Archive
June 2018
Vulnerabilities first published in this month (UTC), newest first.
1,787 results · Feed
-
Unscored —
MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add Ne…
-
Unscored —
coreBOS version 7.0 and earlier contains a Incorrect Access Control vulnerability in Module: Contacts that can result i…
-
Unscored —
Trovebox version <= 4.0.0-rc6 contains a Server-Side request forgery vulnerability in webhook component that can result…
-
Unscored —
LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in J…
-
Unscored —
ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mb…
-
Unscored —
Triplea version <= 1.9.0.0.10291 contains a XML External Entity (XXE) vulnerability in Importing game data that can res…
-
Unscored —
LoboEvolution version < 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity (XXE) vulnerability in …
-
Medium 6.5
Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arb…
-
Unscored —
beep version 1.3 and up contains a External Control of File Name or Path vulnerability in --device option that can resu…
-
Unscored —
Umlet version < 14.3 contains a XML External Entity (XXE) vulnerability in File parsing that can result in disclosure o…
-
Unscored —
Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/…
-
Unscored —
The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi …
-
Unscored —
Trovebox version <= 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code inj…
-
Unscored —
WP Image Zoom version 1.23 contains a Incorrect Access Control vulnerability in AJAX settings that can result in allows…
-
Critical 9.8
Rubyzip gem contains a Directory Traversal vulnerability in zip file component
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , a…
-
Unscored —
Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page /wp-admin…
-
Unscored —
U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result…
-
Medium 6.1
Qutebrowser XSS Vulnerability
qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's br…
-
Unscored —
Tooltipy (tooltips for WP) version 5 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that ca…
-
Unscored —
lms version <= LMS_011123 contains a Local File Disclosure vulnerability in File reading functionality in LMS module th…
-
Unscored —CVE-2018-1000531 Public exploit
inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in…
-
Unscored —
openpsa contains a PHP Object Injection vulnerability in Form data passed as GET request variables that can result in P…
-
Unscored —
Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settings page A…
-
Unscored —
Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. …
-
Unscored —
Trovebox version <= 4.0.0-rc6 contains a PHP Type juggling vulnerability in album view component that can result in Aut…
-
Unscored —
OCS Inventory OCS Inventory NG version ocsreports 2.4 contains a Cross Site Scripting (XSS) vulnerability in login form…
-
Medium 5.3
Json-jwt did not verify the cryptographic signature for data
Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be…
-
Unscored —
Akiee version 0.0.3 contains a XSS leading to code execution due to the use of node integration vulnerability in "Detai…
-
Unscored —
BigTree-CMS contains a Cross Site Scripting (XSS) vulnerability in /users/create that can result in The low-privileged …
-
High 7.2
Froxlor PHP Object Injection vulnerability
Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $_POST['ssl…
-
Unscored —
Marlin Firmware Marlin version 1.1.x and earlier contains a Buffer Overflow vulnerability in cardreader.cpp (Depending …
-
Critical 9.8CVE-2017-7657 EPSS 14%
Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a …
-
High 7.5
Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a versi…
-
Unscored —
Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a …
-
Unscored —
Cybozu Office 10.0.0 to 10.7.0 allow remote attackers to display an image located in an external server via unspecified…
-
Unscored —
Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL i…
-
Unscored —
Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in a…
-
Unscored —
Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary…
-
Unscored —
Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a T…
-
Unscored —
Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an …