Archive
March 2019
Vulnerabilities first published in this month (UTC), newest first.
1,196 results · Feed
-
Unscored —
zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header.
-
Unscored —CVE-2018-17422 Scanner template
dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext…
-
Unscored —CVE-2018-17418 Public exploit
Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrate…
-
Unscored —
WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI.
-
Unscored —
zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter.
-
Unscored —
zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter.
-
Unscored —
XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter.
-
Unscored —
A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter.
-
Unscored —
An issue was discovered in ZrLog 2.0.3. There is a SQL injection vulnerability in the article management search box via…
-
High 7.5
miekg/dns parsing error leads to nil pointer dereference and DoS
An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before 1.0.10 for Go. A dns.ParseZone() parsing error causes a segmentation violation, leading to denial of service.
-
Unscored —
/console/account/manage.php?type=action&action=add in JTBC v3.0(C) has CSRF for adding an administrator account.
-
Unscored —
WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index…
-
Unscored —
An issue was discovered in ZrLog 2.0.3. There is stored XSS in the file upload area via a crafted attached/file/ pathna…
-
Unscored —
LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php search_query parameter.
-
Unscored —
get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of…
-
Unscored —
An issue was found in HYBBS through 2016-03-08. There is an XSS vulnerablity via an article title to post.html.
-
Unscored —
Simple Machines Forum (SMF) 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter.
-
Unscored —
Simple Machines Forum (SMF) 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via…
-
Unscored —
Simple Machines Forum (SMF) 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang d…
-
Unscored —
GdkPixBuf (aka gdk-pixbuf), possibly 2.32.2, as used by GNOME Nautilus 3.14.3 on Ubuntu 16.04, allows attackers to caus…
-
Unscored —
An issue was discovered in PHPMyWind 5.5. The method parameter of the data/api/oauth/connect.php page has a reflected C…
-
Unscored —
An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site…
-
Unscored —
In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.
-
Unscored —CVE-2019-6710 Public exploit
Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF.
-
Unscored —
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the second textbox of "System setting-…
-
Unscored —
njiandan-cms through 2013-05-23 has index.php/admin/user_new CSRF to add an administrator.
-
High 7.7
TIBCO JasperReports Server XML Entity Expansion Vulnerability
The SOAP API component vulnerability of TIBCO Software Inc.'s TIBCO JasperReports Server, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that may allow a malicious authenticated user to copy text files from the host operating sys…
-
Unscored —
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of "System setting->…
-
Unscored —
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox (aka site logo) of "…
-
Unscored —
An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command…
-
Unscored —
An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command…
-
Unscored —
An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command…
-
Unscored —
An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command…
-
Unscored —
An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment accoun…
-
High 8.8
Bolt Unrestricted Upload of File with Dangerous Type
Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension.
-
Unscored —
An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command…
-
Critical 9.8
Critical severity vulnerability that affects org.apache.solr:solr-core
In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remot…
-
High 8.6CVE-2019-1599 EPSS 14%
Cisco NX-OS Software Netstack Denial of Service Vulnerability
A vulnerability in the network stack of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to an issue with allocating and freeing memory buffers i…
-
Medium 6.7
Cisco FXOS and NX-OS Software Unauthorized Directory Access Vulnerability
A vulnerability in the file system permissions of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to access sensitive information that is stored in the file system of an affected system. The vulnerability is due to im…
-
High 8.6
Cisco FXOS and NX-OS Lightweight Directory Access Protocol Denial of Service Vulnerabilities
Multiple vulnerabilities in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a de…