Archive
August 2018
Vulnerabilities first published in this month (UTC), newest first.
1,015 results · Feed
-
Unscored —
Xiao5uCompany 1.7 has CSRF via admin/Admin.asp.
-
Unscored —
An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=address&do=add page allows CSRF.
-
Unscored —
An issue was discovered in QCMS 3.0.1. upload/System/Controller/guest.php has XSS, as demonstrated by the name paramete…
-
Unscored —
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/product.php has XSS.
-
Unscored —
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/down.php has XSS.
-
Unscored —
zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php.
-
Unscored —
An issue was discovered in QCMS 3.0.1. CSRF exists via the backend/user/admin/add.html URI.
-
Unscored —
dl/dl_sendmail.php in zzcms 8.3 has SQL Injection via the sql parameter.
-
Unscored —
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS.
-
Unscored —
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/category.php has XSS.
-
Unscored —
An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=user&do=add page allows CSRF.
-
Unscored —
An issue was discovered in EMLsoft 5.4.5. XSS exists via the eml/upload/eml/?action=address&do=edit page.
-
Critical 9.8CVE-2017-6920 EPSS 20%
Drupal PECL YAML parser unsafe object handling
Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.
-
Medium 4.3
IBM Maximo Asset Management 7.6 through 7.6.3 could allow an authenticated user to obtain sensitive information from th…
-
Low 3.1
IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more authority than they…
-
Medium 5.4
IBM Jazz Foundation products (IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.5) are vulnerabl…
-
Medium 4.3
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 generates an error message that includes sensiti…
-
Medium 6.5
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 could allow a local attacker to inject commands …
-
Medium 5.9
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that users should have strong p…
-
Medium 5.9
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorith…
-
Medium 4.2
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical re…
-
Medium 5.3
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized …
-
Medium 4.3
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorizati…
-
Medium 6.1
Apache Airflow Reflected Cross-site Scripting vulnerability in 404 Endpoint
It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation:…
-
Unscored —
An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings (such as the theme, title, and descri…
-
Unscored —
An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI.
-
Unscored —
The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function i…
-
Unscored —
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<form action='data:text" attack.
-
Unscored —
An issue has been found in jpeg_encoder through 2015-11-27. It is a SEGV in the function readFromBMP in jpeg_encoder.cp…
-
Unscored —
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math><maction xlink:href=" attack.
-
Unscored —
An issue has been found in dilawar sound through 2017-11-27. The end of openWavFile in wav-file.cc has Mismatched Memor…
-
Unscored —
Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for…
-
Unscored —
The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute).
-
Unscored —
An issue has been found in PDF2JSON 0.69. The HtmlString class in ImgOutputDev.cc has Mismatched Memory Management Rout…
-
Unscored —
An issue has been found in jpeg_encoder through 2015-11-27. It is a heap-based buffer overflow in the function readFrom…
-
Unscored —
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math xlink:href=" attack.
-
Unscored —
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<svg><a xlink:href=" attack.
-
Unscored —
Harmonic NSG 9000 devices allow remote authenticated users to conduct directory traversal attacks, as demonstrated by "…
-
Unscored —
PHPCMS 9 allows remote attackers to cause a denial of service (resource consumption) via large font_size, height, and w…
-
Unscored —
Harmonic NSG 9000 devices allow remote authenticated users to read the webapp.py source code via a direct request for t…