.1
OpenTSDB Cross-site Scripting vulnerability
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'type' to the /suggest URI.
-
Unscored —
An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the `admin.php` file of the `./…
-
Unscored —
WSTMall v1.9.1_170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account.
-
Unscored —
An XSS issue was discovered in Advanced Electron Forum (AEF) v1.0.9. A persistent XSS vulnerability is located in the `…
-
Unscored —
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function G…
-
Unscored —CVE-2018-12998 EPSS 99%
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network…
-
Unscored —
Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Co…
-
Unscored —
An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface.
-
Unscored —
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) …
-
Unscored —
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms…
-
Unscored —
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename…
-
Unscored —
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename…
-
Unscored —
Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to dele…
-
Unscored —
Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote…
-
Unscored —
Hycus CMS 1.0.4 allows Authentication Bypass via "'=' 'OR'" credentials.
-
Medium 6.1
OpenTSDB Cross-site Scripting vulnerability
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI.
-
Unscored —
GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI.
-
Unscored —
EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users.