CVEs published in May 2018
1,213 vulnerabilities, 158 critical, 7 exploited.
- cactusthemes gameplan-event and gym fitnessReflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of...6.1 Medium
- amazon echo dot firmware, echo firmware, echo plus firmware +2 more +4 more** DISPUTED ** Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused...3.3 Low
- unisys stealth authorization serverIn Stealth Authorization Server before 3.3.017.0 in Unisys Stealth Solution, an encryption key...4.7 Medium
- maharaMahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to...5.3 Medium
- tp-link ipc tl-ipc223\(p\)-6 firmware, tl-ipc323k-d firmware, tl-ipc325\(kp\) firmware +1 more +3 more/usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL...9.8 Critical
- tp-link ipc tl-ipc223\(p\)-6 firmware, tl-ipc323k-d firmware, tl-ipc325\(kp\) firmware +1 more +3 moreTP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices allow...8.8 High
- vgate icar 2 wi-fi obd2 firmwareAn issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The OBD port is used to...8.8 High
- vgate icar 2 wi-fi obd2 firmwareAn issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The data packets that are sent...6.5 Medium
- vgate icar 2 wi-fi obd2 firmwareAn issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The dongle opens an...8.8 High
- synacor zimbra collaboration suite, zimbra collaboration suite +1 moreZimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7...6.1 Medium
- graphviz, canonical ubuntu linux, fedoraproject fedora +2 moreNULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the...5.5 Medium
- synacor zimbra collaboration suite, zimbra collaboration suite +1 moreCross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite ...8.8 High
- misp-project mispAn issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp...6.1 Medium
- hcltech legacy ivr firmwareA vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These...8.1 High
- schedmd slurm, debian linux +1 moreSchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names (aka user_name...5.3 Medium
- apport project apportApport treats the container PID as the global PID when /proc/<global_pid>/ is missing7.8 High
- taglib, debian linux +1 moreThe TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote...6.5 Medium
- libmobi project libmobiThe mobi_decompress_lz77 function in compression.c in Libmobi 0.3 allows remote attackers to...8.8 High
- libmobi project libmobiThe mobi_reconstruct_parts function in parse_rawml.c in Libmobi 0.3 allows remote attackers to...6.5 Medium
- libmobi project libmobiThe buffer_addraw function in buffer.c in Libmobi 0.3 allows remote attackers to cause...6.5 Medium
- libmobi project libmobiThe mobi_decompress_huffman_internal function in compression.c in Libmobi 0.3 allows remote...6.5 Medium
- libmobi project libmobiThe buffer_fill64 function in compression.c in Libmobi 0.3 allows remote attackers to cause...6.5 Medium
- libmobi project libmobiThe mobi_get_kf8boundary_seqnumber function in util.c in Libmobi 0.3 allows remote attackers to...6.5 Medium
- libmobi project libmobiThe mobi_parse_mobiheader function in read.c in Libmobi 0.3 allows remote attackers to cause...6.5 Medium
- domainmodDomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_last_name parameter.5.4 Medium
- domainmodDomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_first_name parameter.5.4 Medium
- yiban easy class education platformYIBAN Easy class education platform 2.0 has XSS via the articlelist.php k parameter.6.1 Medium
- littlecms little cms** DISPUTED ** tificc in Little CMS 2.9 has an out-of-bounds write in the...7.8 High
- littlecms little cms** DISPUTED ** tificc in Little CMS 2.9 has an out-of-bounds write in the PrecalculatedXFORM...7.8 High
- google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreA precision error in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to...8.8 High
- liblouis, canonical ubuntu linux, opensuse leap +2 moreLiblouis 3.5.0 has a Segmentation fault in lou_logPrint in logging.c.8.8 High
- git-scm git, canonical ubuntu linux +1 moreIn Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17...7.5 High
- wuzhicmsAn issue was discovered in WUZHI CMS 4.1.0 There is a Stored XSS Vulnerability in "Account...5.4 Medium
- block eosAn issue was discovered in EOS.IO DAWN 4.2. plugins/net_plugin/net_plugin.cpp does not limit the...7.5 High
- md4c project md4cmd_is_link_reference_definition_helper in md4c 0.2.5 has a heap-based buffer over-read because...9.8 Critical
- md4c project md4cmd4c 0.2.5 has a heap-based buffer over-read because md_is_named_entity_contents has an off-by...9.8 Critical
- md4c project md4cmd4c 0.2.5 has a heap-based buffer overflow in md_merge_lines because md_is_link_label mishandles...9.8 Critical
- theolivetree ftp serverThe Olive Tree Ftp Server application 1.32 for Android has Insecure Data Storage because a...9.8 Critical
- vmware horizon client for linux, horizon client +1 moreVMware Horizon Client for Linux (4.x before 4.8.0 and prior) contains a local privilege...7.8 High
- atob project atob, hackerone atob node module +1 moreOut-of-bounds Read in atob9.1 Critical
- hackerone html-pages node module, html-pages project html-pages +1 morePath Traversal in html-pages9.8 Critical
- hackerone stattic node module, stattic project stattic +1 morePath Traversal in stattic7.5 High
- crud-file-server project crud-file-server, hackerone crud-file-server node module +1 morePath Traversal in crud-file-server7.5 High
- jigowatt php login \& user managementAn arbitrary file upload vulnerability in /classes/profile.class.php in Jigowatt "PHP Login &...8.8 High
- ruckussecurity icx7450-48 firmwareA reflected XSS vulnerability on Ruckus ICX7450-48 devices allows remote attackers to inject...6.1 Medium
- samsung mobileA malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when...5.3 Medium
- zohocorp manageengine adaudit plusZoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection.9.8 Critical
- gaoxuyan project gaoxuyan, hackerone gaoxuyan node module +1 moreDirectory Traversal in gaoxuyan7.5 High
- node-tkinter project node-tkinter, hackerone node-tkinter node module +1 morenode-tkinter is malware7.5 High
- tkinter package tkinter, hackerone tkinter node module +1 moretkinter is malware7.5 High
- Show moreLoading…