Archive

1 June 2018

Vulnerabilities first published on this day (UTC), newest first.

← May 2018 2018 / June /1 July 2018 →

All Critical High Medium Low Exploited only Public exploit

151 results · Feed

Unscored —

CVE-2018-11161

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 19 of 46).

Jun 1, 2018
Unscored —

CVE-2018-11144

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 2 of 46).

Jun 1, 2018
Unscored —

CVE-2018-11169

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 27 of 46).

Jun 1, 2018
Unscored —

CVE-2018-11157

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 15 of 46).

Jun 1, 2018
Unscored —

CVE-2018-11174

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 32 of 46).

Jun 1, 2018
Unscored —

CVE-2018-11165

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 23 of 46).

Jun 1, 2018
Unscored —

CVE-2018-11162

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46).

Jun 1, 2018
Unscored —

CVE-2018-11180

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 38 of 46).

Jun 1, 2018
Unscored —

CVE-2018-11177

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 35 of 46).

Jun 1, 2018
Unscored —

CVE-2018-11176

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 34 of 46).

Jun 1, 2018
Unscored —

CVE-2018-11149

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46).

Jun 1, 2018
Unscored —

CVE-2018-11166

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 24 of 46).

Jun 1, 2018
Unscored —

CVE-2018-11158

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 16 of 46).

Jun 1, 2018
Unscored —

CVE-2018-11175

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 33 of 46).

Jun 1, 2018
Medium 4.2

CVE-2018-1002100

Kubernetes arbitrary file overwrite

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.

Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go

Jun 1, 2018
Unscored —

CVE-2018-11538 Public exploit EPSS 12%

servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST para…

Jun 1, 2018
Unscored —

CVE-2018-11195

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to the browser "back and r…

Jun 1, 2018
Unscored —

CVE-2018-11196

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 can be used as medium to transmit viruses…

Jun 1, 2018
Unscored —

CVE-2018-3756

Hyperledger Iroha versions v1.0_beta and v1.0.0_beta-1 are vulnerable to transaction and block signature verification b…

Jun 1, 2018
Critical 9.8

CVE-2018-3757

Command Injection in pdf-image

Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter.

pdf-image npm

Jun 1, 2018
Medium 5.3

CVE-2018-3809

Information Exposure on Case Insensitive File Systems in serve

Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored.

serve npm

Jun 1, 2018
High —

CVE-2016-10610

Downloads Resources over HTTP in unicode-json

unicode-json is a unicode lookup table. unicode-json before 2.0.0 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.

HackerOne unicode-json node module unicode-json npm

Jun 1, 2018
High —

CVE-2016-10616

Downloads Resources over HTTP in openframe-image

openframe-image is an Openframe extension which adds support for images via fbi. openframe-image downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.

HackerOne openframe-image node module openframe-image npm

Jun 1, 2018
High —

CVE-2016-10575

Downloads Resources over HTTP in kindlegen

Kindlegen is a simple Node.js wrapper of the official kindlegen program. Kindlegen versions before 1.1.0 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out t…

HackerOne kindlegen node module kindlegen npm

Jun 1, 2018
High —

CVE-2016-10613

Downloads Resources over HTTP in bionode-sra

bionode-sra is a Node.js wrapper for SRA Toolkit. bionode-sra downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.

HackerOne bionode-sra node module bionode-sra npm

Jun 1, 2018
High 8.1

CVE-2016-10581

steroids downloads resources over HTTP

Steroids is PhoneGap on Steroids, providing native UI elements, multiple WebViews and enhancements for better developer productivity. steroids downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote…

HackerOne steroids node module steroids npm

Jun 1, 2018
High —

CVE-2016-10614

Downloads Resources over HTTP in httpsync

httpsync is a port of libcurl to node.js. httpsync downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binar…

HackerOne httpsync node module httpsync npm

Jun 1, 2018
High —

CVE-2016-10602

Downloads Resources over HTTP in haxe

haxe is a cross-platform toolkit haxe downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the …

HackerOne haxe node module haxe npm

Jun 1, 2018
High —

CVE-2016-10585

Downloads Resources over HTTP in libxl

libxl provides Node bindings for the libxl library for reading and writing excel (XLS and XLSX) spreadsheets. libxl downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by sw…

HackerOne libxl node module libxl npm

Jun 1, 2018
High 8.1

CVE-2016-10624

selenium-chromedriver Downloads Resources over HTTP

selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) …

HackerOne selenium-chromedriver node module selenium-chromedriver npm

Jun 1, 2018
High 8.1

CVE-2016-10632

apk-parser2 downloads Resources over HTTP

apk-parser2 is a module which extracts Android Manifest info from an APK file. apk-parser2 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested …

HackerOne apk-parser2 node module apk-parser2 npm

Jun 1, 2018
High 8.1

CVE-2016-10605

dalek-browser-ie downloads Resources over HTTP

dalek-browser-ie is Internet Explorer bindings for DalekJS. dalek-browser-ie downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an…

HackerOne dalek-browser-ie node module dalek-browser-ie npm

Jun 1, 2018
High —

CVE-2016-10606

Downloads Resources over HTTP in grunt-webdriver-qunit

grunt-webdriver-qunit is a grunt plugin to run qunit with webdriver in grunt grunt-webdriver-qunit downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the re…

HackerOne grunt-webdriver-qunit node module grunt-webdriver-qunit npm

Jun 1, 2018
High —

CVE-2016-10620

Downloads Resources over HTTP in atom-node-module-installer

atom-node-module-installer installs node modules for atom-shell applications. atom-node-module-installer binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the reques…

HackerOne atom-node-module-installer node module atom-node-module-installer npm

Jun 1, 2018
High —

CVE-2016-10615

Downloads Resources over HTTP in curses

curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requeste…

HackerOne curses node module curses npm

Jun 1, 2018
High 8.1

CVE-2016-10576

fuseki downloads Resources over HTTP

Fuseki server wrapper and management API in fuseki before 1.0.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker …

HackerOne fuseki node module fuseki npm

Jun 1, 2018
High 8.1

CVE-2016-10618

node-browser downloads Resources over HTTP

node-browser is a wrapper webdriver by nodejs. node-browser downloads resources over HTTP, which leaves it vulnerable to MITM attacks.

HackerOne node-browser node module node-browser npm

Jun 1, 2018
High 8.1

CVE-2016-10582

closurecompiler downloads Resources over HTTP

closurecompiler is a Closure Compiler for node.js. closurecompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker …

HackerOne closurecompiler node module closurecompiler npm

Jun 1, 2018
High —

CVE-2016-10603

Downloads Resources over HTTP in air-sdk

air-sdk is a NPM wrapper for the Adobe AIR SDK. air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled …

HackerOne air-sdk node module air-sdk npm

Jun 1, 2018
High —

CVE-2016-10634

scalajs-standalone-bin Downloads Resources over HTTP

scala-standalone-bin is a Binary wrapper for ScalaJS. scala-standalone-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an a…

HackerOne scalajs-standalone-bin node module scalajs-standalone-bin npm

Jun 1, 2018