Security Vulnerabilities - CVEs Published In January 2018
Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter.
CVSS Score
5.4
EPSS Score
0.002
Published
2018-01-04
Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource.
CVSS Score
5.4
EPSS Score
0.002
Published
2018-01-04
In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x95002578.
CVSS Score
7.8
EPSS Score
0.0
Published
2018-01-04
In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x950025b0.
CVSS Score
7.8
EPSS Score
0.0
Published
2018-01-04
In K7 Antivirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x83002168.
CVSS Score
7.8
EPSS Score
0.0
Published
2018-01-04
In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x95002610.
CVSS Score
7.8
EPSS Score
0.0
Published
2018-01-04
The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/post.php.
CVSS Score
5.4
EPSS Score
0.003
Published
2018-01-04
The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.php.
CVSS Score
5.4
EPSS Score
0.003
Published
2018-01-04
The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php.
CVSS Score
5.4
EPSS Score
0.002
Published
2018-01-04
The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.
CVSS Score
9.8
EPSS Score
0.814
Published
2018-01-04