CVEs published in January 2018
1,346 vulnerabilities, 169 critical, 4 exploited.
- embedthis goahead web serverEmbedThis GoAhead Webserver versions 4.0.0 and earlier is vulnerable to an integer overflow in...7.5 High
- cobbler project cobblerCobbler vulnerable to arbitrary code execution9.8 Critical
- bookstackapp bookstackBookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation...5.4 Medium
- brave browserBrave Software's Brave Browser, version 0.19.73 (and earlier) is vulnerable to an incorrect...4.7 Medium
- ffmpeg, libav, google chrome +2 moreIn line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017...6.5 Medium
- gnome gdm, display manager +1 moreA flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean...4.1 Medium
- plonePlone Unauthorized Access Vulnerability6.5 Medium
- ploneProducts.CMFPlone XSS in profile home_page property5.4 Medium
- ploneProducts.CMFPlone Open Redirect Vulnerability6.1 Medium
- smartySmarty PHP code injection9.8 Critical
- netgate pfsense, opnsense project opnsense +1 morepfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page...8.8 High
- elabftwELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos...5.4 Medium
- xmlbundle project xmlbundleXXE Vulnerability in XMLBundle 0.1.77.5 High
- acquia mauticMautic users able to download any files from server using filemanager6.5 Medium
- acquia mauticDisabled users able to log in with third party SSO plugin8.1 High
- acquia mauticInline JS XSS vulnerability in Mautic6.1 Medium
- [unknown] libexif, canonical ubuntu linux, debian linux +2 moreA vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of...6.1 Medium
- lavaliteStored XSS in LavaLite 5.2.45.4 Medium
waylandMageiaUpdated wayland packages fix security vulnerabilityNo scorepython-werkzeugMageiaUpdated python-werkzeug packages fix security vulnerabilityNo score- phpmyadminphpMyAdmin CSRF Vulnerability8.8 High
- androidsvg project androidsvgAndroid SVG vulnerable to XML External Entity (XXE)7.8 High
- pepperminty-wiki project pepperminty-wikiPepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting...9.8 Critical
- commsyCommsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality...8.8 High
- quickappscms quickapps cmsQuickApps CMS Cross-site Scripting5.4 Medium
firefoxUbuntufirefox regressionNo scoreraptor2MageiaUpdated raptor2 packages fix security vulnerabilityNo score- exiv2The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers...5.5 Medium
- octopus deployIn Octopus Deploy versions 3.2.11 - 4.1.5 (fixed in 4.1.6), an authenticated user with...8.8 High
- rocket.chatRocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to...9.8 Critical
- leanote desktopLeanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled...6.1 Medium
- shiba project shibaShiba vulnerable to XSS leading to code execution6.1 Medium
- invoiceninja invoice ninjaInvoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within...5.4 Medium
- debian linux, linux kernel, arista eos +26 more +28 moreThe tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11,...9.8 Critical
- awstats, debian linux +1 moreAwstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the ...9.8 Critical
- miniupnp project miniupnpdUninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in...7.8 High
- imagemagick, canonical ubuntu linux, debian linux +2 moreImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in...6.5 Medium
- leafpubLeafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within...5.4 Medium
- leanoteLeanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes6.1 Medium
- openmicroscopy omeroIn OMERO 5.3.3 or earlier a user could create an OriginalFile and adjust its path such that it...8.3 High
- creolabs gravityCreolabs Gravity 1.0 contains a stack based buffer overflow in the operator_string_add function,...9.8 Critical
- furikake project furikakeWordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect...6.1 Medium
- vanillaforums vanilla forumsVanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from...8.0 High
- marked project markedMarked vulnerable to XSS from data URIs6.1 Medium
- liferay portalLiferay Portal XSS vulnerability via movie parameter in the /html/portal/flash.jsp page6.1 Medium
- omniscale mapproxyMapProxy vulnerable to cross-site scripting in demo service6.1 Medium
- ez publisheZ Publish Cross-site Scripting (XSS) vulnerability6.1 Medium
- atom electronElectron vulnerable to URL spoofing via PDFium4.3 Medium
- b2evolutionb2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote...9.8 Critical
- lcdf gifsicle, debian linux +1 moreGifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function...9.8 Critical
- Show moreLoading…