Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2012-0771 | 1 Adobe | 1 Shockwave Player | 2018-03-18 | 9.3 HIGH | 8.8 HIGH |
| Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0759. | |||||
| CVE-2018-7217 | 1 Tejari | 1 Bravo Solution | 2018-03-18 | 6.5 MEDIUM | 8.8 HIGH |
| In Bravo Tejari Procurement Portal, uploaded files are not properly validated by the application either on the client or the server side. An attacker can take advantage of this vulnerability and upload malicious executable files to compromise the application, as demonstrated by an esop/evm/OPPreliminaryForms.do?formId=857 request. | |||||
| CVE-2018-7301 | 1 Eq-3 | 2 Homematic Central Control Unit Ccu2, Homematic Central Control Unit Ccu2 Firmware | 2018-03-18 | 7.5 HIGH | 9.8 CRITICAL |
| eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. This can be exploited by sending arbitrary XML-RPC requests to control the attached BidCos devices. | |||||
| CVE-2017-7375 | 3 Debian, Google, Xmlsoft | 3 Debian Linux, Android, Libxml2 | 2018-03-18 | 7.5 HIGH | 9.8 CRITICAL |
| A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable). | |||||
| CVE-2018-7272 | 1 Forgerock | 1 Access Management | 2018-03-18 | 4.0 MEDIUM | 6.5 MEDIUM |
| The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file. | |||||
| CVE-2015-0203 | 1 Apache | 1 Qpid | 2018-03-18 | 4.0 MEDIUM | 6.5 MEDIUM |
| The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via an AMQP message with (1) an invalid range in a sequence set, (2) content-bearing methods other than message-transfer, or (3) a session-gap control before a corresponding session-attach. | |||||
| CVE-2018-7339 | 1 Mp4v2 Project | 1 Mp4v2 | 2018-03-18 | 6.8 MEDIUM | 8.8 HIGH |
| The MP4Atom class in mp4atom.cpp in MP4v2 through 2.0.0 mishandles Entry Number validation for the MP4 Table Property, which allows remote attackers to cause a denial of service (overflow, insufficient memory allocation, and segmentation fault) or possibly have unspecified other impact via a crafted mp4 file. | |||||
| CVE-2018-5716 | 1 Reprisesoftware | 1 Reprise License Manager | 2018-03-18 | 8.5 HIGH | 8.1 HIGH |
| An issue was discovered in Reprise License Manager 11.0. This vulnerability is a Path Traversal where the attacker, by changing a field in the Web Request, can have access to files on the File System of the Server. By specifying a pathname in the POST parameter "lf" to the goform/edit_lf_get_data URI, the attacker can retrieve the content of a file. | |||||
| CVE-2018-7276 | 1 Lutron | 2 Quantum Bacnet Integration, Quantum Bacnet Integration Firmware | 2018-03-18 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered on Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) devices. Remote attackers can obtain potentially sensitive information via a /DbXmlInfo.xml request, as demonstrated by the Latitude/Longitude of the device. | |||||
| CVE-2017-10963 | 1 Samsung | 2 Knox Enterprise Mobility Management, Knox Identity Access Management | 2018-03-18 | 4.3 MEDIUM | 5.9 MEDIUM |
| In Knox SDS IAM (Identity Access Management) and EMM (Enterprise Mobility Management) 16.11 on Samsung mobile devices, a man-in-the-middle attacker can install any application into the Knox container (without the user's knowledge) by inspecting network traffic from a Samsung server and injecting content at a certain point in the update sequence. This installed application can further leak information stored inside the Knox container to the outside world. | |||||
| CVE-2018-7477 | 1 School Management Script Project | 1 School Management Script | 2018-03-18 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parent_module/parent_login.php. | |||||
| CVE-2015-7966 | 1 Gemalto | 1 Safenet Authentication Service Windows Logon Agent | 2018-03-17 | 4.6 MEDIUM | 7.8 HIGH |
| SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module, a different vulnerability than CVE-2015-7965. | |||||
| CVE-2018-4875 | 1 Adobe | 1 Experience Manager | 2018-03-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Adobe Experience Manager versions 6.1 and 6.0 are vulnerable to a reflected cross-site scripting vulnerability related to the handling of malicious content embedded in image files uploaded to the DAM. | |||||
| CVE-2018-6883 | 1 Piwigo | 1 Piwigo | 2018-03-17 | 4.0 MEDIUM | 4.9 MEDIUM |
| Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator. | |||||
| CVE-2015-7964 | 1 Gemalto | 1 Safenet Authentication Service For Nps Agent | 2018-03-17 | 4.6 MEDIUM | 7.8 HIGH |
| SafeNet Authentication Service for NPS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module. | |||||
| CVE-2015-7965 | 1 Gemalto | 1 Safenet Authentication Service Windows Logon Agent | 2018-03-17 | 4.6 MEDIUM | 7.8 HIGH |
| SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module, a different vulnerability than CVE-2015-7966. | |||||
| CVE-2015-7967 | 1 Gemalto | 1 Safenet Authentication Service For Citrix Web Interface Agent | 2018-03-17 | 4.6 MEDIUM | 7.8 HIGH |
| SafeNet Authentication Service for Citrix Web Interface Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module. | |||||
| CVE-2015-7963 | 1 Gemalto | 1 Safenet Authentication Service For Ad Fs Agent | 2018-03-17 | 4.6 MEDIUM | 7.8 HIGH |
| SafeNet Authentication Service for AD FS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module. | |||||
| CVE-2018-7463 | 1 Asanhamayesh | 1 Asanhamayesh Cms | 2018-03-17 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in files.php in the "files" component in ASANHAMAYESH CMS 3.4.6 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter. | |||||
| CVE-2015-7597 | 1 Gemalto | 1 Safenet Authentication Service Iis Agent | 2018-03-17 | 4.6 MEDIUM | 7.8 HIGH |
| SafeNet Authentication Service IIS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module. | |||||
| CVE-2015-7598 | 1 Gemalto | 1 Safenet Authentication Service Tokenvalidator Proxy Agent | 2018-03-17 | 4.6 MEDIUM | 7.8 HIGH |
| SafeNet Authentication Service TokenValidator Proxy Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module. | |||||
| CVE-2015-7961 | 1 Gemalto | 1 Safenet Authentication Service Remote Web Workplace Agent | 2018-03-17 | 4.6 MEDIUM | 7.8 HIGH |
| SafeNet Authentication Service Remote Web Workplace Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module. | |||||
| CVE-2015-7962 | 1 Gemalto | 1 Safenet Authentication Service For Outlook Web App Agent | 2018-03-17 | 4.6 MEDIUM | 7.8 HIGH |
| SafeNet Authentication Service for Outlook Web App Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module. | |||||
| CVE-2015-7596 | 1 Gemalto | 1 Safenet Authentication Service End User Software Tools For Windows | 2018-03-17 | 4.6 MEDIUM | 7.8 HIGH |
| SafeNet Authentication Service End User Software Tools for Windows uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module. | |||||
| CVE-2018-7289 | 1 Teclib-edition | 1 Armadito Antivirus | 2018-03-17 | 4.3 MEDIUM | 3.3 LOW |
| An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames containing pure UTF-16 characters can bypass detection. The user-mode service will fail to open the file for scanning after the conversion is done from Unicode to ANSI. This happens because characters that cannot be converted from Unicode are replaced with '?' characters. | |||||
| CVE-2016-0291 | 1 Ibm | 1 Bigfix Platform | 2018-03-17 | 9.0 HIGH | 8.8 HIGH |
| IBM BigFix Platform 9.0, 9.1 before 9.1.8, and 9.2 before 9.2.8 allow remote authenticated users to execute arbitrary commands by leveraging report server access. IBM X-Force ID: 111302. | |||||
| CVE-2018-7471 | 1 Bj-tct | 1 Kingview | 2018-03-17 | 7.2 HIGH | 7.8 HIGH |
| KingView 7.5SP1 has an integer overflow during stgopenstorage API read operations. | |||||
| CVE-2016-0369 | 1 Ibm | 1 Forms Experience Builder | 2018-03-17 | 4.0 MEDIUM | 2.7 LOW |
| XML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6 allows remote authenticated users to obtain sensitive information via crafted XML data. IBM X-Force ID: 112088. | |||||
| CVE-2018-7452 | 1 Xpdfreader | 1 Xpdf | 2018-03-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| A NULL pointer dereference in JPXStream::fillReadBuf in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demonstrated by pdftohtml. | |||||
| CVE-2018-7454 | 1 Xpdfreader | 1 Xpdf | 2018-03-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| A NULL pointer dereference in XFAForm::scanFields in XFAForm.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demonstrated by pdftohtml. | |||||
| CVE-2018-7455 | 1 Xpdfreader | 1 Xpdf | 2018-03-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| An out-of-bounds read in JPXStream::readTilePart in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demonstrated by pdftohtml. | |||||
| CVE-2018-7470 | 1 Imagemagick | 1 Imagemagick | 2018-03-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in ImageMagick 7.0.7-22 Q16. The IsWEBPImageLossless function in coders/webp.c allows attackers to cause a denial of service (segmentation violation) via a crafted file. | |||||
| CVE-2017-1774 | 1 Ibm | 1 Security Guardium Big Data Intelligence | 2018-03-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| IBM Security Guardium Big Data Intelligence (SonarG) 3.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 136818. | |||||
| CVE-2016-0299 | 1 Ibm | 1 Tririga Application Platform | 2018-03-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote attackers to obtain sensitive information via vectors involving a database query. IBM X-Force ID: 111382. | |||||
| CVE-2018-4906 | 1 Adobe | 4 Acrobat, Acrobat Dc, Acrobat Reader and 1 more | 2018-03-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation is part of the image conversion module that handles Enhanced Metafile Format Plus (EMF+) data related to graphic object image attributes. A successful attack can lead to sensitive data exposure. | |||||
| CVE-2018-4901 | 1 Adobe | 4 Acrobat, Acrobat Dc, Acrobat Reader and 1 more | 2018-03-17 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. The vulnerability is caused by the computation that writes data past the end of the intended buffer; the computation is part of the document identity representation. An attacker can potentially leverage the vulnerability to corrupt sensitive data or execute arbitrary code. | |||||
| CVE-2018-4902 | 1 Adobe | 4 Acrobat, Acrobat Dc, Acrobat Reader and 1 more | 2018-03-17 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the rendering engine. The vulnerability is triggered by a crafted PDF file containing a video annotation (and corresponding media files) that is activated by the embedded JavaScript. Successful exploitation could lead to arbitrary code execution. | |||||
| CVE-2016-6272 | 1 Epic | 1 Mychart | 2018-03-17 | 5.0 MEDIUM | 7.5 HIGH |
| XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as field labels, via the topic parameter to help.asp. NOTE: this was originally reported as a SQL injection vulnerability, but this may be inaccurate. | |||||
| CVE-2017-9425 | 1 Facetag Project | 1 Facetag | 2018-03-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag action. | |||||
| CVE-2018-7433 | 1 Ithemes | 1 Security | 2018-03-17 | 5.0 MEDIUM | 7.5 HIGH |
| The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page. | |||||
| CVE-2018-7484 | 1 Purevpn | 1 Purevpn | 2018-03-17 | 9.3 HIGH | 7.8 HIGH |
| An issue was discovered in PureVPN through 5.19.4.0 on Windows. The client installation grants the Everyone group Full Control permission to the installation directory. In addition, the PureVPNService.exe service, which runs under NT Authority\SYSTEM privileges, tries to load several dynamic-link libraries using relative paths instead of the absolute path. When not using a fully qualified path, the application will first try to load the library from the directory from which the application is started. As the residing directory of PureVPNService.exe is writable to all users, this makes the application susceptible to privilege escalation through DLL hijacking. | |||||
| CVE-2018-1399 | 1 Ibm | 1 Daeja Viewone | 2018-03-17 | 3.5 LOW | 5.4 MEDIUM |
| IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138435. | |||||
| CVE-2017-15696 | 1 Apache | 1 Geode | 2018-03-16 | 5.0 MEDIUM | 7.5 HIGH |
| When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code. | |||||
| CVE-2018-7469 | 1 Entrepreneur Job Portal Script Project | 1 Entrepreneur Job Portal Script | 2018-03-16 | 3.5 LOW | 4.8 MEDIUM |
| PHP Scripts Mall Entrepreneur Job Portal Script 2.0.9 has XSS via the p_name (aka Edit Category Name) field to admin/categories_industry.php (aka Categories - Industry Type). | |||||
| CVE-2017-12415 | 1 Oxid-esales | 1 Eshop | 2018-03-16 | 5.1 MEDIUM | 7.5 HIGH |
| OXID eShop Community Edition before 6.0.0 RC2 (development), 4.10.x before 4.10.5 (maintenance), and 4.9.x before 4.9.10 (legacy), Enterprise Edition before 6.0.0 RC2 (development), 5.2.x before 5.2.10 (legacy), and 5.3.x before 5.3.5 (maintenance), and Professional Edition before 6.0.0 RC2 (development), 4.9.x before 4.9.10 (legacy) and 4.10.x before 4.10.5 (maintenance) allow remote attackers to hijack the cart session of a client via Cross-Site Request Forgery (CSRF) if the following pre-conditions are met: (1) the attacker knows which shop is presently used by the client, (2) the attacker knows the exact time when the customer will add product items to the cart, (3) the attacker knows which product items are already in the cart (has to know their article IDs), and (4) the attacker would be able to trick user into clicking a button (submit form) of an e-mail or remote site within the period of visiting the shop and placing an order. | |||||
| CVE-2018-6534 | 1 Icinga | 1 Icinga | 2018-03-16 | 4.3 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an attacker can cause a NULL pointer dereference, which can cause the product to crash. | |||||
| CVE-2017-9426 | 1 Facetag Project | 1 Facetag | 2018-03-16 | 7.5 HIGH | 9.8 CRITICAL |
| ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag or facetag.listTags action. | |||||
| CVE-2018-7476 | 1 Finecms | 1 Finecms | 2018-03-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| controllers/admin/Linkage.php in dayrui FineCms 5.3.0 has Cross Site Scripting (XSS) via the id or lid parameter in a c=linkage,m=import request to admin.php, because the xss_clean protection mechanism is defeated by crafted input that lacks a '<' or '>' character. | |||||
| CVE-2017-16813 | 1 Foxitsoftware | 1 Mobilepdf | 2018-03-16 | 2.9 LOW | 5.5 MEDIUM |
| A denial-of-service issue was discovered in the Foxit MobilePDF app before 6.1 for iOS. This occurs when a user uploads a file that includes a hexadecimal Unicode character in the "filename" parameter via Wi-Fi, since the app could fail to parse this. | |||||
| CVE-2017-16814 | 1 Foxitsoftware | 1 Mobilepdf | 2018-03-16 | 3.3 LOW | 5.5 MEDIUM |
| A Directory Traversal issue was discovered in the Foxit MobilePDF app before 6.1 for iOS. This occurs by abusing the URL + escape character during a Wi-Fi transfer, which could be exploited by attackers to bypass intended restrictions on local application files. | |||||