Archive
21 June 2018
Vulnerabilities first published on this day (UTC), newest first.
41 results · Feed
-
Unscored —
Redatam7 (formerly Redatam WebServer) allows remote attackers to discover the installation path via an invalid LFN para…
-
Unscored —
Redatam7 (formerly Redatam WebServer) allows remote attackers to read arbitrary files via /redbin/rpwebutilities.exe/te…
-
Unscored —
NEWMARK (aka New Mark) NMCMS 2.1 allows SQL Injection via the sect_id parameter to the /catalog URI.
-
Medium 6.1
phpMyAdmin XSS Vulnerability
An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer featur…
-
High 8.8
phpMyAdmin Improper Authentication
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an impro…
-
Unscored —
System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potenti…
-
Unscored —
Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log …
-
Unscored —
Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the…
-
Unscored —
Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favor…
-
Unscored —
Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values.
-
Unscored —
qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 …
-
Medium 6.5
Stored cross-site scripting vulnerability
RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console administrator could potentially exploit this vulnerability to store arbitrary HTML or JavaScript co…
-
Unscored —
RSA Authentication Manager Security Console, versions 8.3 P1 and earlier, contains a reflected cross-site scripting vul…
-
Unscored —
Telesquare SDT-CS3B1 and SDT-CW3B1 devices through 1.2.0 have a default factory account. Remote attackers can obtain ac…
-
Medium 5.3
Phusion Passenger incorrect permission assignment
An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actuall…
-
Unscored —
Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 bu…
-
Unscored —
An issue was discovered in the Linux kernel through 4.17.2. Since the page allocator does not yield CPU resources to th…
-
Unscored —
Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS …
-
Low 3.7
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user au…
-
Medium 6.5
A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with acces…
-
Unscored —
A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an u…
-
Unscored —
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to send a m…
-
Unscored —
A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager could allow an una…
-
Unscored —
A vulnerability in the Cisco Discovery Protocol component of Cisco FXOS Software and Cisco NX-OS Software could allow a…
-
Unscored —
A vulnerability in the Web Admin Interface of Cisco Meeting Server could allow an authenticated, remote attacker to cau…
-
Unscored —
A vulnerability in BIOS authentication management of Cisco 5000 Series Enterprise Network Compute System and Cisco Unif…
-
Unscored —
A vulnerability in the session identification management functionality of the web-based management interface for Cisco …
-
Unscored —
A vulnerability in the CLI parser of Cisco NX-OS Software could allow an authenticated, local attacker to perform a com…
-
Unscored —
A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobil…
-
Unscored —
A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticat…
-
Unscored —
A vulnerability in the file descriptor handling of Cisco TelePresence Video Communication Server (VCS) Expressway could…
-
Unscored —
A vulnerability in the Cisco Discovery Protocol (formerly known as CDP) subsystem of devices running, or based on, Cisc…
-
Unscored —
A vulnerability in the process of uploading new application images to Cisco FXOS on the Cisco Firepower 4100 Series Nex…
-
Unscored —
A vulnerability in the web UI of Cisco FXOS and Cisco UCS Fabric Interconnect Software could allow an unauthenticated, …
-
Unscored —
A vulnerability in the implementation of a specific CLI command and the associated Simple Network Management Protocol (…
-
Unscored —
A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an u…
-
Unscored —
A vulnerability in the CLI parser of Cisco FXOS Software and Cisco UCS Fabric Interconnect Software could allow an auth…
-
Unscored —
A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an u…
-
Unscored —
A vulnerability in the role-based access-checking mechanisms of Cisco NX-OS Software could allow an authenticated, loca…
-
Unscored —
A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco NX-OS on the Cisco Nexus 4000 Series …