CVE Daily
← All years

Uncategorized 2018

Page 16/19.

CVEs without a recognized CWE (not present in the CWE map or marked as N/A).

CVSS ≥ 0.0
2018-02-15
Critical

CVE-2017-5802

A Remote Gain Privileged Access vulnerability in HPE Vertica Analytics Platform version v4.1 and later was found.

CVSS: 9.8CWE: N/A
Read more
Medium

CVE-2017-5787

A remote denial of service vulnerability in HPE Version Control Repository Manager (VCRM) in all versions prior to 7.6 was found.

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2017-5786

A local Unauthorized Data Modification vulnerability in HPE OfficeConnect Network Switches version PT.02.01 including PT.01.03 through PT.01.14

CVSS: 5.5CWE: N/A
Read more
Medium

CVE-2017-12553

A local authentication bypass vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 5.6CWE: N/A
Read more
Medium

CVE-2017-12552

A local arbitrary execution of commands vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 5.6CWE: N/A
Read more
Medium

CVE-2017-12551

A local arbitrary execution of commands vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 5.6CWE: N/A
Read more
Medium

CVE-2017-12550

A local security misconfiguration vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 5.6CWE: N/A
Read more
Medium

CVE-2017-12548

A local arbitrary command execution vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 5.6CWE: N/A
Read more
Medium

CVE-2017-12547

A local arbitrary command execution vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 5.6CWE: N/A
Read more
Critical

CVE-2017-12542

A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found.

CVSS: 10.0CWE: N/A
Read more
High

CVE-2016-8534

A remote privilege elevation vulnerability in HPE Matrix Operating Environment version 7.6 was found.

CVSS: 8.8CWE: CWE-264
Read more
High

CVE-2016-8533

A remote priviledge escalation vulnerability in HPE Matrix Operating Environment version 7.6 was found.

CVSS: 8.8CWE: CWE-264
Read more
High

CVE-2016-8528

A Remote Escalation of Privilege vulnerability in HPE Helion Eucalyptus version 3.3.0 through 4.3.1 was found.

CVSS: 8.8CWE: CWE-264
Read more
High

CVE-2016-8520

HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also ac…

CVSS: 8.8CWE: CWE-275
Read more
High

CVE-2016-8518

A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2016-8516

A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2017-17284

Huawei DP300 V500R002C00, RP200 V500R002C00, V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C01, V100R001C10, V500…

CVSS: 5.3CWE: N/A
Read more
Medium

CVE-2017-15340

Huawei smartphones with software of TAG-AL00C92B168 have an information disclosure vulnerability. An attacker tricks the user to install a crafted application, this application simulate click action…

CVSS: 5.5CWE: N/A
Read more
High

CVE-2017-18087

The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version 5…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2018-0850

Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run allow an elevation of privilege vulnerability due to how the for…

CVSS: 6.5CWE: N/A
Read more
High

CVE-2018-0846

The Windows Common Log File System (CLFS) driver in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709,…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2018-0844

The Windows Common Log File System (CLFS) driver in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709,…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2018-0842

Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709…

CVSS: 7.0CWE: N/A
Read more
High

CVE-2018-0841

Microsoft Office 2016 Click-to-Run allows a remote code execution vulnerability due to how objects are handled in memory, aka "Office Remote Code Execution Vulnerability"

CVSS: 8.8CWE: N/A
Read more
High

CVE-2018-0831

The Windows kernel in Windows 10 versions 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to how objects in memory are han…

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2018-0827

Windows Scripting Host (WSH) in Windows 10 versions 1703 and 1709 and Windows Server, version 1709 allows a Device Guard security feature bypass vulnerability due to the way objects are handled in me…

CVSS: 5.3CWE: N/A
Read more
High

CVE-2018-0826

Windows Storage Services in Windows 10 versions 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way objects a…

CVSS: 7.0CWE: N/A
Read more
High

CVE-2018-0825

StructuredQuery in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows S…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2018-0823

The Named Pipe File System in Windows 10 version 1709 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way the Named Pipe File System handles objects, aka "N…

CVSS: 7.0CWE: N/A
Read more
High

CVE-2018-0822

NTFS in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way NTFS handles objects, aka "Windo…

CVSS: 7.0CWE: N/A
Read more
High

CVE-2018-0820

The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Window…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2018-0809

The Windows kernel in Windows 10, versions 1703 and 1709, and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way objects are handled in memory, aka "Windows El…

CVSS: 7.0CWE: N/A
Read more
Medium

CVE-2018-0771

Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows a security feature bypass, due to how Edge handles different-origin requests, aka "Microsoft Edge Security Feature By…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2018-0757

The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Window…

CVSS: 4.7CWE: N/A
Read more
High

CVE-2018-0756

The Windows kernel in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way objects are handle…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2018-0742

The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Window…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2017-13273

In xt_qtaguid.c, there is a race condition due to insufficient locking. This could lead to local elevation of privileges with no additional execution privileges needed. User interaction is not needed…

CVSS: 7.0CWE: N/A
Read more
2018-02-14
Critical

CVE-2018-1287

In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unau…

CVSS: 9.8CWE: N/A
Read more
Medium

CVE-2018-2396

Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, using IGS Interpreter service.

CVSS: 6.5CWE: N/A
Read more
High

CVE-2018-2395

Under certain conditions a malicious user may retrieve information on SAP Internet Graphic Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, overwrite existing image or corrupt other type of files.

CVSS: 8.8CWE: N/A
Read more
Medium

CVE-2018-2394

Under certain conditions an unauthenticated malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, services and/or system…

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2018-2391

Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, via IGS portwatcher service.

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2018-2390

Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, via IGS Chart service.

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2018-2387

A vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to obtain information on ports, which is not available to the user otherwise.

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2018-2382

A vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to store graphics in a controlled area and as such gain information from system area…

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2018-2378

In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource consumption.

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2018-2377

In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized users.

CVSS: 6.5CWE: N/A
Read more
High

CVE-2018-2376

In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space.

CVSS: 8.1CWE: N/A
Read more
High

CVE-2018-2375

In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space.

CVSS: 8.1CWE: N/A
Read more
Medium

CVE-2018-2374

In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sensitive application data like service bindings within that sp…

CVSS: 6.5CWE: N/A
Read more
High

CVE-2018-2373

Under certain circumstances, a specific endpoint of the Controller's API could be misused by unauthenticated users to execute SQL statements that deliver information about system configuration in SAP…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2018-2369

Under certain conditions SAP HANA, 1.00, 2.00, allows an unauthenticated attacker to access information which would otherwise be restricted. An attacker can misuse the authentication function of the…

CVSS: 5.3CWE: N/A
Read more
2018-02-13
Critical

CVE-2018-1383

A software logic bug creates a vulnerability in an AIX 6.1, 7.1, and 7.2 daemon which could allow a user with root privileges on one system, to obtain root access on another machine. IBM X-force ID:…

CVSS: 9.1CWE: N/A
Read more
High

CVE-2017-1714

IBM Notes and Domino NSD 8.5 and 9.0 could allow an authenticated local user without administrative privileges to gain System privilege. IBM X-Force ID: 134633.

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2015-9252

An issue was discovered in QPDF before 7.0.0. Endless recursion causes stack exhaustion in QPDFTokenizer::resolveLiteral() in QPDFTokenizer.cc, related to the QPDF::resolve function in QPDF.cc.

CVSS: 5.5CWE: CWE-399
Read more
Critical

CVE-2018-6292

Remote Code Execution in Saperion Web Client version 7.5.2 83166.

CVSS: 9.8CWE: N/A
Read more
2018-02-12
High

CVE-2017-9967

A security misconfiguration vulnerability exists in Schneider Electric's IGSS SCADA Software versions 12 and prior. Security configuration settings such as Address Space Layout Randomization (ASLR) a…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2017-13245

A elevation of privilege vulnerability in the Upstream kernel audio driver. Product: Android. Versions: Android kernel. ID: A-64315347.

CVSS: 7.8CWE: N/A
Read more
High

CVE-2017-13244

A elevation of privilege vulnerability in the Upstream kernel easel. Product: Android. Versions: Android kernel. ID: A-62678986.

CVSS: 7.8CWE: N/A
Read more
High

CVE-2016-8742

The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in the install inherit the file permissions of the parent directory and therefore a…

CVSS: 7.8CWE: CWE-264
Read more
2018-02-09
High

CVE-2018-1000041

GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM…

CVSS: 8.8CWE: N/A
Read more
High

CVE-2018-1000024

The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2014-8171

The memory resource controller (aka memcg) in the Linux kernel allows local users to cause a denial of service (deadlock) by spawning new processes within a memory-constrained cgroup.

CVSS: 5.5CWE: CWE-399
Read more
High

CVE-2018-6826

An issue was discovered on VOBOT CLOCK before 0.99.30 devices. Cleartext HTTP is used to download a breakout program, and therefore man-in-the-middle attackers can execute arbitrary code by watching…

CVSS: 7.5CWE: N/A
Read more
Critical

CVE-2018-6871

LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function.

CVSS: 9.8CWE: N/A
Read more
2018-02-08
High

CVE-2017-15914

Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3.

CVSS: 8.8CWE: N/A
Read more
Critical

CVE-2011-4889

The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 does…

CVSS: 9.8CWE: CWE-254
Read more
Medium

CVE-2017-6227

A vulnerability in the IPv6 stack on Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b, 8.1.2 and 8.2.0 could allow an attacker to cause a denial of service (C…

CVSS: 6.5CWE: N/A
Read more
High

CVE-2018-0137

A vulnerability in the TCP throttling process of Cisco Prime Network could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerabil…

CVSS: 8.6CWE: CWE-399
Read more
2018-02-07
Medium

CVE-2017-15391

Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to access Extension pages without authorisation via a crafted HTML page.

CVSS: 6.5CWE: N/A
Read more
High

CVE-2017-15387

Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascript: URL windows when they should not be allowed to via a…

CVSS: 8.8CWE: N/A
Read more
High

CVE-2018-1366

IBM Content Navigator 2.0 and 3.0 is vulnerable to Comma Separated Value (CSV) Injection. An attacker could exploit this vulnerability to exploit other vulnerabilities in spreadsheet software. IBM X-…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2017-1692

IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. IBM X-Force ID: 134067.

CVSS: 7.8CWE: N/A
Read more
Critical

CVE-2018-6823

In the VPN client in Mailbutler Shimo before 4.1.5.1 on macOS, the com.feingeist.shimo.helper tool LaunchDaemon implements an unprotected XPC service that can be abused to execute scripts as root.

CVSS: 9.8CWE: N/A
Read more
Critical

CVE-2018-6822

In PureVPN 6.0.1 on macOS, HelperTool LaunchDaemon implements an unprotected XPC service that can be abused to execute system commands as root.

CVSS: 9.8CWE: N/A
Read more
2018-02-06
High

CVE-2016-3952

web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify. NOTE: this issue c…

CVSS: 7.8CWE: CWE-255
Read more
Medium

CVE-2015-4400

Ring (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information about the wireless network configuration by pressing the set up button and leveraging an API in the Gain…

CVSS: 4.6CWE: CWE-255
Read more
High

CVE-2018-6290

Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1.

CVSS: 7.8CWE: N/A
Read more
Critical

CVE-2016-6813

Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-"root") Cl…

CVSS: 9.8CWE: N/A
Read more
2018-02-05
High

CVE-2015-1416

Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other patch variants allow…

CVSS: 7.8CWE: CWE-264
Read more
Medium

CVE-2018-5795

An issue was discovered in Extreme Networks ExtremeWireless WiNG 5.x before 5.8.6.9 and 5.9.x before 5.9.1.3. There is Arbitrary File Write from the WebGUI on the WiNG Access Point / Controller.

CVSS: 4.9CWE: N/A
Read more
2018-02-03
High

CVE-2009-5144

mod-gnutls does not validate client certificates when "GnuTLSClientVerify require" is set in a directory context, which allows remote attackers to spoof clients via a crafted certificate.

CVSS: 7.5CWE: CWE-254
Read more
2018-02-02
High

CVE-2014-1835

The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table.

CVSS: 7.8CWE: CWE-255
Read more
Medium

CVE-2018-6542

In ZZIPlib 0.13.67, there is a bus error (when handling a disk64_trailer seek value) caused by loading of a misaligned address in the zzip_disk_findfirst function of zzip/mmapped.c.

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2018-6541

In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could lever…

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2018-6540

In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address in the zzip_disk_findfirst function of zzip/mmapped.c. Remote attackers could leverage this vulnerability to cause a…

CVSS: 6.5CWE: N/A
Read more
Critical

CVE-2018-6521

The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in which this allows remo…

CVSS: 9.8CWE: N/A
Read more
2018-02-01
Medium

CVE-2017-2293

Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove arbitrary packages on all managed agents. Th…

CVSS: 4.9CWE: N/A
Read more
High

CVE-2017-3160

After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI…

CVSS: 7.4CWE: N/A
Read more
Medium

CVE-2014-9503

The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with "access content" permissions to modify arbitrary nodes by leveraging imp…

CVSS: 6.5CWE: CWE-264
Read more
Medium

CVE-2014-3752

The MiniIcpt.sys driver in G Data TotalProtection 2014 24.0.2.1 and earlier allows local users with administrator rights to execute arbitrary code with SYSTEM privileges via a crafted 0x83170180 call.

CVSS: 6.7CWE: CWE-264
Read more
Medium

CVE-2018-6484

In ZZIPlib 0.13.67, there is a memory alignment error and bus error in the __zzip_fetch_disk_trailer function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of se…

CVSS: 6.5CWE: N/A
Read more
Critical

CVE-2017-16861

It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or…

CVSS: 9.8CWE: N/A
Read more
2018-01-31
High

CVE-2018-6479

An issue was discovered on Netwave IP Camera devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to the / URI.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2014-1632

htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter.

CVSS: 8.1CWE: CWE-275
Read more
High

CVE-2014-1631

Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php.

CVSS: 7.5CWE: CWE-275
Read more
2018-01-30
Critical

CVE-2016-6599

BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a method that can be used to retrieve a co…

CVSS: 9.8CWE: CWE-255
Read more
High

CVE-2017-1731

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security when using the Administrative Console. An authenticated remote attacker could exploit this vulnerab…

CVSS: 8.8CWE: N/A
Read more
2018-01-26
Medium

CVE-2017-1545

IBM Doors Web Access 9.5 and 9.6 could allow an attacker with physical access to the system to log into the application using previously stored credentials. IBM X-Force ID: 130914.

CVSS: 6.8CWE: N/A
Read more
High

CVE-2017-18076

In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the enviro…

CVSS: 7.5CWE: N/A
Read more
2018-01-25
High

CVE-2017-15365

sql/event_data_objects.cc in MariaDB before 10.1.30 and 10.2.x before 10.2.10 and Percona XtraDB Cluster before 5.6.37-26.21-3 and 5.7.x before 5.7.19-29.22-3 allows remote authenticated users with S…

CVSS: 8.8CWE: N/A
Read more
2018-01-24
Critical

CVE-2018-1000007

libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the hos…

CVSS: 9.8CWE: N/A
Read more
Critical

CVE-2018-5777

An issue was discovered in Ipswitch WhatsUp Gold before 2017 Plus SP1 (17.1.1). Remote clients can take advantage of a misconfiguration in the TFTP server that could allow attackers to execute arbitr…

CVSS: 9.8CWE: N/A
Read more
Critical

CVE-2017-15718

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.

CVSS: 9.8CWE: N/A
Read more
2018-01-23
High

CVE-2017-2747

HP has identified a potential security vulnerability before IG_11_00_00.10 for DesignJet T790, T795, T1300, T2300, before MRY_04_05_00.5 for DesignJet T920, T930, T1500, T1530, T2500, T2530, before A…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2017-2742

A potential security vulnerability has been identified with HP Web Jetadmin before 10.4 SR2. This vulnerability could potentially be exploited to create a denial of service.

CVSS: 7.5CWE: N/A
Read more
Critical

CVE-2017-2741

A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmware before 1708D. This vulnerability could potentially be exploited to execute a…

CVSS: 9.8CWE: N/A
Read more
High

CVE-2017-2740

A potential security vulnerability has been identified with the command line shell of the HP ThinPro operating system 6.1, 5.2.1, 5.2, 5.1, 5.0, and 4.4. The vulnerability could result in a local una…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2015-1142857

On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF. This includes Linux kernel ixgbe driver before commit f079fa005aae08ee0e1bc32…

CVSS: 8.6CWE: CWE-254
Read more
2018-01-22
High

CVE-2018-0862

Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way ob…

CVSS: 8.8CWE: N/A
Read more
High

CVE-2018-0849

Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way ob…

CVSS: 8.8CWE: N/A
Read more
High

CVE-2018-0848

Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way ob…

CVSS: 8.8CWE: N/A
Read more
High

CVE-2018-0845

Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way ob…

CVSS: 7.8CWE: N/A
Read more
Critical

CVE-2018-5999

An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails.

CVSS: 9.8CWE: N/A
Read more
Medium

CVE-2018-1043

In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.

CVSS: 6.5CWE: N/A
Read more
2018-01-21
Critical

CVE-2017-18045

JBMC DirectAdmin before 1.52, when the email_ftp_password_change setting is nonzero, allows remote attackers to obtain access or cause a denial of service (segfault) via an unspecified request.

CVSS: 9.8CWE: N/A
Read more
2018-01-20
Critical

CVE-2017-14803

In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrar…

CVSS: 9.8CWE: N/A
Read more
2018-01-19
High

CVE-2017-14460

An exploitable overly permissive cross-domain (CORS) whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8. An automatically sent JSON object to JSON-RPC endpoint can tri…

CVSS: 7.5CWE: N/A
Read more
Critical

CVE-2017-14097

An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to decrypt contents of a database with information that cou…

CVSS: 9.8CWE: N/A
Read more
Medium

CVE-2014-4919

OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition before 5.0.13 and 5.1.x before 5.1.7, and Community Edition before 4.7.13 and 4.8.x before 4.8.7 allow remote…

CVSS: 5.4CWE: CWE-264
Read more
>