Archive
May 2018
Vulnerabilities first published in this month (UTC), newest first.
1,164 results · Feed
-
Unscored —
The mobi_decompress_lz77 function in compression.c in Libmobi 0.3 allows remote attackers to cause remote code executio…
-
Unscored —
The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause informa…
-
Unscored —
The mobi_parse_mobiheader function in read.c in Libmobi 0.3 allows remote attackers to cause information disclosure (he…
-
Unscored —
The mobi_get_kf8boundary_seqnumber function in util.c in Libmobi 0.3 allows remote attackers to cause information discl…
-
Unscored —
tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in li…
-
Unscored —
DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_first_name parameter.
-
Unscored —
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code …
-
Unscored —
YIBAN Easy class education platform 2.0 has XSS via the articlelist.php k parameter.
-
Unscored —
tificc in Little CMS 2.9 has an out-of-bounds write in the PrecalculatedXFORM function in cmsxform.c in liblcms2.a via …
-
Unscored —
DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_last_name parameter.
-
Unscored —
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remot…
-
Unscored —
md4c 0.2.5 has a heap-based buffer over-read because md_is_named_entity_contents has an off-by-one error.
-
Unscored —
md_is_link_reference_definition_helper in md4c 0.2.5 has a heap-based buffer over-read because md_is_link_label mishand…
-
Unscored —
An issue was discovered in WUZHI CMS 4.1.0 There is a Stored XSS Vulnerability in "Account Settings -> Member Centre ->…
-
Unscored —
An issue was discovered in EOS.IO DAWN 4.2. plugins/net_plugin/net_plugin.cpp does not limit the number of P2P connecti…
-
Unscored —
md4c 0.2.5 has a heap-based buffer overflow in md_merge_lines because md_is_link_label mishandles the case of a link la…
-
Unscored —
The Olive Tree Ftp Server application 1.32 for Android has Insecure Data Storage because a username and password are st…
-
Medium —
SQL Injection in mysql
Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.
-
High —
Denial of Service in hapi
Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until …
-
Critical —CVE-2015-9235 Public exploit
Verification Bypass in jsonwebtoken
In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm …
-
High —
Denial of Service in ecstatic
Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via the If-Modified-Sin…
-
Medium —
Unsafe Merging of CORS Configuration Conflict in hapi
When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like …
-
High 7.5
Authentication Weakness in keystone
Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in.
-
Unscored —
An arbitrary file upload vulnerability in /classes/profile.class.php in Jigowatt "PHP Login & User Management" before 4…
-
Unscored —
A reflected XSS vulnerability on Ruckus ICX7450-48 devices allows remote attackers to inject arbitrary web script or HT…
-
Unscored —
VMware Horizon Client for Linux (4.x before 4.8.0 and prior) contains a local privilege escalation vulnerability due to…
-
Critical 9.1
Out-of-bounds Read in atob
atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.
-
Critical 9.8
Path Traversal in html-pages
The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL.
-
High 7.5
Path Traversal in crud-file-server
crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a malicious user to read content of any file with known path.
-
High 7.5
Path Traversal in stattic
stattic node module suffers from a Path Traversal vulnerability due to lack of validation of path, which allows a malicious user to read content of any file with known path.
-
Unscored —CVE-2018-10751 Public exploit
A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String E…
-
Unscored —CVE-2018-10466 EPSS 17%
Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection.
-
Medium —
Hidden Directories Always Served in inert
The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden` is false.
-
Medium 5.9
Validation Bypass in paypal-ipn
paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox. With a bit of time, an attacker could craft a request using the simulator that would fool…
-
High —
Downloads Resources over HTTP in tomita-parser
tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an at…
-
High —
Downloads Resources over HTTP in broccoli-closure
broccoli-closure is a Closure compiler plugin for Broccoli. broccoli-closure before 1.3.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested b…
-
High —
Downloads Resources over HTTP in native-opencv
native-opencv is the OpenCV library installed via npm native-opencv downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attac…
-
High —
Downloads Resources over HTTP in unicode
unicode loads unicode data downloaded from unicode.org into nodejs. Unicode before 9.0.0 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.
-
High 8.1
selenium-binaries downloads resources over HTTP
selenium-binaries downloads Selenium related binaries for your OS. selenium-binaries downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary…
-
High —
Downloads Resources over HTTP in cue-sdk-node
cue-sdk-node is a Corsair Cue SDK wrapper for node.js. cue-sdk-node downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attack…