Archive
May 2018
Vulnerabilities first published in this month (UTC), newest first.
1,164 results · Feed
-
Critical 9.8
Spring Security OAuth vulnerable to remote code execution (RCE)
Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to t…
-
High 8.8
Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
-
Medium 4.7
Path traversal in org.springframework.integration:spring-integration-zip
Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z) that holds path traversal filenames. So w…
-
Unscored —
Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.…
-
Unscored —
Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the …
-
Unscored —
Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block, which allo…
-
Unscored —
The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requi…
-
Unscored —
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validat…
-
Unscored —CVE-2018-10580 Public exploit
The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that disp…
-
Medium 4.3
admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that al…
-
Unscored —
Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02…
-
Unscored —
An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (unexpectedl…
-
Low 2.3
Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and …
-
Unscored —
Intel NUC kits with insufficient input validation in system firmware, potentially allows a local attacker to elevate pr…
-
Unscored —
DLL injection vulnerability in the installation executables (Autorun.exe and Setup.exe) for Intel's wireless drivers an…
-
Unscored —
An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (host OS inf…
-
Medium 4.2
postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() fun…
-
Unscored —
An integer overflow in the transferMulti function of a smart contract implementation for Social Chain (SCA), an Ethereu…
-
Unscored —
An integer overflow in the transferMulti function of a smart contract implementation for KoreaShow, an Ethereum ERC20 t…
-
Unscored —
In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of ser…
-
Unscored —
In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of ser…
-
Unscored —
In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of ser…
-
Unscored —
In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of ser…
-
Unscored —
An issue was discovered in Free Lossless Image Format (FLIF) 0.3. The TransformPaletteC::process function in transform/…
-
Unscored —
An issue was discovered in Free Lossless Image Format (FLIF) 0.3. The Plane function in image/image.hpp allows remote a…
-
Unscored —
The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a de…
-
Unscored —
Huawei iBMC V200R002C60 have an authentication bypass vulnerability. A remote attacker with low privilege may craft spe…
-
Unscored —
Huawei home gateway products HiRouter-CD20 and WS5200 with the versions before HiRouter-CD20-10 1.9.6 and the versions …
-
Unscored —
Huawei smart phones Mate 10 and Mate 10 Pro with earlier versions than 8.0.0.129(SP2C00) and earlier versions than 8.0.…
-
Unscored —
In Android before the 2018-05-05 security patch level, NVIDIA Widevine Trustlet contains a vulnerability in Widevine TA…
-
Unscored —
In Android before the 2018-05-05 security patch level, NVIDIA Media Server contains an out-of-bounds read (due to impro…
-
Unscored —
Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly proc…
-
Unscored —
DLPnpAuditor.exe in DeviceLock Plug and Play Auditor (freeware) 5.72 has a Unicode Buffer Overflow (SEH).
-
Unscored —
Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12…
-
Unscored —
The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program s…
-
Unscored —
In Android before the 2018-05-05 security patch level, NVIDIA Trusted Execution Environment (TEE) contains a memory cor…
-
Unscored —
In Android before the 2018-05-05 security patch level, NVIDIA Tegra X1 TZ contains a vulnerability in Widevine TA where…
-
Medium 5.5
Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit() function in net/d…
-
Medium 6.5
Cross-site scripting (XSS) vulnerability in Notification Center in Synology Calendar before 2.1.1-0502 allows remote au…
-
Medium 6.5
Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Drive before 1.0.1-10253 allows remote authe…