CVEs published in April 2018
1,684 vulnerabilities, 383 critical, 5 exploited.
- agentejo cockpitSSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows remote attackers to read arbitrary...9.1 Critical
- onethinkSSRF (Server Side Request Forgery) in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1...9.8 Critical
- ibm websphere mqIBM WebSphere MQ 7.5.x before 7.5.0.6 and 8.0.x before 8.0.0.3 allows remote authenticated users...5.3 Medium
- ibm security siteprotector systemIBM Security SiteProtector System 3.0, 3.1.0 and 3.1.1 allows remote attackers to bypass intended...7.5 High
- horde ldapThe Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by...8.1 High
- ezpz-one-click-backup project ezpz-one-click-backupThe EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress...9.8 Critical
- open-xchange appsuiteThe backend in Open-Xchange (OX) AppSuite 7.4.2 before 7.4.2-rev9 allows remote attackers to...5.3 Medium
- 3ds catiaStack-based buffer overflow in Dassault Systemes CATIA V5-6R2013 allows remote attackers to...9.8 Critical
- opendocmanOpenDocMan 1.2.7 and earlier does not properly validate allowed actions, which allows remote...8.8 High
- buddypressThe Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote...6.5 Medium
- entity api project api, fedoraproject fedora +1 moreThe entity_access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow...6.5 Medium
- entity api project api, fedoraproject fedora +1 moreThe entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might...6.5 Medium
- entity api project api, fedoraproject fedora +1 moreThe entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might...6.5 Medium
- atlassian application linksVarious administrative application link resources in Atlassian Application Links before version 5...4.8 Medium
- atlassian jira, jira server +1 moreVarious administrative external system import resources in Atlassian JIRA Server (including JIRA...6.5 Medium
- atlassian jiraThe agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to...6.1 Medium
- freebsdIn FreeBSD before 11.0-STABLE, 11.0-RELEASE-p10, 10.3-STABLE, and 10.3-RELEASE-p19, ipfilter...7.5 High
- metinfoThe reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords...8.8 High
- metinfoCross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to...6.1 Medium
- wuzhicmsAn issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a user...8.8 High
- wuzhicmsAn issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin...8.8 High
- icmsdev icmsAn issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an...5.4 Medium
- icmsdev icmsAn issue was discovered in idreamsoft iCMS through 7.0.7. SQL injection exists via the pid array...9.8 Critical
- icmsdev icmsAn issue was discovered in idreamsoft iCMS through 7.0.7. CSRF exists in admincp.php, as...8.8 High
- icmsdev icmsAn issue was discovered in idreamsoft iCMS through 7.0.7. Physical path leakage exists via an...5.3 Medium
- signalThe Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass...6.8 Medium
- qpdf project qpdf, canonical ubuntu linux +1 morelibqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key but found non-name...7.8 High
- lcds laquis scada, ics-cert lcds - leão consultoria e desenvolvimento de sistemas ltda me laquis scada +1 moreA structured exception handler overflow vulnerability in Leao Consultoria e Desenvolvimento de...7.8 High
- maharaMahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.10 before 17.10.4 are vulnerable to...6.1 Medium
- dell emc avamar, emc integrated data protection appliance, dell emc avamar, integrated data protection appliance +2 moreAvamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC...9.8 Critical
- talos zabbix, debian linux +1 moreAn information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4...3.7 Low
- 3cx live chatThe WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.6.1 Medium
ubuntu-release-upgraderUbuntuubuntu-release-upgrader vulnerabilityNo score- hyper runvutil.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain...7.8 High
- apache solr, debian linux +1 moreThere is a XML external entity expansion (XXE) vulnerability in Apache Solr7.5 High
- buffalo inc. wzr-1750dhp2, buffalo wzr-1750dhp2 firmware +1 moreBuffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary OS commands via...8.8 High
- buffalo inc. wzr-1750dhp2, buffalo wzr-1750dhp2 firmware +1 moreBuffer overflow in Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute...7.8 High
- buffalo inc. wzr-1750dhp2, buffalo wzr-1750dhp2 firmware +1 moreBuffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to bypass authentication and execute...8.8 High
- glamo inc. iremoconwifi app for android, glamo iremocon wifi +1 moreThe iRemoconWiFi App for Android version 4.1.7 and earlier does not verify X.509 certificates...7.4 High
- lxr project lxrLXR version 1.0.0 to 2.3.0 allows remote attackers to execute arbitrary OS commands via...9.8 Critical
- match clone script project clone scriptPHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the...6.1 Medium
- kotti project kottiKotti CSRF in the local roles implementation8.8 High
python-cryptoDebianpython-crypto - security updateNo score- redhat pcs, clusterlabs pacemaker command line interface, debian linux +1 more +3 morepcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST...4.3 Medium
- typo3Typo3 XSS Vulnerability4.8 Medium
- gxlcms qyIn Gxlcms QY v1.0.0713, Lib\Lib\Action\Home\HitsAction.class.php allows remote attackers to read...9.8 Critical
- gxlcms qyIn Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to read...7.5 High
- gxlcms qyIn Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to...7.5 High
- xmlsoft libxml2, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreUncontrolled resource consumption in nokogiri6.5 Medium
- gxlcms qyIn Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows...9.8 Critical
- Show moreLoading…