Archive
26 June 2018
Vulnerabilities first published on this day (UTC), newest first.
144 results · Feed
-
Unscored —
WP Image Zoom version 1.23 contains a Incorrect Access Control vulnerability in AJAX settings that can result in allows…
-
Critical 9.8
Rubyzip gem contains a Directory Traversal vulnerability in zip file component
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , a…
-
Unscored —
Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page /wp-admin…
-
Unscored —
U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result…
-
Medium 6.1
Qutebrowser XSS Vulnerability
qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's br…
-
Unscored —
Tooltipy (tooltips for WP) version 5 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that ca…
-
Unscored —
lms version <= LMS_011123 contains a Local File Disclosure vulnerability in File reading functionality in LMS module th…
-
Unscored —CVE-2018-1000531 Public exploit
inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in…
-
Unscored —
openpsa contains a PHP Object Injection vulnerability in Form data passed as GET request variables that can result in P…
-
Unscored —
Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settings page A…
-
Unscored —
Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. …
-
Unscored —
Trovebox version <= 4.0.0-rc6 contains a PHP Type juggling vulnerability in album view component that can result in Aut…
-
Unscored —
OCS Inventory OCS Inventory NG version ocsreports 2.4 contains a Cross Site Scripting (XSS) vulnerability in login form…
-
Medium 5.3
Json-jwt did not verify the cryptographic signature for data
Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be…
-
Unscored —
Akiee version 0.0.3 contains a XSS leading to code execution due to the use of node integration vulnerability in "Detai…
-
Unscored —
BigTree-CMS contains a Cross Site Scripting (XSS) vulnerability in /users/create that can result in The low-privileged …
-
High 7.2
Froxlor PHP Object Injection vulnerability
Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $_POST['ssl…
-
Unscored —
Marlin Firmware Marlin version 1.1.x and earlier contains a Buffer Overflow vulnerability in cardreader.cpp (Depending …
-
Critical 9.8CVE-2017-7657 EPSS 14%
Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a …
-
High 7.5
Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a versi…
-
Unscored —
Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a …
-
Unscored —
Cybozu Office 10.0.0 to 10.7.0 allow remote attackers to display an image located in an external server via unspecified…
-
Unscored —
Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL i…
-
Unscored —
Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in a…
-
Unscored —
Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary…
-
Unscored —
Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a T…
-
Unscored —
Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an …
-
Medium 5.3
Sensitive Data Exposure in baserCMS
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction in mail form to view a file which is uploaded by a site user via unspecified vectors.
-
Unscored —
Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges v…
-
Medium 5.4
XSS in baserCMS
Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
-
Unscored —
Cross-site scripting vulnerability in Pixelpost v1.7.3 and earlier allows remote attackers to inject arbitrary web scri…
-
Medium 6.1
XSS in baserCMS
Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
-
Unscored —
Pixelpost v1.7.3 and earlier allows remote code execution via unspecified vectors.
-
Unscored —
Untrusted search path vulnerability in the installer of Visual C++ Redistributable allows an attacker to gain privilege…
-
Unscored —
Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass authentication to obtain the schedules without …
-
Unscored —
Cybozu Office 10.0.0 to 10.7.0 allows authenticated attackers to bypass authentication to view the schedules that are n…
-
Medium 5.3
baserCMS Access Control Bypass
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a content to view a file which is uploaded by a site user via unspecified vectors.
-
Unscored —
Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to cause a denial of service via unspecified vectors.
-
Unscored —
SQL injection vulnerability in the Pixelpost v1.7.3 and earlier allows remote authenticated attackers to execute arbitr…
-
Unscored —
Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.0 allows remote attackers to inject arbitrary web sc…