CVEs published in April 2018
1,684 vulnerabilities, 383 critical, 5 exploited.
- nasa cfitsio, talos nasa cfitsio, fedoraproject fedora +2 moreIn the ffghbn function in NASA CFITSIO 3.42, specially crafted images parsed via the library can...8.8 High
- nasa cfitsio, talos nasa cfitsio, fedoraproject fedora +2 moreIn the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the...8.8 High
- pbootcmsPbootCMS v0.9.8 allows PHP code injection via an IF label in index.php/About/6.html or admin.php...9.8 Critical
- pbootcmsPbootCMS v0.9.8 has CSRF via an admin.php/Message/mod/id/19.html?backurl=/index.php request,...8.8 High
- xyhcms project xyhcmsAn issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php.6.1 Medium
- xyhcms project xyhcmsAn issue was discovered in XYHCMS 3.5. It has CSRF via an index.php?g=Manage&m=Rbac&a=addUser...8.8 High
- theforeman foreman, unspecified foreman-debug, redhat satellite +2 moreforeman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An...4.7 Medium
- redhat openshiftopenshift before versions 3.3.1.11, 3.2.1.23, 3.4 is vulnerable to a flaw when a volume fails to...4.3 Medium
- legion of the bouncy castle bouncy castle, bouncycastle bc-java, redhat satellite +1 more +3 moreBouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions4.4 Medium
- coderium installer of soundengine free, soundengine +1 moreUntrusted search path vulnerability in Installer of SoundEngine Free ver.5.21 and earlier allows...7.8 High
- securebrain phishwall, securebrain corporation the installer of phishwall client internet explorer edition +1 moreUntrusted search path vulnerability in The installer of PhishWall Client Internet Explorer...7.8 High
- hatena bookmark, hatena co.,ltd. bookmark app for ios +1 moreHatena Bookmark App for iOS Version 3.0 to 3.70 allows remote attackers to spoof the address bar...6.5 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreCross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.1 allows remote authenticated...5.4 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreCybozu Garoon 3.5.0 to 4.6.1 allows remote authenticated attackers to bypass access restriction...4.3 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreCross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.0 allows remote authenticated...5.4 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreCybozu Garoon 4.0.0 to 4.6.0 allows remote authenticated attackers to bypass access restriction...4.3 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreCybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction...4.9 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreCybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction...2.7 Low
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreCybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction...4.3 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreSQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated...8.8 High
- dlink dir-815 firmwareD-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have...6.1 Medium
- dlink dir-815 firmwareD-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have...6.1 Medium
- dlink dir-815 firmwareD-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have...9.8 Critical
- chanzhiQingDao Nature Easy Soft Chanzhi Enterprise Portal System (aka chanzhieps) pro1.6 allows remote...7.5 High
linux-toolsDebianlinux-tools - security updateNo score- imagemagick, canonical ubuntu linux +1 moreIn ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders...6.5 Medium
- debian linux, linux kernel, canonical ubuntu linux +2 moreThe kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an...5.5 Medium
- openssl, canonical ubuntu linux +1 moreCache timing vulnerability in RSA Key Generation5.9 Medium
- libxlsAn exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of...8.8 High
- libxlsAn exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of...8.8 High
- monstraplugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an...4.8 Medium
- libreoffice, canonical ubuntu linux, debian linux +3 more +5 moreThe SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4...7.8 High
- libreoffice, canonical ubuntu linux, debian linux +3 more +5 moresot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an...7.8 High
- zblogcn z-blogphpZ-BlogPHP 1.5.1 has XSS via the zb_users/plugin/AppCentre/plugin_edit.php app_id parameter. The...4.8 Medium
- zblogcn z-blogphpThe plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP...7.2 High
flash-player-pluginMageiaUpdated flash-player-plugin packages fix security vulnerabilityNo score- monstraMonstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin...4.8 Medium
- icmsdev icmsAn issue was discovered in idreamsoft iCMS V7.0.7. There is a CSRF vulnerability that can add an...8.8 High
- geglAn issue was discovered in GEGL through 0.3.32. The gegl_buffer_iterate_read_simple function in...8.8 High
- gegl generic graphics libraryAn issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm...7.5 High
- geglAn issue was discovered in GEGL through 0.3.32. The gegl_tile_backend_swap_constructed function...8.8 High
- geglAn issue was discovered in GEGL through 0.3.32. The render_rectangle function in process/gegl...7.5 High
- monstraMonstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role,...4.8 Medium
- wordpress, debian linux +1 moreBefore WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and...6.1 Medium
- wordpress, debian linux +1 moreBefore WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the...6.1 Medium
- wordpress, debian linux +1 moreBefore WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if...6.1 Medium
- perl, canonical ubuntu linux, debian linux +2 moreHeap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent...9.8 Critical
- perl, canonical ubuntu linux, debian linux +2 more +4 moreAn issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular...7.5 High
- perl, canonical ubuntu linux, debian linux +2 more +4 moreAn issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap...9.8 Critical
- smartscriptsolutions domain traderXSS exists in Domain Trader 2.5.3 via the recoverlogin.php email_address parameter.6.1 Medium
- Show moreLoading…