Skip to content
OpenAdvisories

Archive

1 June 2018

Vulnerabilities first published on this day (UTC), newest first.

← May 2018 2018 / June /1 July 2018 →
  1. 1151
  2. 25
  3. 3 
  4. 4136
  5. 560
  6. 630
  7. 7237
  8. 896
  9. 91
  10. 101
  11. 11349
  12. 1256
  13. 1359
  14. 1471
  15. 1548
  16. 164
  17. 1726
  18. 1827
  19. 1948
  20. 2035
  21. 2141
  22. 2226
  23. 2310
  24. 244
  25. 2529
  26. 26144
  27. 2731
  28. 2820
  29. 2937
  30. 305
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 4.8
    CVE-2018-11564 Public exploit

    Pagekit Stored Cross-site Scripting

    Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will …

    pagekit/pagekit Packagist
  • Medium 4.2
    CVE-2018-1002100

    Kubernetes arbitrary file overwrite

    In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  • Medium 5.3
    CVE-2018-3809

    Information Exposure on Case Insensitive File Systems in serve

    Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored.

    serve npm
  • Medium 5.9
    CVE-2016-10594

    ipip downloads Resources over HTTP

    ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net. ipip downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.

    HackerOne ipip node module ipip npm
  • Medium —
    CVE-2016-10592

    Downloads Resources over HTTP in jser-stat

    jser-stat is a JSer.info stat library. jser-stat downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.

    HackerOne jser-stat node module jser-stat npm
  • Medium 6.1
    CVE-2018-3755

    Cross-Site Scripting in sexstatic

    XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element used in directory name.

    HackerOne sexstatic sexstatic npm
  • Medium 6.1
    CVE-2018-3743

    Open Redirect in hekto

    Open redirect in hekto <=0.2.3 when target domain name is used as html filename on server.

    HackerOne hekto hekto npm
  • Medium 6.1
    CVE-2018-11651

    Cross-site Scripting in Graylog

    Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx.

    org.graylog2:graylog2-server Maven
  • Medium 6.1
    CVE-2018-11650

    Cross-site Scripting in Graylog Server

    Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.

    org.graylog2:graylog2-server Maven
  • Medium 6.5
    CVE-2018-8921

    Cross-site scripting (XSS) vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remot…

    Synology Drive
  • Medium 6.5
    CVE-2018-8922

    Improper access control vulnerability in Synology Drive before 1.0.2-10275 allows remote authenticated users to access …

    Synology Drive