Search
Total
49350 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-13240 | 1 Google | 1 Android | 2018-03-07 | 5.0 MEDIUM | 7.5 HIGH |
| A information disclosure vulnerability in the Android framework (crypto framework). Product: Android. Versions: 8.0, 8.1. ID: A-68694819. | |||||
| CVE-2017-13239 | 1 Google | 1 Android | 2018-03-07 | 5.0 MEDIUM | 7.5 HIGH |
| A information disclosure vulnerability in the Android framework (ui framework). Product: Android. Versions: 8.0. ID: A-66244132. | |||||
| CVE-2017-13241 | 1 Google | 1 Android | 2018-03-07 | 5.0 MEDIUM | 7.5 HIGH |
| A information disclosure vulnerability in the Android media framework (libstagefright_soft_avcenc). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-69065651. | |||||
| CVE-2017-13242 | 1 Google | 1 Android | 2018-03-07 | 5.0 MEDIUM | 7.5 HIGH |
| A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-62672248. | |||||
| CVE-2017-8260 | 1 Google | 1 Android | 2018-03-07 | 6.8 MEDIUM | 7.8 HIGH |
| In all Qualcomm products with Android releases from CAF using the Linux kernel, due to a type downcast, a value may improperly pass validation and cause an out of bounds write later. | |||||
| CVE-2017-8952 | 1 Hp | 1 Sitescope | 2018-03-06 | 5.0 MEDIUM | 7.5 HIGH |
| A Disclosure of Sensitive Information vulnerability in HPE SiteScope version v11.2x, v11.3x was found. | |||||
| CVE-2018-1000021 | 1 Git-scm | 1 Git | 2018-03-06 | 6.8 MEDIUM | 8.8 HIGH |
| GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their traffic modified in a MITM attack). | |||||
| CVE-2017-8951 | 1 Hp | 1 Sitescope | 2018-03-06 | 4.6 MEDIUM | 7.8 HIGH |
| A Disclosure of Sensitive Information vulnerability in HPE SiteScope version v11.2x, v11.3x was found. | |||||
| CVE-2018-1000058 | 1 Jenkins | 1 Pipeline Supporting Apis | 2018-03-06 | 6.5 MEDIUM | 8.8 HIGH |
| Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java deserialization like readResolve implemented in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles. | |||||
| CVE-2018-6888 | 1 Typesettercms | 1 Typesetter | 2018-03-06 | 6.0 MEDIUM | 8.0 HIGH |
| An issue was discovered in Typesetter 5.1. The User Permissions page (aka Admin/Users) suffers from critical flaw of Cross Site Request forgery: using a forged HTTP request, a malicious user can lead a user to unknowingly create / delete or modify a user account due to the lack of an anti-CSRF token. | |||||
| CVE-2018-6889 | 1 Typesettercms | 1 Typesetter | 2018-03-06 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in Typesetter 5.1. It suffers from a Host header injection vulnerability, Using this attack, a malicious user can poison the web cache or perform advanced password reset attacks or even trigger arbitrary user re-direction. | |||||
| CVE-2018-1000056 | 1 Jenkins | 1 Junit | 2018-03-06 | 6.5 MEDIUM | 8.3 HIGH |
| Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks. | |||||
| CVE-2018-1000055 | 1 Jenkins | 1 Android Lint | 2018-03-06 | 6.5 MEDIUM | 8.3 HIGH |
| Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks. | |||||
| CVE-2016-8515 | 1 Hp | 1 Version Control Repository Manager | 2018-03-06 | 6.5 MEDIUM | 8.8 HIGH |
| A remote malicious file upload vulnerability in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions prior to 7.6. | |||||
| CVE-2017-8955 | 1 Hp | 1 Intelligent Management Center | 2018-03-06 | 7.8 HIGH | 7.5 HIGH |
| A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.2 was found. | |||||
| CVE-2017-8984 | 1 Hp | 1 Intelligent Management Center | 2018-03-06 | 9.3 HIGH | 8.8 HIGH |
| A remote code execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0506P03 was found. | |||||
| CVE-2017-8983 | 1 Hp | 1 Intelligent Management Center | 2018-03-06 | 9.0 HIGH | 8.8 HIGH |
| A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P4 was found. | |||||
| CVE-2017-12554 | 1 Hp | 1 Intelligent Management Center | 2018-03-06 | 9.0 HIGH | 8.8 HIGH |
| A remote code execution vulnerability in HPE intelligent Management Center (iMC) PLAT iMC Plat 7.3 E0504P2 and earlier was found. | |||||
| CVE-2017-8958 | 1 Hp | 1 Intelligent Management Center | 2018-03-06 | 9.3 HIGH | 8.8 HIGH |
| A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 and earlier was found. | |||||
| CVE-2018-6293 | 1 Hyland | 1 Saperion Web Client | 2018-03-06 | 5.0 MEDIUM | 7.5 HIGH |
| Arbitrary File Read in Saperion Web Client version 7.5.2 83166. | |||||
| CVE-2017-12520 | 1 Hp | 1 Intelligent Management Center | 2018-03-06 | 9.0 HIGH | 8.8 HIGH |
| A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version. | |||||
| CVE-2017-18179 | 1 Progress | 1 Sitefinity | 2018-03-05 | 6.5 MEDIUM | 8.8 HIGH |
| Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a password change or a session termination. Also, it is transmitted as a GET parameter. This is fixed in 10.1. | |||||
| CVE-2017-5781 | 1 Hp | 1 Matrix Operating Environment | 2018-03-05 | 6.8 MEDIUM | 8.8 HIGH |
| A CSRF vulnerability in HPE Matrix Operating Environment version v7.6 was found. | |||||
| CVE-2016-8523 | 1 Hp | 1 Smart Storage Administrator | 2018-03-05 | 9.0 HIGH | 8.8 HIGH |
| A Remote Arbitrary Code Execution vulnerability in HPE Smart Storage Administrator version before v2.60.18.0 was found. | |||||
| CVE-2016-8518 | 1 Hp | 1 Systems Insight Manager | 2018-03-05 | 5.0 MEDIUM | 7.5 HIGH |
| A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found. | |||||
| CVE-2016-8516 | 1 Hp | 1 Systems Insight Manager | 2018-03-05 | 5.0 MEDIUM | 7.5 HIGH |
| A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found. | |||||
| CVE-2016-10007 | 1 Dotcms | 1 Dotcms | 2018-03-05 | 6.5 MEDIUM | 7.2 HIGH |
| SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_FORM_HANDLER_orderBy parameter. | |||||
| CVE-2016-10008 | 1 Dotcms | 1 Dotcms | 2018-03-05 | 6.5 MEDIUM | 7.2 HIGH |
| SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_STRUCTURE_direction parameter. | |||||
| CVE-2018-6186 | 1 Citrix | 1 Netscaler | 2018-03-03 | 9.0 HIGH | 8.8 HIGH |
| Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF attack via the /rapi/read_url URI by an authenticated attacker who has a webapp account. The attacker can gain access to the nsroot account, and execute remote commands with root privileges. | |||||
| CVE-2017-12724 | 1 Smiths-medical | 1 Medfusion 4000 Wireless Syringe Infusion Pump | 2018-03-02 | 6.8 MEDIUM | 8.1 HIGH |
| A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump contains hardcoded credentials, which are not fully initialized. The FTP server is only accessible if the pump is configured to allow FTP connections. | |||||
| CVE-2017-12726 | 1 Smiths-medical | 1 Medfusion 4000 Wireless Syringe Infusion Pump | 2018-03-02 | 7.5 HIGH | 7.3 HIGH |
| A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. Telnet on the pump uses hardcoded credentials, which can be used if the pump is configured to allow external communications. Smiths Medical assesses that it is not possible to upload files via Telnet and the impact of this vulnerability is limited to the communications module. | |||||
| CVE-2016-8533 | 1 Hp | 1 Matrix Operating Environment | 2018-03-02 | 6.5 MEDIUM | 8.8 HIGH |
| A remote priviledge escalation vulnerability in HPE Matrix Operating Environment version 7.6 was found. | |||||
| CVE-2016-8534 | 1 Hp | 1 Matrix Operating Environment | 2018-03-02 | 6.5 MEDIUM | 8.8 HIGH |
| A remote privilege elevation vulnerability in HPE Matrix Operating Environment version 7.6 was found. | |||||
| CVE-2015-2186 | 1 Edx | 2 Configuration, Edx-platform | 2018-03-02 | 5.0 MEDIUM | 7.5 HIGH |
| The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead of a boolean False for the CORS_ORIGIN_ALLOW_ALL setting. Note: this vulnerability was fixed on 2015-03-06, but the version number was not changed. | |||||
| CVE-2017-12545 | 3 Hp, Linux, Microsoft | 3 System Management Homepage, Linux Kernel, Windows | 2018-03-02 | 7.8 HIGH | 7.5 HIGH |
| A remote denial of service vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found. | |||||
| CVE-2017-13246 | 1 Google | 1 Android | 2018-03-01 | 5.0 MEDIUM | 7.5 HIGH |
| A information disclosure vulnerability in the Upstream kernel network driver. Product: Android. Versions: Android kernel. ID: A-36279469. | |||||
| CVE-2017-13243 | 1 Google | 1 Android | 2018-03-01 | 5.0 MEDIUM | 7.5 HIGH |
| A information disclosure vulnerability in the Android system (ui). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. ID: A-38258991. | |||||
| CVE-2018-1000045 | 1 Nasa | 1 Singledop | 2018-03-01 | 6.8 MEDIUM | 7.8 HIGH |
| NASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library (Weather data) that can result in remote code execution. This attack appear to be exploitable via Victim opening a specially crafted radar data file. This vulnerability appears to have been fixed in v1.1. | |||||
| CVE-2018-1000046 | 1 Nasa | 1 Pyblock | 2018-03-01 | 6.8 MEDIUM | 7.8 HIGH |
| NASA Pyblock version v1.0 - v1.3 contains a CWE-502 vulnerability in Radar data parsing library that can result in remote code execution. This attack appear to be exploitable via Victim opening a specially crafted radar data file. This vulnerability appears to have been fixed in v1.4. | |||||
| CVE-2018-1000047 | 1 Nasa | 1 Kodiak | 2018-03-01 | 6.8 MEDIUM | 8.8 HIGH |
| NASA Kodiak version v1.0 contains a CWE-502 vulnerability in Kodiak library's data processing function that can result in remote code execution. This attack appear to be exploitable via Victim opens an untrusted file for optimization using Kodiak library. | |||||
| CVE-2018-1000048 | 1 Nasa | 1 Rtretrievalframework | 2018-03-01 | 6.8 MEDIUM | 8.8 HIGH |
| NASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval functionality of RtRetrieval framework that can result in remote code execution. This attack appear to be exploitable via Victim tries to retrieve and process a weather data file. | |||||
| CVE-2018-6610 | 1 Jlike Project | 1 Jlike | 2018-03-01 | 5.0 MEDIUM | 7.5 HIGH |
| Information Leakage exists in the jLike 1.0 component for Joomla! via a task=getUserByCommentId request. | |||||
| CVE-2018-2392 | 1 Sap | 1 Internet Graphics Server | 2018-03-01 | 5.0 MEDIUM | 7.5 HIGH |
| Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable. | |||||
| CVE-2018-2393 | 1 Sap | 1 Internet Graphics Server | 2018-03-01 | 5.0 MEDIUM | 7.5 HIGH |
| Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable. | |||||
| CVE-2017-6279 | 1 Google | 1 Android | 2018-03-01 | 7.2 HIGH | 7.8 HIGH |
| NVIDIA libnvmmlite_audio.so contains an elevation of privilege vulnerability when running in media server which may cause an out of bounds write and could lead to local code execution in a privileged process. This issue is rated as high. Product: Android. Version: N/A. Android: A-65023166. Reference: N-CVE-2017-6279. | |||||
| CVE-2017-6258 | 1 Google | 1 Android | 2018-03-01 | 7.2 HIGH | 7.8 HIGH |
| NVIDIA libnvmmlite_audio.so contains an elevation of privilege vulnerability when running in media server which may cause an out of bounds write and could lead to local code execution in a privileged process. This issue is rated as high. Product: Android. Version: N/A. Android: A-38027496. Reference: N-CVE-2017-6258. | |||||
| CVE-2018-6792 | 1 Saifor | 1 Cvms Hub | 2018-03-01 | 6.5 MEDIUM | 8.8 HIGH |
| Multiple SQL injection vulnerabilities in Saifor CVMS HUB 1.3.1 allow an authenticated user to execute arbitrary SQL commands via multiple parameters to the /cvms-hub/privado/seccionesmib/secciones.xhtml resource. The POST parameters are j_idt118, j_idt120, j_idt122, j_idt124, j_idt126, j_idt128, and j_idt130 under formularioGestionarSecciones:tablaSeccionesMib:*:filter. The GET parameter is nombreAgente. | |||||
| CVE-2018-3605 | 1 Trendmicro | 1 Control Manager | 2018-03-01 | 6.5 MEDIUM | 8.8 HIGH |
| TopXXX, ViolationXXX, and IncidentXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arbitrary code on vulnerable installations. | |||||
| CVE-2018-1000019 | 1 Open-emr | 1 Openemr | 2018-03-01 | 9.0 HIGH | 8.8 HIGH |
| OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in fax_dispatch.php that can result in OS command injection by an authenticated attacker with any role. This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher. | |||||
| CVE-2018-6288 | 1 Kaspersky | 1 Secure Mail Gateway | 2018-03-01 | 6.8 MEDIUM | 8.8 HIGH |
| Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1. | |||||