Archive
May 2018
Vulnerabilities first published in this month (UTC), newest first.
129 results · Clear filters · Feed
-
High 7.0
Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script…
-
High 7.6
hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerab…
-
High 7.8
Client for OES Elevation of Privilege via Buffer Overflow
The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys.
-
High 7.5
Missing Authorization in Apache ZooKeeper
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to t…
-
High 7.5
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe…
-
High 7.8
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Insecu…
-
High 7.5
Apache ORC vulnerable to Uncontrolled Recursion
In Apache ORC 1.0.0 to 1.4.3 a malformed ORC file can trigger an endlessly recursive function call in the C++ or Java parser. The impact of this bug is most likely denial-of-service against software that uses the ORC file parser. With the C++ parser, the stac…
-
High 7.5
DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in…
-
High 7.2
UAA privilege escalation across identity zones
Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impers…
-
High 8.8
Deserialization of Untrusted Data in Jenkins
Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs (SECURITY-383).
-
High 8.1
An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0. A specially craft…
-
High 8.0
kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulner…
-
High 8.8
Deserialization of Untrusted Data in Infinispan
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects…
-
High 8.8
An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 170303…
-
High 7.5
An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 170303…
-
High 8.8
An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 170303…
-
High 8.8
An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 170303…
-
High 8.8
An exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 bui…
-
High 7.5
Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 1703…
-
High 7.5
An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 170303…
-
High 7.5
Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 1703…
-
High 8.8
An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 170303…
-
High 7.5
An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 170303…
-
High 7.5
An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 170303…
-
High 8.8
An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 170303…
-
High 8.8
An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 170303…
-
High 7.5CVE-2018-1259 Public exploit
Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying li…
-
High 8.8
Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
-
High 7.3
SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote at…
-
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018…
-
High 7.5CVE-2018-0954 EPSS 15%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, ChakraCore, Internet Explorer 11, Microsoft…
-
High 7.5CVE-2018-0943 EPSS 16%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
High 7.5CVE-2018-0945 EPSS 16%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018…
-
High 7.5
Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents
A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.7.…
-
High 7.5
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized…
KEV Aug 5, 2024 -
High 7.5CVE-2018-1022 EPSS 15%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is…
-
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018…
-
High 7.5CVE-2018-8130 EPSS 16%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
High 7.5
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Window…
KEV Feb 15, 2022 -
High 7.5CVE-2018-8137 EPSS 16%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018…