Archive
May 2018
Vulnerabilities first published in this month (UTC), newest first.
1,164 results · Feed
-
Unscored —
ESTsoft ALZip before 10.76 allows local users to execute arbitrary code via creating a malicious .DLL file and installi…
-
Unscored —
The dcputs function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size gre…
-
Unscored —
The getString function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size …
-
Unscored —
An issue was discovered in Libav 12.3. A read access violation in the in_table_init16 function in libavcodec/aacsbr.c a…
-
Unscored —
A vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) could allow an unau…
-
Unscored —
A vulnerability in the detection engine of Cisco Firepower Threat Defense software could allow an unauthenticated, remo…
-
Unscored —
A vulnerability in the logs component of Cisco Identity Services Engine could allow an unauthenticated, remote attacker…
-
Unscored —
A vulnerability in the Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) certificate validation dur…
-
Unscored —
A vulnerability in the web UI of Cisco TelePresence Server Software could allow an unauthenticated, remote attacker to …
-
Unscored —
A vulnerability in the Real-Time Transport Protocol (RTP) bitstream processing of the Cisco Meeting Server could allow …
-
Unscored —
A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, high-p…
-
Unscored —
A vulnerability in the container management subsystem of Cisco Digital Network Architecture (DNA) Center could allow an…
-
Unscored —
A vulnerability in the Secure Copy Protocol (SCP) server of Cisco Enterprise NFV Infrastructure Software (NFVIS) could …
-
Unscored —
A vulnerability in the web management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an …
-
Unscored —
A vulnerability in the API gateway of the Cisco Digital Network Architecture (DNA) Center could allow an unauthenticate…
-
Unscored —
A vulnerability in the web framework of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote att…
-
Unscored —
A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 7800 Series phon…
-
Unscored —
A vulnerability in the web framework of Cisco Unified Communications Manager and Cisco Unified Presence could allow an …
-
Unscored —
A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to l…
-
Unscored —
A vulnerability in the TCP stack of Cisco SocialMiner could allow an unauthenticated, remote attacker to cause a denial…
-
Unscored —
This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation…
-
Unscored —
The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to pl…
-
Unscored —
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to pl…
-
Unscored —
An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a…
-
Unscored —
An issue was discovered in libjpeg 9a. The get_text_rgb_row function in rdppm.c allows remote attackers to cause a deni…
-
Unscored —
An issue was discovered in libjpeg 9a. The get_text_gray_row function in rdppm.c allows remote attackers to cause a den…
-
Unscored —
A vulnerability has been identified in SIMATIC S7-400 (incl. F) CPU hardware version 4.0 and below (All versions), SIMA…
-
Critical 9.8CVE-2018-8014 EPSS 21%
The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have…
-
Unscored —
An issue was discovered in Z-BlogPHP 2.0.0. There is a persistent XSS that allows remote attackers to inject arbitrary …
-
Unscored —
TinyXML2 6.2.0 has a heap-based buffer over-read in the XMLDocument::Parse function in libtinyxml2.so. NOTE: The tinyxm…
-
Unscored —
A NULL pointer dereference was discovered in H5O__chunk_deserialize in H5Ocache.c in the HDF HDF5 1.10.2 library. It co…
-
Unscored —
A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. It coul…
-
Unscored —
A division by zero was discovered in H5D__chunk_init in H5Dchunk.c in the HDF HDF5 1.10.2 library. It could allow a rem…
-
Unscored —
A out of bounds read was discovered in H5VM_memcpyvv in H5VM.c in the HDF HDF5 1.10.2 library. It could allow a remote …
-
Unscored —
A division by zero was discovered in H5D__btree_decode_key in H5Dbtree.c in the HDF HDF5 1.10.2 library. It could allow…
-
Unscored —
An issue was discovered in Z-BlogPHP 2.0.0. zb_system/cmd.php?act=verify relies on MD5 for the password parameter, whic…
-
Unscored —
Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and earlier allows remote authenticated …
-
Unscored —
PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8 and earlier allows remote attac…
-
Unscored —
SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included i…
-
Unscored —
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the app…