Skip to content
OpenAdvisories

Archive

May 2018

Vulnerabilities first published in this month (UTC), newest first.

← April 2018 2018 / May June 2018 →
  1. 131
  2. 263
  3. 313
  4. 435
  5. 55
  6. 64
  7. 719
  8. 829
  9. 9105
  10. 1049
  11. 1125
  12. 127
  13. 134
  14. 1450
  15. 1537
  16. 1628
  17. 17139
  18. 1831
  19. 1938
  20. 204
  21. 2113
  22. 2263
  23. 2332
  24. 2455
  25. 2546
  26. 2617
  27. 27 
  28. 2811
  29. 2980
  30. 3030
  31. 31101
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical —
    CVE-2016-10555 Public exploit

    Forgeable Public/Private Tokens in jwt-simple

    Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the publ…

    HackerOne jwt-simple node module jwt-simple npm
  • Critical 9.8
    CVE-2018-11138 Exploited · Ransomware Public exploit Scanner template EPSS 92%

    The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible b…

    KEV Mar 25, 2022
  • Critical —
    CVE-2015-9235 Public exploit

    Verification Bypass in jsonwebtoken

    In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm …

    HackerOne jsonwebtoken node module jsonwebtoken npm
  • Critical 9.8
    CVE-2018-10094 Public exploit EPSS 69%

    Dolibarr SQL injection vulnerability

    SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.8
    CVE-2018-1260 Public exploit EPSS 11%

    Spring Security OAuth vulnerable to remote code execution (RCE)

    Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to t…

    Pivotal Spring Security OAuth org.springframework.security.oauth:spring-security-oauth2 Maven
  • Critical 9.8
    CVE-2018-10562 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_a…

    KEV Mar 31, 2022
  • Critical 9.8
    CVE-2018-10561 Exploited Public exploit EPSS 93%

    An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?image…

    KEV Mar 31, 2022