Archive
5 June 2018
Vulnerabilities first published on this day (UTC), newest first.
60 results · Feed
-
High 7.5
SB10232 - McAfee Management of Native Encryption (MNE) - Privilege Escalation vulnerability
Privilege Escalation vulnerability in McAfee Management of Native Encryption (MNE) before 4.1.4 allows local users to gain elevated privileges via a crafted user input.
-
Medium 6.5
Cross-site scripting (XSS) vulnerability in Title Tootip in Synology Office before 3.0.3-2143 allows remote authenticat…
-
Medium 6.5
Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology File Station before 1.1.4-0122 allows remote…
-
Unscored —CVE-2016-9488 Public exploit
ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker cou…
-
Unscored —
ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerability
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTY…
-
High 7.5
Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appea…
-
Unscored —
Kitura 2.3.0 and earlier have an unintended read access to unauthorised files and folders that can be exploited by a cr…
-
Unscored —
The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory (OOM…
-
Unscored —
The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attac…
-
Unscored —
WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC_KEY' is hard coded.
-
Unscored —
RSA Web Threat Detection SQL Injection Vulnerability
RSA Web Threat Detection versions prior to 6.4, contain an SQL injection vulnerability in the Administration and Forensics applications. An authenticated malicious user with low privileges could potentially exploit this vulnerability to execute SQL commands o…
-
Unscored —
An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds re…
-
Unscored —
An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds rea…
-
Unscored —
An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds rea…
-
Unscored —
The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Di…
-
Unscored —
An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds r…
-
Unscored —
plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login…
-
Unscored —
index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter.
-
Unscored —CVE-2018-11736 Public exploit
An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute …
-
Medium 5.4
nZEDb Cross-site Scripting (XSS) in the 404 error page
nZEDb v0.7.3.3 has XSS in the 404 error page.