Skip to content
OpenAdvisories

Archive

April 2018

Vulnerabilities first published in this month (UTC), newest first.

← March 2018 2018 / April May 2018 →
  1. 18
  2. 225
  3. 3170
  4. 4163
  5. 557
  6. 614
  7. 710
  8. 85
  9. 914
  10. 1050
  11. 1188
  12. 12112
  13. 1346
  14. 148
  15. 157
  16. 1641
  17. 1731
  18. 18282
  19. 19200
  20. 2036
  21. 2110
  22. 2210
  23. 2327
  24. 2497
  25. 2547
  26. 2636
  27. 2729
  28. 283
  29. 2915
  30. 3029
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Low 3.7
    CVE-2017-2591

    389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config…

    389-ds-base 389-ds-base Debian Ubuntu
  • Low 2.8
    CVE-2017-9275

    NetIQ Identity Reporting XSS exposure

    NetIQ Identity Reporting, in versions prior to 5.5 Service Pack 1, is susceptible to an XSS attack.

    NetIQ Identity Reporting
  • Low 3.1
    CVE-2018-2790

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions…

    Oracle Java openjdk-8 openjdk-7 Ubuntu Wolfi
  • Low 3.8
    CVE-2018-2412

    SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in …

    SAP SAP Disclosure Management
  • Low 3.3
    CVE-2018-1000150

    Jenkins Reverse Proxy Auth Plugin allows attackers with local file system access to obtain a list of authorities for logged in users

    An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#authContext that allows attackers with local file system access to obtain a list of authorities for logged in users.

    org.jenkins-ci.plugins:reverse-proxy-auth-plugin Maven
  • Low 3.1
    CVE-2018-1000143

    Jenkins GitHub Pull Request Builder Plugin

    An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials.

    org.jenkins-ci.plugins:ghprb Maven
  • Low 3.7
    CVE-2018-1284

    Exposure of Sensitive Information to an Unauthorized Actor in Apache hive

    In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_float/xpath_long/xpath_int/xpath_short) to expose the content of a file on the machine running HiveServer2 owned by HiveSe…

    Apache Software Foundation Apache Hive org.apache.hive:hive-exec org.apache.hive:hive Maven
  • Low 3.7
    CVE-2018-1315

    Incorrect Permission Assignment for Critical Resource in Apache hive

    In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to be written to an arbitrary location on the cluster where the command is run from. This is because FT…

    Apache Software Foundation Apache Hive org.apache.hive:hive-exec org.apache.hive:hive Maven
  • Low 3.5
    CVE-2017-3964

    SB10192 - Network Security Management (NSM) - Reflective Cross-Site Scripting (XSS) vulnerability

    Reflective Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to inject arbitrary web script or HTML via a URL parameter.

    McAfee Network Security Management (NSM)
  • Low 3.7
    CVE-2018-6659

    SB10228 ePO Reflected Cross-Site Scripting vulnerability

    Reflected Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows remote authenticated users to exploit an XSS issue via not sanitizing the user input.

    McAfee ePolicy Orchestrator (ePO)