Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-1750 | 1 Ibm | 1 Jazz Reporting Service | 2018-05-25 | 3.5 LOW | 5.4 MEDIUM |
| IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 135523. | |||||
| CVE-2018-8880 | 1 Lutron | 2 Quantum Bacnet Integration, Quantum Bacnet Integration Firmware | 2018-05-25 | 5.0 MEDIUM | 7.5 HIGH |
| Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing the /deviceIP information, which leads to internal network information disclosure. | |||||
| CVE-2018-9245 | 1 Ericssonlg | 1 Ipecs Nms | 2018-05-25 | 10.0 HIGH | 9.8 CRITICAL |
| The Ericsson-LG iPECS NMS A.1Ac login portal has a SQL injection vulnerability in the User ID and password fields that allows users to bypass the login page and execute remote code on the operating system. | |||||
| CVE-2017-2811 | 1 Kakadusoftware | 1 Kakadu Sdk | 2018-05-25 | 6.8 MEDIUM | 7.8 HIGH |
| A code execution vulnerability exists in the Kakadu SDK 7.9's parsing of compressed JPEG 2000 images. A specially crafted JPEG 2000 file can be read by the program, and can lead to an out of bounds write causing an exploitable condition to arise. | |||||
| CVE-2014-5014 | 1 Tinywebgallery | 1 Wordpress Flash Uploader | 2018-05-25 | 7.5 HIGH | 9.8 CRITICAL |
| The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path. | |||||
| CVE-2017-12087 | 1 Tinysvcmdns Project | 1 Tinysvcmdns | 2018-05-25 | 7.5 HIGH | 9.8 CRITICAL |
| An exploitable heap overflow vulnerability exists in the tinysvcmdns library version 2016-07-18. A specially crafted packet can make the library overwrite an arbitrary amount of data on the heap with attacker controlled values. An attacker needs send a dns packet to trigger this vulnerability. | |||||
| CVE-2017-2812 | 1 Kakadusoftware | 1 Kakadu Sdk | 2018-05-25 | 6.8 MEDIUM | 7.8 HIGH |
| A code execution vulnerability exists in the kdu_buffered_expand function of the Kakadu SDK 7.9. A specially crafted JPEG 2000 file can be read by the program and can lead to an out of bounds write causing an exploitable condition to arise. | |||||
| CVE-2018-10303 | 1 Foxitsoftware | 2 Foxit Reader, Phantompdf | 2018-05-25 | 6.8 MEDIUM | 8.8 HIGH |
| A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 allows remote attackers to execute arbitrary code, aka iDefense ID V-y0nqfutlf3. | |||||
| CVE-2018-9921 | 1 Cmsmadesimple | 1 Cms Made Simple | 2018-05-25 | 5.0 MEDIUM | 5.3 MEDIUM |
| In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and determine whether a file has contents matching a specified checksum. The attack uses an admin/checksum.php?__c= request. | |||||
| CVE-2018-10267 | 1 Wtcms Project | 1 Wtcms | 2018-05-25 | 6.8 MEDIUM | 8.8 HIGH |
| WTCMS 1.0 has a CSRF vulnerability to add an administrator account via the index.php?admin&m=user&a=add_post URI. | |||||
| CVE-2017-12109 | 1 Libxls Project | 1 Libxls | 2018-05-25 | 6.8 MEDIUM | 8.8 HIGH |
| An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULRK record. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability. | |||||
| CVE-2017-12108 | 1 Libxls Project | 1 Libxls | 2018-05-25 | 6.8 MEDIUM | 8.8 HIGH |
| An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULBLANK record. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability. | |||||
| CVE-2018-10295 | 1 Chemcms Project | 1 Chemcms | 2018-05-25 | 6.8 MEDIUM | 8.8 HIGH |
| ChemCMS v1.0.6 has CSRF by using public/admin/user/addpost.html to add an administrator account. | |||||
| CVE-2017-13073 | 1 Qnap | 1 Photo Station | 2018-05-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5.4.3, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML. | |||||
| CVE-2018-10265 | 1 Hongcms Project | 1 Hongcms | 2018-05-25 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI. | |||||
| CVE-2018-10268 | 1 Fastadmin | 1 Fastadmin | 2018-05-25 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in FastAdmin V1.0.0.20180417_beta. There is XSS via the application\api\controller\User.php avatar parameter. | |||||
| CVE-2018-10302 | 1 Foxitsoftware | 2 Foxit Reader, Phantompdf | 2018-05-25 | 6.8 MEDIUM | 7.8 HIGH |
| A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 allows remote attackers to execute arbitrary code, aka iDefense ID V-jyb51g3mv9. | |||||
| CVE-2018-6518 | 1 Compo | 1 Composr Cms | 2018-05-25 | 3.5 LOW | 4.8 MEDIUM |
| Composr CMS 10.0.13 has XSS via the site_name parameter in a page=admin-setupwizard&type=step3 request to /adminzone/index.php. | |||||
| CVE-2017-1724 | 1 Ibm | 5 Qradar Incident Forensics, Qradar Network Insights, Qradar Risk Manager and 2 more | 2018-05-25 | 3.5 LOW | 6.1 MEDIUM |
| IBM Security QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134814. | |||||
| CVE-2018-10266 | 1 Beescms | 1 Beescms | 2018-05-25 | 6.8 MEDIUM | 8.8 HIGH |
| BEESCMS 4.0 has a CSRF vulnerability to add an administrator account via the admin/admin_admin.php?nav=list_admin_user&admin_p_nav=user URI. | |||||
| CVE-2018-10329 | 1 Phpipam | 1 Phpipam | 2018-05-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| app/tools/mac-lookup/index.php in phpIPAM 1.3.1 has Reflected XSS on /tools/mac-lookup/ via the mac parameter. | |||||
| CVE-2017-1723 | 1 Ibm | 3 Qradar Incident Forensics, Qradar Network Insights, Qradar Security Information And Event Manager | 2018-05-25 | 4.0 MEDIUM | 6.5 MEDIUM |
| IBM Security QRadar SIEM 7.2 and 7.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 134812. | |||||
| CVE-2018-9102 | 1 Mitel | 2 Mivoice Connect, St 14.2 | 2018-05-25 | 4.3 MEDIUM | 6.5 MEDIUM |
| A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the signin interface. A successful exploit could allow an attacker to extract sensitive information from the database. | |||||
| CVE-2018-3836 | 2 Debian, Leptonica | 2 Debian Linux, Leptonica | 2018-05-25 | 7.2 HIGH | 7.8 HIGH |
| An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4. A specially crafted gplot rootname argument can cause a command injection resulting in arbitrary code execution. An attacker can provide a malicious path as input to an application that passes attacker data to this function to trigger this vulnerability. | |||||
| CVE-2018-10366 | 1 User Project | 1 User | 2018-05-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field. | |||||
| CVE-2018-10210 | 1 Vaultize | 1 Enterprise File Sharing | 2018-05-25 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. Enumeration of users is possible through the password-reset feature. | |||||
| CVE-2018-10422 | 1 Hongcms Project | 1 Hongcms | 2018-05-25 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field. | |||||
| CVE-2017-14740 | 1 Genixcms | 1 Genixcms | 2018-05-25 | 3.5 LOW | 4.8 MEDIUM |
| Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the Menu ID when adding a menu. | |||||
| CVE-2017-1721 | 1 Ibm | 1 Qradar Security Information And Event Manager | 2018-05-25 | 6.8 MEDIUM | 5.6 MEDIUM |
| IBM Security QRadar SIEM 7.2 and 7.3 could allow an unauthenticated user to execute code remotely with lower level privileges under unusual circumstances. IBM X-Force ID: 134810. | |||||
| CVE-2017-1722 | 1 Ibm | 1 Qradar Security Information And Event Manager | 2018-05-25 | 6.5 MEDIUM | 6.3 MEDIUM |
| IBM Security QRadar SIEM 7.2 and 7.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 134811. | |||||
| CVE-2014-2908 | 1 Siemens | 6 Simatic S7 Cpu-1211c, Simatic S7 Cpu 1200 Firmware, Simatic S7 Cpu 1212c and 3 more | 2018-05-25 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||||
| CVE-2014-5074 | 1 Siemens | 8 Simatic S7-1500 Cpu Firmware, Simatic S7-1511-1 Pn Cpu, Simatic S7-1513-1 Pn Cpu and 5 more | 2018-05-25 | 7.1 HIGH | N/A |
| Siemens SIMATIC S7-1500 CPU devices with firmware before 1.6 allow remote attackers to cause a denial of service (device restart and STOP transition) via crafted TCP packets. | |||||
| CVE-2016-8655 | 1 Linux | 1 Linux Kernel | 2018-05-25 | 7.2 HIGH | 7.8 HIGH |
| Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions. | |||||
| CVE-2016-9092 | 1 Symantec | 2 Content Analysis, Mail Threat Defense | 2018-05-25 | 6.8 MEDIUM | 8.8 HIGH |
| The Symantec Content Analysis (CA) 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense (MTD) 1.1 management consoles are susceptible to a cross-site request forging (CSRF) vulnerability. A remote attacker can use phishing or other social engineering techniques to access the management console with the privileges of an authenticated administrator user. | |||||
| CVE-2018-10220 | 1 Mushmush | 1 Glastopf | 2018-05-24 | 6.8 MEDIUM | 8.8 HIGH |
| ** DISPUTED ** Glastopf 3.1.3-dev has SSRF, as demonstrated by the abc.php a parameter. NOTE: the vendor indicates that this is intentional behavior because the product is a web application honeypot, and modules/handlers/emulators/rfi.py supports Remote File Inclusion emulation. | |||||
| CVE-2018-10312 | 1 Wuzhicms | 1 Wuzhi Cms | 2018-05-24 | 6.8 MEDIUM | 8.8 HIGH |
| index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member. | |||||
| CVE-2018-10368 | 1 Wuzhicms | 1 Wuzhi Cms | 2018-05-24 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in WUZHI CMS 4.1.0. The "Extension Module -> System Announcement" feature has Stored XSS via an announcement. | |||||
| CVE-2018-10391 | 1 Wuzhicms | 1 Wuzhi Cms | 2018-05-24 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI. | |||||
| CVE-2018-6917 | 1 Freebsd | 1 Freebsd | 2018-05-24 | 5.0 MEDIUM | 7.5 HIGH |
| In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, insufficient validation of user-provided font parameters can result in an integer overflow, leading to the use of arbitrary kernel memory as glyph data. Unprivileged users may be able to access privileged kernel data. | |||||
| CVE-2018-6919 | 1 Freebsd | 1 Freebsd | 2018-05-24 | 5.0 MEDIUM | 7.5 HIGH |
| In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, due to insufficient initialization of memory copied to userland, small amounts of kernel memory may be disclosed to userland processes. Unprivileged users may be able to access small amounts privileged kernel data. | |||||
| CVE-2014-0950 | 1 Ibm | 1 Rational Clearquest | 2018-05-24 | 5.5 MEDIUM | 7.1 HIGH |
| Multiple XML external entity (XXE) vulnerabilities in (1) CQWeb / CM Server, (2) ClearQuest Native client, (3) ClearQuest Eclipse client, and (4) ClearQuest Eclipse Designer components in IBM Rational ClearQuest 7.1.1 through 7.1.1.9, 7.1.2 through 7.1.2.13, 8.0.0 through 8.0.0.10, and 8.0.1 through 8.0.1.3 allow remote attackers to cause a denial of service or access other servers via crafted XML data. IBM X-Force ID: 92623. | |||||
| CVE-2018-10311 | 1 Wuzhicms | 1 Wuzhi Cms | 2018-05-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the tag[pinyin] parameter to the /index.php?m=tags&f=index&v=add URI. | |||||
| CVE-2018-10367 | 1 Wuzhicms | 1 Wuzhi Cms | 2018-05-24 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in WUZHI CMS 4.1.0. The content-management feature has Stored XSS via the title or content section. | |||||
| CVE-2017-17902 | 1 Kliqqi | 1 Kliqqi Cms | 2018-05-24 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection exists in Kliqqi CMS 3.5.2 via the randkey parameter of a new story at the pligg/story.php?title= URI. | |||||
| CVE-2018-10213 | 1 Vaultize | 1 Enterprise File Sharing | 2018-05-24 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is XSS in invitation mail received from a different user, who can modify the HTML in that mail before sending it. | |||||
| CVE-2017-15640 | 1 Phpipam | 1 Phpipam | 2018-05-24 | 3.5 LOW | 5.4 MEDIUM |
| app/sections/user-menu.php in phpIPAM before 1.3.1 has XSS via the ip parameter. | |||||
| CVE-2018-10206 | 1 Vaultize | 1 Enterprise File Sharing | 2018-05-24 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS via the optional message field of a file request. | |||||
| CVE-2018-10208 | 1 Vaultize | 1 Enterprise File Sharing | 2018-05-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is anonymous reflected XSS on the error page via a /share/error?message= URI. | |||||
| CVE-2018-10209 | 1 Vaultize | 1 Enterprise File Sharing | 2018-05-24 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS on the file or folder download pop-up via a crafted file or folder name. | |||||
| CVE-2018-9101 | 1 Mitel | 2 Mivoice Connect, St 14.2 | 2018-05-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the launch_presenter.php page. A successful exploit could allow an attacker to execute arbitrary scripts. | |||||