Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-17863 | 2 Debian, Linux | 2 Debian Linux, Linux Kernel | 2018-03-16 | 7.2 HIGH | 7.8 HIGH |
| kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact. | |||||
| CVE-2017-15699 | 1 Apache | 2 Qpid Dispatch, Qpid Dispatch Firmware | 2018-03-15 | 6.8 MEDIUM | 6.5 MEDIUM |
| A Denial of Service vulnerability was found in Apache Qpid Dispatch Router versions 0.7.0 and 0.8.0. To exploit this vulnerability, a remote user must be able to establish an AMQP connection to the Qpid Dispatch Router and send a specifically crafted AMQP frame which will cause it to segfault and shut down. | |||||
| CVE-2018-2370 | 1 Sap | 1 Bi Launchpad | 2018-03-15 | 5.0 MEDIUM | 5.3 MEDIUM |
| Server Side Request Forgery (SSRF) vulnerability in SAP Central Management Console, BI Launchpad and Fiori BI Launchpad, 4.10, from 4.20, from 4.30, could allow a malicious user to use common techniques to determine which ports are in use on the backend server. | |||||
| CVE-2018-2371 | 1 Sap | 1 Netweaver Java Web Application | 2018-03-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting (XSS) vulnerability. | |||||
| CVE-2018-7039 | 1 Ccn-lite | 1 Ccn-lite | 2018-03-15 | 7.5 HIGH | 9.8 CRITICAL |
| CCN-lite 2.0.0 Beta allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact because the ccnl_ndntlv_prependBlob function in ccnl-pkt-ndntlv.c can be called with wrong arguments. Specifically, there is an incorrect integer data type causing a negative third argument in some cases of crafted TLV data with inconsistent length information. | |||||
| CVE-2017-18088 | 1 Atlassian | 1 Bitbucket | 2018-03-15 | 4.3 MEDIUM | 4.3 MEDIUM |
| Various plugin servlet resources in Atlassian Bitbucket Server before version 5.3.7 (the fixed version for 5.3.x), from version 5.4.0 before 5.4.6 (the fixed version for 5.4.x), from version 5.5.0 before 5.5.6 (the fixed version for 5.5.x), from version 5.6.0 before 5.6.3 (the fixed version for 5.6.x), from version 5.7.0 before 5.7.1 (the fixed version for 5.7.x) and before 5.8.0 allow remote attackers to conduct clickjacking attacks via framing various resources that lacked clickjacking protection. | |||||
| CVE-2011-4973 | 1 Mod Nss Project | 1 Mod Nss | 2018-03-15 | 7.5 HIGH | 9.8 CRITICAL |
| Authentication bypass vulnerability in mod_nss 1.0.8 allows remote attackers to assume the identity of a valid user by using their certificate and entering 'password' as the password. | |||||
| CVE-2017-5788 | 1 Hp | 2 Nonstop Server, Nonstop Server Software | 2018-03-15 | 4.9 MEDIUM | 5.5 MEDIUM |
| A Local Disclosure of Sensitive Information vulnerability in HPE NonStop Software Essentials version T0894 T0894H02 through T0894H02^AAI was found. | |||||
| CVE-2017-5797 | 1 Hp | 1 Intelligent Management Center | 2018-03-15 | 7.8 HIGH | 7.5 HIGH |
| A Remote Unauthenticated Disclosure of Information vulnerability in HPE Intelligent Management Center (IMC) SOM version v7.3 (E0501) was found. | |||||
| CVE-2017-5798 | 1 Hp | 1 Opencall Media Platform | 2018-03-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 (for OCMP 3.x), all versions prior to 4.4.7 RP702 (for OCMP 4.x). | |||||
| CVE-2017-5799 | 1 Hp | 1 Opencall Media Platform | 2018-03-15 | 6.5 MEDIUM | 8.8 HIGH |
| A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 (for OCMP 3.x), all versions prior to 4.4.7 RP702 (for OCMP 4.x). | |||||
| CVE-2017-5801 | 1 Hp | 1 Business Process Monitor | 2018-03-15 | 5.0 MEDIUM | 7.5 HIGH |
| A Remote Unauthorized Access to Data vulnerability in HPE Business Process Monitor version v09.2x, v09.30 was found. | |||||
| CVE-2017-8944 | 1 Hp | 1 Cloud Optimizer | 2018-03-15 | 7.8 HIGH | 7.5 HIGH |
| A Remote Disclosure of Information vulnerability in HPE Cloud Optimizer version v3.0x was found. | |||||
| CVE-2017-8946 | 1 Hp | 1 Aruba Airwave Glass | 2018-03-15 | 7.6 HIGH | 8.3 HIGH |
| A Remote Code Execution vulnerability in HPE Aruba AirWave Glass version v1.0.0 and 1.0.1 was found. | |||||
| CVE-2017-8947 | 1 Hp | 1 Ucmdb Configuration Manager | 2018-03-15 | 10.0 HIGH | 9.8 CRITICAL |
| A Remote Code Execution vulnerability in HPE UCMDB version v10.10, v10.11, v10.20, v10.21, v10.22, v10.30, v10.31 was found. | |||||
| CVE-2017-8969 | 1 Hp | 1 Insight Control | 2018-03-15 | 3.5 LOW | 5.7 MEDIUM |
| An improper input validation vulnerability in HPE Insight Control version 7.6 LR1 was found. | |||||
| CVE-2017-8970 | 1 Hp | 1 Matrix Operating Environment | 2018-03-15 | 5.0 MEDIUM | 5.3 MEDIUM |
| A remote unauthenticated disclosure of information vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found. | |||||
| CVE-2017-8978 | 1 Hp | 3 Icewall Mcrp, Icewall Mfa, Icewall Sso | 2018-03-15 | 4.9 MEDIUM | 4.6 MEDIUM |
| A Remote Unauthorized Disclosure of Information vulnerability in HPE IceWall Products version MFA 4.0 proxy was found. | |||||
| CVE-2018-6324 | 1 F-secure | 1 Radar | 2018-03-15 | 5.8 MEDIUM | 6.1 MEDIUM |
| F-Secure Radar (on-premises) before 2018-02-15 has an Unvalidated Redirect via the ReturnUrl parameter that triggers upon a user login. | |||||
| CVE-2018-6189 | 1 F-secure | 1 Radar | 2018-03-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| F-Secure Radar (on-premises) before 2018-02-15 has XSS via vectors involving the Tags parameter in the JSON request body in an outbound request for the /api/latest/vulnerabilityscans/tags/batch resource, aka a "suggested metadata tags for assets" issue. | |||||
| CVE-2018-5767 | 1 Tendacn | 2 Ac15, Ac15 Firmware | 2018-03-15 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered on Tenda AC15 V15.03.1.16_multi devices. A remote, unauthenticated attacker can gain remote code execution on the device with a crafted password parameter for the COOKIE header. | |||||
| CVE-2018-1000128 | 2018-03-15 | N/A | N/A | ||
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-7752. Reason: This candidate is a reservation duplicate of CVE-2018-7752. Notes: All CVE users should reference CVE-2018-7752 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. | |||||
| CVE-2018-4876 | 1 Adobe | 1 Experience Manager | 2018-03-14 | 4.3 MEDIUM | 6.1 MEDIUM |
| Adobe Experience Manager versions 6.3, 6.2, and 6.1 are vulnerable to cross-site scripting via a bypass of the Sling XSSAPI#getValidHref function. | |||||
| CVE-2015-5674 | 1 Freebsd | 1 Freebsd | 2018-03-14 | 4.0 MEDIUM | 6.5 MEDIUM |
| The routed daemon in FreeBSD 9.3 before 9.3-RELEASE-p22, 10.2-RC2 before 10.2-RC2-p1, 10.2-RC1 before 10.2-RC1-p2, 10.2 before 10.2-BETA2-p3, and 10.1 before 10.1-RELEASE-p17 allows remote authenticated users to cause a denial of service (assertion failure and daemon exit) via a query from a network that is not directly connected. | |||||
| CVE-2015-5725 | 1 Codeigniter | 1 Codeigniter | 2018-03-14 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors involving the offset variable. | |||||
| CVE-2018-7210 | 1 Idashboards | 1 Idashboards | 2018-03-14 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct request for the idb/config?CMD=installLicense URI, as demonstrated by intranet IP addresses and names of guest accounts. | |||||
| CVE-2018-7219 | 1 5none | 1 Nonecms | 2018-03-14 | 6.8 MEDIUM | 8.8 HIGH |
| application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request. | |||||
| CVE-2017-17159 | 1 Huawei | 4 Mt8-emui4.1, Mt8-emui4.1 Firmware, Nts-al00 and 1 more | 2018-03-14 | 6.1 MEDIUM | 6.5 MEDIUM |
| Some Huawei smart phones with software of NXT-AL10C00B386, NXT-CL00C92B386, NXT-DL00C17B386, NXT-TL00C01B386SP01, NTS-AL00C00B535 have a DoS vulnerability due to insufficient input validation. An unauthenticated attacker could send malformed System Information(SI) messages to the smart phone within radio range by special wireless device. Successful exploit could make the smart phone restart. | |||||
| CVE-2018-7176 | 1 Frontaccounting | 1 Frontaccounting | 2018-03-14 | 6.8 MEDIUM | 8.8 HIGH |
| FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions page). | |||||
| CVE-2017-17201 | 1 Huawei | 12 Berlin-emui5.0, Berlin-emui5.0 Firmware, Berlin-l21 and 9 more | 2018-03-14 | 4.3 MEDIUM | 5.5 MEDIUM |
| Some huawei smartphones with software BTV-DL09C233B350, Berlin-L21HNC432B360, Berlin-L22HNC636B360, Berlin-L24HNC567B360, Berlin-L21C10B130, Berlin-L21C185B132, Berlin-L21C464B130, Berlin-L22C346B140, Berlin-L22C636B160, Berlin-L23C605B131, Berlin-L23DOMC109B160, MHA-AL00AC00B125 have a DoS vulnerability. Due to insufficient input validation, an attacker could trick a user to execute a malicious application, which could be exploited by attacker to launch DoS attacks. | |||||
| CVE-2018-0515 | 1 Flets | 1 Azukeru Backup Tool | 2018-03-14 | 6.8 MEDIUM | 7.8 HIGH |
| Untrusted search path vulnerability in "FLET'S Azukeru Backup Tool" version 1.5.2.6 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | |||||
| CVE-2018-0516 | 1 Flets | 1 Address Selection Tool | 2018-03-14 | 6.8 MEDIUM | 7.8 HIGH |
| Untrusted search path vulnerability in FLET'S v4 / v6 address selection tool allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | |||||
| CVE-2018-0864 | 1 Microsoft | 1 Sharepoint Server | 2018-03-14 | 3.5 LOW | 5.4 MEDIUM |
| SharePoint Project Server 2013 and SharePoint Enterprise Server 2016 allow an information disclosure vulnerability due to how web requests are handled, aka "Microsoft SharePoint Information Disclosure Vulnerability". | |||||
| CVE-2017-17285 | 1 Huawei | 2 Lon-al00b, Lon-al00b Firmware | 2018-03-14 | 5.8 MEDIUM | 8.8 HIGH |
| Bluetooth module in some Huawei mobile phones with software LON-AL00BC00B229 and earlier versions has a buffer overflow vulnerability. Due to insufficient input validation, an unauthenticated attacker may craft Bluetooth AVDTP/AVCTP messages after successful paring, causing buffer overflow. Successful exploit may cause code execution. | |||||
| CVE-2018-0761 | 1 Microsoft | 2 Windows 7, Windows Server 2008 | 2018-03-14 | 2.1 LOW | 5.5 MEDIUM |
| The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure, due to how the Windows EOT font engine handles embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0755, CVE-2018-0760, and CVE-2018-0855. | |||||
| CVE-2018-0755 | 1 Microsoft | 2 Windows 7, Windows Server 2008 | 2018-03-14 | 2.1 LOW | 5.5 MEDIUM |
| The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure, due to how the Windows EOT font engine handles embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0760, CVE-2018-0761, and CVE-2018-0855. | |||||
| CVE-2018-0760 | 1 Microsoft | 3 Windows 7, Windows Server 2008, Windows Server 2012 | 2018-03-14 | 2.1 LOW | 5.5 MEDIUM |
| The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1, Windows Server 2008 R2, and Windows Server 2012 allows information disclosure, due to how the Windows EOT font engine handles embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0755, CVE-2018-0761, and CVE-2018-0855. | |||||
| CVE-2016-8742 | 2 Apache, Microsoft | 2 Couchdb, Windows | 2018-03-14 | 7.2 HIGH | 7.8 HIGH |
| The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in the install inherit the file permissions of the parent directory and therefore a non-privileged user can substitute any executable for the nssm.exe service launcher, or CouchDB batch or binary files. A subsequent service or server restart will then run that binary with administrator privilege. This issue affected CouchDB 2.0.0 (Windows platform only) and was addressed in CouchDB 2.0.0.1. | |||||
| CVE-2018-8086 | 2018-03-14 | N/A | N/A | ||
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. | |||||
| CVE-2015-3990 | 1 Sonicwall | 4 Analyzer, Global Management System, Uma Em5000 and 1 more | 2018-03-13 | 9.0 HIGH | N/A |
| The GMS ViewPoint (GMSVP) web application in Dell Sonicwall GMS, Analyzer, and UMA EM5000 before 7.2 SP4 allows remote authenticated users to execute arbitrary commands via vectors related to configuration. | |||||
| CVE-2009-5144 | 1 Mod Gnutls Project | 1 Mod Gnutls | 2018-03-13 | 5.0 MEDIUM | 7.5 HIGH |
| mod-gnutls does not validate client certificates when "GnuTLSClientVerify require" is set in a directory context, which allows remote attackers to spoof clients via a crafted certificate. | |||||
| CVE-2018-6461 | 2 March-hare, Microsoft | 2 Wincvs, Windows | 2018-03-13 | 9.3 HIGH | 7.8 HIGH |
| March Hare WINCVS before 2.8.01 build 6610, and CVS Suite before 2009R2 build 6610, contains an Insecure Library Loading vulnerability in the wincvs2.exe or wincvs.exe file, which may allow local users to gain privileges via a Trojan horse Python or TCL DLL file in the current working directory. | |||||
| CVE-2015-1416 | 1 Freebsd | 1 Freebsd | 2018-03-13 | 9.3 HIGH | 7.8 HIGH |
| Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other patch variants allow remote attackers to execute arbitrary shell commands via a crafted patch file. | |||||
| CVE-2015-4412 | 1 Bson Project | 1 Bson | 2018-03-13 | 7.5 HIGH | 9.8 CRITICAL |
| BSON injection vulnerability in the legal? function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service (resource consumption) or inject arbitrary data via a crafted string. | |||||
| CVE-2017-6200 | 1 Sandstorm | 1 Sandstorm | 2018-03-13 | 4.0 MEDIUM | 6.5 MEDIUM |
| Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip function doesn't filter Line Feed (\n) characters in a directory name. | |||||
| CVE-2017-6201 | 1 Sandstorm | 1 Sandstorm | 2018-03-13 | 5.5 MEDIUM | 8.1 HIGH |
| A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203. A remote attacker may exploit this issue by providing a URL. It could bypass access control such as firewalls that prevent the attackers from accessing the URLs directly. | |||||
| CVE-2017-6199 | 1 Sandstorm | 1 Sandstorm | 2018-03-13 | 7.5 HIGH | 9.8 CRITICAL |
| A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field. | |||||
| CVE-2017-6198 | 1 Sandstorm | 1 Sandstorm | 2018-03-13 | 6.8 MEDIUM | 6.5 MEDIUM |
| The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to cause a denial of service by launching a fork bomb in the sandbox, or by using a large amount of disk space. | |||||
| CVE-2016-7394 | 1 Tiki | 1 Tikiwiki Cms\/groupware | 2018-03-13 | 4.3 MEDIUM | 6.1 MEDIUM |
| tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie. | |||||
| CVE-2015-4400 | 1 Ring | 2 Ring, Ring Firmware | 2018-03-13 | 2.1 LOW | 4.6 MEDIUM |
| Ring (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information about the wireless network configuration by pressing the set up button and leveraging an API in the GainSpan Wi-Fi module. | |||||