CVEs published in April 2018
1,684 vulnerabilities, 383 critical, 5 exploited.
- lutron quantum bacnet integration firmwareLutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user...7.5 High
- web-dorado wd instagram feedCross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1...6.1 Medium
- web-dorado wd instagram feedCross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1...6.1 Medium
- siemens simatic wincc oa operator, siemens ag simatic wincc oa operator ios app +1 moreA vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4)....4.6 Medium
- packagekit, canonical ubuntu linux, debian linux +6 more +8 moreAn authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users...5.5 Medium
- foxit, foxit pdf reader +1 moreAn exploitable use-after-free vulnerability exists in the JavaScript engine Foxit Software Foxit...8.8 High
- foxit, foxit pdf reader +1 moreAn exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's...8.8 High
- ultimatemember user profile \& membershipAuthenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11...4.8 Medium
- ultimatemember user profile \& membershipThe User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented...8.8 High
- qnap photo stationCross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5...6.1 Medium
- ibm mq, websphere mq +1 moreIBM WebSphere MQ 8.0 through 8.0.0.8 and 9.0 through 9.0.4 under special circumstances could...5.3 Medium
- ibm cognos business intelligenceIBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized...7.0 High
- ibm rational team concert, rational collaborative lifecycle management +1 moreIBM Team Concert (RTC) 5.0, 5.0.1, 5.0.2, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, and 6.0.5 stores...8.8 High
- ibm cognos business intelligenceIBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2 is vulnerable to cross-site...6.1 Medium
- ibm security access manager, security access manager firmware, security access manager for mobile +1 more +3 moreIBM Security Access Manager Appliance 8.0.0 through 8.0.1.6 and 9.0.0 through 9.0.3.1 uses weaker...7.5 High
- beauty ecosystem coinAn integer overflow in the batchTransfer function of a smart contract implementation for Beauty...7.5 High
- check point software technologies ltd. linux kernel, debian linux, linux kernel +4 more +6 moreThe udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel version 3.4 and up...7.8 High
- linux kernelThe Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in...5.5 Medium
- openslp, canonical ubuntu linux, debian linux +35 more +37 moreOpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue...9.8 Critical
- discuz discuzxDiscuz! DiscuzX through X3.4 has reflected XSS via forum.php?mod=post&action=newthread because...5.4 Medium
- discuz discuzxDiscuz! DiscuzX through X3.4 has stored XSS via the portal.php?mod=portalcp&ac=article URI,...5.4 Medium
- kliqqi cmsSQL Injection exists in Kliqqi CMS 3.5.2 via the randkey parameter of a new story at the pligg...9.8 Critical
- kliqqi cmsKliqqi CMS 3.5.2 has XSS via a crafted group name in pligg/groups.php, a crafted Homepage string...5.4 Medium
- 1234n minicmsMiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter.6.1 Medium
- chemcms project chemcmsChemCMS v1.0.6 has CSRF by using public/admin/user/addpost.html to add an administrator account.8.8 High
- ericssonlg ipecs nmsThe Ericsson-LG iPECS NMS A.1Ac login portal has a SQL injection vulnerability in the User ID and...9.8 Critical
- ericssonlg ipecs nmsThe Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS...8.8 High
- ericssonlg ipecs nmsThe Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since...9.8 Critical
- artifex mupdf, debian linux +1 moreIn MuPDF 1.13.0, there is an infinite loop in the fz_skip_space function of the pdf/pdf-xref.c...5.5 Medium
- libtiffLibTIFF 4.0.9 has a NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c.6.5 Medium
- phpipamapp/sections/user-menu.php in phpIPAM before 1.3.1 has XSS via the ip parameter.5.4 Medium
- adaltech g-ticketAdaltech G-Ticket v70 EME104 has SQL Injection via the mobile-loja/mensagem.asp eve_cod parameter.9.8 Critical
- cliquemania loja virtualCliqueMania loja virtual 14 has SQL Injection via the patch/remote.php id parameter in a...9.8 Critical
- fastadminAn issue was discovered in FastAdmin V1.0.0.20180417_beta. There is XSS via the application\api...5.4 Medium
- wtcms project wtcmsWTCMS 1.0 has a CSRF vulnerability to add an administrator account via the index.php?admin&m=user...8.8 High
- beescmsBEESCMS 4.0 has a CSRF vulnerability to add an administrator account via the admin/admin_admin...8.8 High
- hongcms project hongcmsAn issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an...8.8 High
- nasm netwide assemblerNetwide Assembler (NASM) 2.13 has a stack-based buffer over-read in the disasm function of the...7.8 High
- paessler prtg network monitorPaessler PRTG Network Monitor before 18.1.39.1648 mishandles stack memory during unspecified API...7.5 High
- sharing-file easy file sharing web serverStack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to...9.8 Critical
- calderalabs caldera formsMultiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1...4.8 Medium
- digitalguardian management consoleDigital Guardian Management Console 7.1.2.0015 has a Directory Traversal issue.6.5 Medium
- digitalguardian management consoleDigital Guardian Management Console 7.1.2.0015 has an XXE issue.6.5 Medium
- digitalguardian management consoleDigital Guardian Management Console 7.1.2.0015 has an SSRF issue that allows remote attackers to...6.5 Medium
- digitalguardian management consoleDigital Guardian Management Console 7.1.2.0015 allows authenticated remote code execution because...8.8 High
- vertiv watchdog consoleGeist WatchDog Console 3.2.2 uses a weak ACL for the C:\ProgramData\WatchDog Console directory,...7.8 High
- vertiv watchdog consoleCross-site scripting (XSS) vulnerability in Geist WatchDog Console 3.2.2 allows remote...4.8 Medium
- vertiv watchdog consoleXML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote...4.9 Medium
- ibm rational clearquestMultiple XML external entity (XXE) vulnerabilities in (1) CQWeb / CM Server, (2) ClearQuest...7.1 High
- ibm rational clearcaseMultiple XML external entity (XXE) vulnerabilities in the (1) CCRC WAN Server / CM Server, (2)...9.1 Critical
- Show moreLoading…