Archive
4 October 2018
Vulnerabilities first published on this day (UTC), newest first.
29 results · Feed
-
Unscored —
The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execu…
-
Unscored —
An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, le…
-
Unscored —
An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consum…
-
Critical 9.1
Mercurial Out-of-bounds Read vulnerability
cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.
-
Unscored —
PHP Scripts Mall Market Place Script 1.0.1 allows XSS via a keyword.
-
Unscored —
PHP Scripts Mall Open Source Real-estate Script 3.6.2 allows remote attackers to list the wp-content/themes/template_dp…
-
Unscored —
PHP Scripts Mall Olx Clone 3.4.2 has XSS.
-
Unscored —
PHP Scripts Mall Domain Lookup Script 3.0.5 allows XSS in the search bar.
-
Unscored —
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a keyword. NOTE: This may overlap with CVE-2018-6870 which has…
-
Unscored —
Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When conta…
-
Medium 4.3
$wgRateLimits entry for 'user' overrides 'newbie'
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'.
-
Medium 6.5
Information disclosure in Special:Redirect/logid
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid
-
Medium 6.5
BotPasswords can bypass CentralAuth's account lock
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock
-
Unscored —
Navigate CMS 2.8 has Stored XSS via a navigate_upload.php (aka File Upload) request with a multipart/form-data JavaScri…
-
Medium 5.3
Tarball was missing .htaccess files
Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible.
-
Unscored —
Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Incorrect Access Control.
-
Unscored —
Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Insecure Permissions.
-
Medium 6.1
Coaster CMS Stored Cross-site Scripting vulnerability
A Stored XSS vulnerability has been discovered in the v5.5.0 version of the Coaster CMS product.
-
Medium 5.4
IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This …
-
Low 3.1
IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain…
-
Medium 6.3
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2, 3.0.4, 3.0.6, and 3.2.0 is vulnerable …
-
Medium 5.4
IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This …
-
Medium 5.4
IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This …
-
High 7.3
Authentication bypass in sibling check
A improper authentication using the HOST header in SUSE Linux SMT allows remote attackers to spoof a sibling server. Affected releases are SUSE Linux SMT: versions prior to 3.0.37.
-
Critical 9.8
SQL injection in RegistrationSharing module
A SQL Injection in the RegistrationSharing module of SUSE Linux SMT allows remote attackers to cause execute arbitrary SQL statements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37.
-
Medium 6.5
External Entity processing in the RegistrationSharing module
A External Entity Reference ('XXE') vulnerability in SUSE Linux SMT allows remote attackers to read data from the server or cause DoS by referencing blocking elements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37.
-
Unscored —
The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authori…
-
Medium 4.3
Apache Tomcat Open Redirect vulnerability
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redi…
-
Unscored —
NetApp E-Series SANtricity OS Controller Software 11.30 and later version 11.30.5 is susceptible to unauthenticated rem…