Archive
12 February 2018
Vulnerabilities first published on this day (UTC), newest first.
54 results · Feed
-
Unscored —
A remote code execution vulnerability exists in Schneider Electric's StruxureOn Gateway versions 1.1.3 and prior. Uploa…
-
Unscored —
A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prio…
-
Unscored —
A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA An…
-
Unscored —
A security misconfiguration vulnerability exists in Schneider Electric's IGSS SCADA Software versions 12 and prior. Sec…
-
Unscored —
An information disclosure vulnerability exists in Schneider Electric's IGSS Mobile application version 3.01 and prior. …
-
Unscored —
In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::IptcData::printStructure function in iptc.cpp, rela…
-
Unscored —
In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp. Remote atta…
-
Unscored —
In Exiv2 0.26, there is an integer overflow leading to a heap-based buffer over-read in the Exiv2::getULong function in…
-
Unscored —
In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remo…
-
Unscored —
Dell EMC SupportAssist Enterprise version 1.1 creates a local Windows user account named "OMEAdapterUser" with a defaul…
-
Unscored —
The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial…
-
Unscored —
A elevation of privilege vulnerability in the Upstream kernel audio driver. Product: Android. Versions: Android kernel.…
-
Unscored —
In ihevcd_ctb_boundary_strength_pbslice of libhevc, there is possible resource exhaustion. This could lead to a remote …
-
Unscored —
A other vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID…
-
Unscored —
A remote code execution vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1…
-
Unscored —
A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 6.0, 6.0.1, 7.0, …
-
Unscored —
In hevc codec, there is an out-of-bounds write due to an incorrect bounds check with the i2_pic_width_in_luma_samples v…
-
Unscored —
In XBLRamDump mode, there is a debug feature that can be used to dump memory contents, if an attacker has physical acce…
-
Unscored —
In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an un…
-
Unscored —
In DLSParser of the sonivox library, there is possible resource exhaustion due to a memory leak. This could lead to rem…
-
Unscored —
In the Pixel 2 bootloader, there is a missing permission check which bypasses carrier bootloader lock. This could lead …
-
Unscored —CVE-2017-13236 Public exploit
In the KeyStore service, there is a permissions bypass that allows access to protected resources. This could lead to lo…
-
Unscored —
A information disclosure vulnerability in the Android media framework (libstagefright_soft_avcenc). Product: Android. V…
-
Unscored —
In libmediadrm, there is an out-of-bounds write due to improper input validation. This could lead to local elevation of…
-
Unscored —
A information disclosure vulnerability in the Android system (ui). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, …
-
Unscored —
A information disclosure vulnerability in the Android framework (ui framework). Product: Android. Versions: 8.0. ID: A-…
-
Unscored —
In audioserver, there is an out-of-bounds write due to a log statement using %s with an array that may not be NULL term…
-
Unscored —
A information disclosure vulnerability in the Upstream kernel network driver. Product: Android. Versions: Android kerne…
-
Unscored —
A elevation of privilege vulnerability in the Upstream kernel easel. Product: Android. Versions: Android kernel. ID: A-…
-
Unscored —
A information disclosure vulnerability in the Android framework (crypto framework). Product: Android. Versions: 8.0, 8.…
-
Unscored —
The cbstream.sys driver in Carbon Black 5.1.1.60603 allows local users with admin privileges to cause a denial of servi…
-
Unscored —
cb.exe in Carbon Black 5.1.1.60603 allows attackers to cause a denial of service (out-of-bounds read, invalid pointer d…
-
Unscored —
In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on c…
-
Unscored —CVE-2016-8742 Public exploit
The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in …
-
High 8.8
Apache Thrift Go Library Command Injection
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
-
Unscored —
controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and t…
-
Unscored —
Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demon…
-
Unscored —
Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the …
-
Unscored —
Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the app…
-
Unscored —
Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a passwo…