Archive
11 May 2018
Vulnerabilities first published on this day (UTC), newest first.
25 results · Feed
-
Unscored —
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROW…
-
Unscored —CVE-2018-6023 Public exploit
Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi ac…
-
Unscored —
Easy Hosting Control Panel (EHCP) v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of …
-
Unscored —
Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the …
-
Unscored —CVE-2018-6361 EPSS 38%
Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP acc…
-
Unscored —
Easy Hosting Control Panel (EHCP) v0.37.12.b allows attackers to obtain sensitive information by leveraging cleartext p…
-
Unscored —
Easy Hosting Control Panel (EHCP) v0.37.12.b makes it easier for attackers to crack database passwords by leveraging us…
-
Unscored —
Easy Hosting Control Panel (EHCP) v0.37.12.b allows remote attackers to conduct cross-site request forgery (CSRF) attac…
-
Unscored —CVE-2018-10832 Public exploit
ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack. Projects are saved as .xmpp files and automations …
-
Unscored —
An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The affected web interface is vul…
-
Unscored —
An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The license key parameter of the …
-
Medium 6.5
Denial of Service in org.springframework:spring-core
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious…
-
High 7.5CVE-2018-1259 Public exploit
Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying li…
-
Unscored —
Pivotal Greenplum Command Center versions 2.x prior to 2.5.1 contains a blind SQL injection vulnerability. An unauthent…
-
Critical 9.8
Spring Security OAuth vulnerable to remote code execution (RCE)
Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to t…
-
High 8.8
Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
-
Medium 4.7
Path traversal in org.springframework.integration:spring-integration-zip
Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z) that holds path traversal filenames. So w…
-
Unscored —
Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.…
-
Unscored —
Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the …
-
Unscored —
Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block, which allo…
-
Unscored —
The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requi…
-
Unscored —
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validat…
-
Unscored —CVE-2018-10580 Public exploit
The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that disp…
-
Medium 4.3
admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that al…
-
Unscored —
Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02…