Archive
19 January 2018
Vulnerabilities first published on this day (UTC), newest first.
32 results · Feed
-
Medium 4.0
An exploitable improper authorization vulnerability exists in miner_stop API of cpp-ethereum's JSON-RPC (commit 4e10157…
-
High 7.5
An exploitable unhandled exception vulnerability exists in multiple APIs of CPP-Ethereum JSON-RPC. Specially crafted JS…
-
Medium 6.8
An exploitable improper authorization vulnerability exists in miner_setGasPrice API of cpp-ethereum's JSON-RPC (commit …
-
Medium 4.0
An exploitable improper authorization vulnerability exists in admin_nodeInfo API of cpp-ethereum's JSON-RPC (commit 4e1…
-
High 7.5
An exploitable overly permissive cross-domain (CORS) whitelist vulnerability exists in JSON-RPC of Parity Ethereum clie…
-
High 8.2
An exploitable information leak/denial of service vulnerability exists in the libevm (Ethereum Virtual Machine) `create…
-
Medium 4.0
An exploitable improper authorization vulnerability exists in admin_peers API of cpp-ethereum's JSON-RPC (commit 4e1015…
-
Medium 4.0
An exploitable improper authorization vulnerability exists in admin_addPeer API of cpp-ethereum's JSON-RPC (commit 4e10…
-
Medium 4.0
An exploitable improper authorization vulnerability exists in miner_start API of cpp-ethereum's JSON-RPC (commit 4e1015…
-
Medium 6.8
An exploitable improper authorization vulnerability exists in miner_setEtherbase API of cpp-ethereum's JSON-RPC (commit…
-
Medium 6.1
delayed_job_web Cross-site Scripting vulnerability
An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the v…
-
Unscored —CVE-2017-11398 Public exploit
A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 a…
-
Medium 6.1
rails_admin ruby gem XSS
An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the…
-
Unscored —
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to p…
-
Unscored —
An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below cou…
-
Unscored —CVE-2017-14096 Public exploit
A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and …
-
Unscored —
An uninitialized pointer information disclosure vulnerability in Trend Micro Mobile Security (Enterprise) versions 9.7 …
-
Unscored —
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to p…
-
Unscored —
A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain mes…
-
Unscored —
Race condition issue in Yandex Browser for Android before 17.4.0.16 allowed a remote attacker to potentially exploit me…
-
Unscored —
Yandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path i…
-
Unscored —
Yandex Browser before 16.9.0 allows remote attackers to spoof the address bar via window.open.
-
Medium 6.5
Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct…
-
High 7.5
OXID eShop user impersonation vulnerability
The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token.
-
Unscored —
OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition before 5.0.13 and 5.1.x before…
-
Unscored —
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow an authenticated u…
-
Unscored —
IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users s…
-
Unscored —
X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Adva…
-
Unscored —
In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote a…
-
Unscored —
In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function (base/PdfVec…
-
Unscored —
In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder func…
-
Unscored —
In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the get_fileinfo function (lrzip…