Archive
7 March 2019
Vulnerabilities first published on this day (UTC), newest first.
65 results · Feed
-
Critical 10.0
TIBCO JasperReports Server User Information Disclosure
The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytic…
-
Unscored —
EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar…
-
High 8.8
TIBCO JasperReports Server Privilege Escalation Via Race Condition
The domain management component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and…
-
High 8.0
TIBCO JasperReports Persistent Cross Site Scripting Vulnerability
The repository component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics …
-
Critical 9.9
TIBCO JasperReports Library Directory Traversal Vulnerability
The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, …
KEV Dec 29, 2022 -
Medium 6.1
Dolibarr Stored Cross-site Scripting in expensereport/card.php
An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note.
-
Critical 9.8
Dolibarr SQL injection via the integer parameters qty and value_unit
An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and value_unit.
-
Unscored —
An issue was discovered in UCMS 1.4.6. There is XSS in the title bar, as demonstrated by a do=list request.
-
Unscored —
zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header.
-
Unscored —CVE-2018-17422 Scanner template
dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext…
-
Unscored —CVE-2018-17418 Public exploit
Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrate…
-
Unscored —
WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI.
-
Unscored —
zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter.
-
Unscored —
zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter.
-
Unscored —
XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter.
-
Unscored —
A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter.
-
Unscored —
An issue was discovered in ZrLog 2.0.3. There is a SQL injection vulnerability in the article management search box via…
-
High 7.5
miekg/dns parsing error leads to nil pointer dereference and DoS
An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before 1.0.10 for Go. A dns.ParseZone() parsing error causes a segmentation violation, leading to denial of service.
-
Unscored —
/console/account/manage.php?type=action&action=add in JTBC v3.0(C) has CSRF for adding an administrator account.
-
Unscored —
WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index…
-
Unscored —
An issue was discovered in ZrLog 2.0.3. There is stored XSS in the file upload area via a crafted attached/file/ pathna…
-
Unscored —
LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php search_query parameter.
-
Unscored —
get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of…
-
Unscored —
An issue was found in HYBBS through 2016-03-08. There is an XSS vulnerablity via an article title to post.html.
-
Unscored —
Simple Machines Forum (SMF) 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter.
-
Unscored —
Simple Machines Forum (SMF) 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via…
-
Unscored —
Simple Machines Forum (SMF) 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang d…
-
Unscored —
GdkPixBuf (aka gdk-pixbuf), possibly 2.32.2, as used by GNOME Nautilus 3.14.3 on Ubuntu 16.04, allows attackers to caus…
-
Unscored —
An issue was discovered in PHPMyWind 5.5. The method parameter of the data/api/oauth/connect.php page has a reflected C…
-
Unscored —
An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site…
-
Unscored —
In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.
-
Unscored —CVE-2019-6710 Public exploit
Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF.
-
Unscored —
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the second textbox of "System setting-…
-
Unscored —
njiandan-cms through 2013-05-23 has index.php/admin/user_new CSRF to add an administrator.
-
High 7.7
TIBCO JasperReports Server XML Entity Expansion Vulnerability
The SOAP API component vulnerability of TIBCO Software Inc.'s TIBCO JasperReports Server, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that may allow a malicious authenticated user to copy text files from the host operating sys…
-
Unscored —
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of "System setting->…
-
Unscored —
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox (aka site logo) of "…
-
Unscored —
An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command…
-
Unscored —
An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command…
-
Unscored —
An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command…