Archive
17 March 2019
Vulnerabilities first published on this day (UTC), newest first.
95 results · Feed
-
Unscored —
In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication.…
-
Unscored —
In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sq…
-
Unscored —
In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to arbitrary…
-
Unscored —
wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to chang…
-
Unscored —CVE-2018-19510 EPSS 20%
subscriber.php in Webgalamb through 7.0 is vulnerable to SQL injection via the Client-IP HTTP request header.
-
Unscored —
wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars() instead of using a templating engine with prop…
-
Unscored —
The Simplenia Pages plugin 2.6.0 for Atlassian Bitbucket Server has XSS.
-
Unscored —
COYO 9.0.8, 10.0.11 and 12.0.4 has cross-site scripting (XSS) via URLs used by "iFrame" widgets.
-
Unscored —
www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitr…
-
Unscored —
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() funct…
-
Unscored —CVE-2018-19487 Public exploit
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_prof…
-
Unscored —
SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Impor…
-
Unscored —
An issue was discovered in Repute ARForms 3.5.1 and prior. An attacker is able to delete any file on the server with we…
-
Critical 10.0
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated us…
-
Unscored —CVE-2018-19191 EPSS 39%
Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or th…
-
Unscored —
SynTP.sys in Synaptics Touchpad drivers before 2018-06-06 allows local users to obtain sensitive information about free…
-
Unscored —
ColossusCoinXT through 1.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitab…
-
Unscored —CVE-2018-14575 Public exploit
Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (C…
-
Unscored —
The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote att…
-
Medium 6.1
DNN XSS Vulnerability
DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML.
-
Unscored —
A stored cross-site scripting (XSS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Dat…
-
Unscored —
A Denial of Service (DOS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Data Acquisit…
-
Unscored —
Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deseriali…
-
Unscored —
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authe…
-
Unscored —
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the d…
-
Unscored —
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input direc…
-
Unscored —
bin/statistics in TWiki 6.0.2 allows cross-site scripting (XSS) via the webs parameter.
-
Unscored —
BMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control in ITAM forms, as demon…
-
Unscored —CVE-2018-20162 Public exploit
Digi TransPort LR54 4.4.0.26 and possible earlier devices have Improper Input Validation that allows users with 'super'…
-
Unscored —
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkd…
-
Unscored —
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer…
-
Unscored —
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index…
-
Unscored —
AbanteCart 1.2.12 has reflected cross-site scripting (XSS) via the sort parameter, as demonstrated by a /apparel--acces…
-
Unscored —
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editP…
-
Unscored —
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMa…
-
Unscored —
Zenphoto 1.4.14 has multiple cross-site scripting (XSS) vulnerabilities via different URL parameters.
-
Unscored —
XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.login/gnb/loginView.sws" i…
-
Unscored —
XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.application/information/ne…
-
Unscored —
In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value.
-
Unscored —
Podcast Generator 2.7 has stored cross-site scripting (XSS) via the URL addcategory parameter.