CVEs published in April 2018
1,684 vulnerabilities, 383 critical, 5 exploited.
- oracle mysql, oracle corporation mysql server, canonical ubuntu linux +13 more +15 moreVulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs)....5.9 Medium
- oracle mysql, oracle corporation mysql server, canonical ubuntu linux +5 more +7 moreVulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported...4.9 Medium
- oracle mysql, oracle corporation mysql server +1 moreVulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security :...6.5 Medium
- oracle mysql, oracle corporation mysql server, canonical ubuntu linux +13 more +15 moreVulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication)....7.7 High
- artifex ghostscript, canonical ubuntu linux, debian linux +6 more +8 moreThe set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex...7.8 High
- logmein lastpassLogMeIn LastPass through 4.15.0 allows remote attackers to cause a denial of service (browser...7.5 High
- gunicorn, debian linux +1 moreGunicorn contains Improper Neutralization of CRLF sequences in HTTP headers7.5 High
- yokogawa centum cs 3000, centum vp, exaopc +3 more +5 moreA weakness in access controls in CENTUM CS 1000 all versions, CENTUM CS 3000 versions R3.09.50...6.5 Medium
- ipvanishIPVanish 3.0.11 for macOS suffers from a root privilege escalation vulnerability. The `com...9.8 Critical
- mruby, debian linux +1 moreIn versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c:...9.8 Critical
- appeartv xc5000 firmware, xc5100 firmware +1 moreOn Appear TV XC5000 and XC5100 devices with firmware 3.26.217, it is possible to read OS files...9.8 Critical
- londontrustmedia private internet accessA vulnerability in London Trust Media Private Internet Access (PIA) VPN Client v77 for Windows...7.8 High
- mauticMautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID7.5 High
- radare radare2In radare2 2.5.0, there is a heap-based buffer over-read in the dalvik_op function (libr/anal/p...5.5 Medium
- radare radare2In radare2 2.5.0, there is a heap-based buffer over-read in the r_hex_bin2str function (libr/util...5.5 Medium
- talos foscam, foscam c1 firmware +1 moreInsufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD...9.6 Critical
- ics-cert omron cx-one, omron cx-flnet, cx-one +5 more +7 moreParsing malformed project files in Omron CX-One versions 4.42 and prior, including the following...7.8 High
- ics-cert omron cx-one, omron cx-flnet, cx-one +5 more +7 moreParsing malformed project files in Omron CX-One versions 4.42 and prior, including the following...7.8 High
- ics-cert omron cx-one, omron cx-flnet, cx-one +5 more +7 moreParsing malformed project files in Omron CX-One versions 4.42 and prior, including the following...7.8 High
- tuzicmsAn issue was discovered in TuziCMS v2.0.6. There is a CSRF vulnerability that can add an admin...8.8 High
- openwebanalytics open web analyticsOpen Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection...9.8 Critical
- tibco jasperreports server, jaspersoft, jaspersoft reporting and analytics +4 more +6 moreTIBCO JasperReports Server Cross Site Scripting Vulnerability6.3 Medium
- tibco jasperreports, jasperreports server, jaspersoft +5 more +7 moreTIBCO JasperReports Server Information Disclosure Vulnerability7.7 High
- tibco jasperreports library, jasperreports server, jaspersoft +10 more +12 moreTIBCO JasperReports Library Code Sandboxing Problem8.8 High
- ibm websphere portalIBM WebSphere Portal 8.0.0 through 8.0.0.1, 8.5, and 9.0 is vulnerable to cross-site scripting....5.4 Medium
- ibm mq, websphere mq +1 moreAn IBM WebSphere MQ 8.0.0.8, 9.0.0.2, and 9.0.4 Client connecting to a MQ Queue Manager can cause...6.5 Medium
- bigtreecms bigtree cmsAn issue was discovered in BigTree 4.2.22. There is cross-site scripting (XSS) in /core/inc/lib...6.1 Medium
- mitsubishi electric europe b.v. e-designerMitsubishi E-Designer, Version 7.52 Build 344 contains six code sections which may be exploited...9.8 Critical
- mitsubishi electric europe b.v. e-designerMitsubishi E-Designer, Version 7.52 Build 344 contains five code sections which may be exploited...9.8 Critical
- mitsubishi electric europe b.v. e-designerMitsubishi E-Designer, Version 7.52 Build 344 contains two code sections which may be exploited...9.8 Critical
- lcds laquis scada, lcds - leã£o consultoria e desenvolvimento de sistemas ltda me laquis scada software +1 moreLeao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions...5.3 Medium
- bmc medical luna cpap machine, cpap luna cpap machine firmware +1 moreBMC Medical Luna CPAP Machines released prior to July 1, 2017, contain an improper input...6.5 Medium
- picturesproPicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access...9.8 Critical
- atlassian atlassian-renderer, jira server +1 moreThe wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows...5.4 Medium
- iac fromdoctopdfThe FromDocToPDF extension before 13.611.13.2303 for Chrome allows remote attackers to discover...5.3 Medium
- 7-zip7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the...8.8 High
- nordvpnNordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the...9.8 Critical
- protonmail protonvpnProtonVPN 1.3.3 for Windows suffers from a SYSTEM privilege escalation vulnerability through the ...9.8 Critical
- mikrotik router firmwareA vulnerability in MikroTik Version 6.41.4 could allow an unauthenticated remote attacker to...7.5 High
- catalooksupport .netstoreThe CATALooK.netStore module through 7.2.8 for DNN (formerly DotNetNuke) allows XSS via the ...6.1 Medium
- symantec management console, symantec corporation itms +1 moreThe Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6, and ITMS 7.6_POST_HF7...8.0 High
- symantec endpoint protectionSymantec Endpoint Protection clients place detected malware in quarantine as part of the intended...7.8 High
- symantec endpoint protectionA version of the SymEvent Driver that shipped with Symantec Endpoint Protection 12.1 RU6 MP6 and...7.0 High
- iscripts uberforxiScripts UberforX 2.2 has CSRF in the "manage_settings" section of the Admin Panel via the /cms...8.8 High
- iscripts uberforxiScripts UberforX 2.2 has Stored XSS in the "manage_settings" section of the Admin Panel via a...6.1 Medium
- iscripts eswapiScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User...6.1 Medium
- ibm security appscanCross-site scripting (XSS) vulnerability in IBM AppScan Enterprise Edition 9.0.x before 9.0.2...5.4 Medium
- node.jsThe HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header,...5.3 Medium
- node.jsThe `'path'` module in the Node.js 4.x release line contains a potential regular expression...7.5 High
- nasa cfitsio, talos nasa cfitsio, fedoraproject fedora +2 moreIn the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can...8.8 High
- Show moreLoading…