Archive
May 2018
Vulnerabilities first published in this month (UTC), newest first.
1,164 results · Feed
-
High 7.5
Missing Authorization in Apache ZooKeeper
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to t…
-
Medium 5.5
There is a XML external entity expansion (XXE) vulnerability in Apache Solr config files
This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solrconfig.xml, schema.xml, managed-schema). In addition, Xinclude functionality provided in these config files is also af…
-
Medium 5.4
Improper Neutralization of CRLF Sequences in HTTP Headers in Undertow
In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and vali…
-
Unscored —
MagniComp SysInfo before 10-H81, as shipped with BMC BladeLogic Automation and other products, contains an information …
-
Unscored —
An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin no…
-
Unscored —
In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive v…
-
Unscored —
Horse Market Sell & Rent Portal Script 1.5.7 has a CSRF vulnerability through which an attacker can change all of the t…
-
Unscored —
A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Fea…
-
Unscored —
A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attac…
-
Unscored —
Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the …
-
Unscored —CVE-2018-11242 Public exploit
An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypt…
-
Unscored —
The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84 and below products allows unauthorized access via a DNS re…
-
Unscored —
An integer overflow in the _transfer function of a smart contract implementation for Hexagon (HXG), an Ethereum ERC20 t…
-
Unscored —
Adobe InDesign versions 13.0 and below have an exploitable Memory corruption vulnerability. Successful exploitation cou…
-
Unscored —
Adobe Connect versions 9.7 and earlier have an exploitable OS Command Injection. Successful exploitation could lead to …
-
Unscored —
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability. Successful exp…
-
Critical 9.8
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deseri…
KEV Nov 3, 2021 -
Unscored —
Adobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion vulnerability. Successful exploit…
-
Unscored —
Adobe Digital Editions versions 4.5.7 and below have an exploitable Stack Overflow vulnerability. Successful exploitati…
-
Unscored —
Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable type confusion vulnerability. Successful exploit…
-
Unscored —
Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable Improper certificate valida…
-
High 7.5
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe…
-
Unscored —
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful ex…
-
High 7.8
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Insecu…
-
Unscored —
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Heap Overflow vulnerability. Successful exploita…
-
Unscored —
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Use-After-Free vulnerability. Successful exploit…
-
Unscored —
Adobe Digital Editions versions 4.5.7 and below have an exploitable Out-of-bounds read vulnerability. Successful exploi…
-
Unscored —
Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable Improper input validation v…
-
Unscored —CVE-2018-4924 EPSS 14%
Adobe Dreamweaver CC versions 18.0 and earlier have an OS Command Injection vulnerability. Successful exploitation coul…
-
Unscored —CVE-2018-4918 EPSS 12%
Adobe Acrobat and Reader versions 2018.009.20050 and earlier, 2017.011.30070 and earlier, 2015.006.30394 and earlier ha…
-
Unscored —
Adobe Connect versions 9.7.5 and earlier have an exploitable Authentication Bypass vulnerability. Successful exploitati…
-
Unscored —
Adobe Experience Manager versions 6.2 and earlier have an exploitable stored cross-site scripting vulnerability. Succes…
-
Unscored —
Adobe Experience Manager versions 6.3 and earlier have an exploitable Cross-site scripting vulnerability. Successful ex…
-
Unscored —
Adobe InDesign versions 13.0 and below have an exploitable Untrusted Search Path vulnerability. Successful exploitation…
-
Unscored —
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability. Successful exp…
-
Unscored —
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful ex…
-
Unscored —
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-…
-
Unscored —
Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable use after free vulnerability. Successful exploit…
-
Unscored —
Adobe PhoneGap Push Plugin versions 1.8.0 and earlier have an exploitable Same-Origin Method Execution vulnerability. S…
-
Unscored —
Adobe Experience Manager versions 6.1 and earlier have an exploitable stored cross-site scripting vulnerability. Succes…