Skip to content
OpenAdvisories

Archive

29 May 2018

Vulnerabilities first published on this day (UTC), newest first.

← April 2018 2018 / May /29 June 2018 →
  1. 131
  2. 263
  3. 313
  4. 435
  5. 55
  6. 64
  7. 719
  8. 829
  9. 9105
  10. 1049
  11. 1125
  12. 127
  13. 134
  14. 1450
  15. 1537
  16. 1628
  17. 17139
  18. 1831
  19. 1938
  20. 204
  21. 2113
  22. 2263
  23. 2332
  24. 2455
  25. 2546
  26. 2617
  27. 27 
  28. 2811
  29. 2980
  30. 3030
  31. 31101
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium —
    CVE-2015-9244

    SQL Injection in mysql

    Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.

    HackerOne mysql node module mysql node-mysql Debian npm
  • Medium —
    CVE-2015-9243

    Unsafe Merging of CORS Configuration Conflict in hapi

    When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like …

    HackerOne hapi node module hapi npm
  • Medium —
    CVE-2014-10068

    Hidden Directories Always Served in inert

    The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden` is false.

    HackerOne inert node module inert npm
  • Medium 5.9
    CVE-2014-10067

    Validation Bypass in paypal-ipn

    paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox. With a bit of time, an attacker could craft a request using the simulator that would fool…

    HackerOne paypal-ipn node module paypal-ipn npm
  • Medium —
    CVE-2016-10680

    Downloads Resources over HTTP in adamvr-geoip-lite

    adamvr-geoip-lite is a light weight native JavaScript implementation of GeoIP API from MaxMind adamvr-geoip-lite downloads geoip resources over HTTP, which leaves it vulnerable to MITM attacks. This impacts the integrity and availability of this geoip data th…

    HackerOne adamvr-geoip-lite node module adamvr-geoip-lite npm
  • Medium 6.1
    CVE-2017-16010

    Cross-Site Scripting in i18next

    i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user…

    HackerOne i18next node module i18next npm
  • Medium 6.5
    CVE-2018-1495

    IBM FlashSystem V840 and V900 products could allow an authenticated attacker with specialized access to overwrite arbit…

    IBM FlashSystem V840 FlashSystem V900
  • Medium 4.2
    CVE-2018-1370

    IBM Security Guardium Big Data Intelligence (SonarG) 3.1 specifies permissions for a security-critical resource in a wa…

    IBM Security Guardium Big Data Intelligence
  • Medium 5.9
    CVE-2018-1375

    IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not renew a session variable after a successful authentic…

    IBM Security Guardium Big Data Intelligence
  • Medium 6.1
    CVE-2018-1376

    IBM Security Guardium Big Data Intelligence (SonarG) 3.1 is vulnerable to cross-site scripting. This vulnerability allo…

    IBM Security Guardium Big Data Intelligence
  • Medium 6.4
    CVE-2016-7076

    sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo execu…

    [UNKNOWN] sudo sudo sudo Debian Ubuntu
  • Medium 4.3
    CVE-2017-1768

    IBM Security Guardium Big Data Intelligence (SonarG) 3.1 generates an error message that includes sensitive information…

    IBM Security Guardium Big Data Intelligence