Archive
22 June 2018
Vulnerabilities first published on this day (UTC), newest first.
26 results · Feed
-
Unscored —
Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domai…
-
Unscored —
phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request, or a cr…
-
Unscored —
tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.
-
Unscored —
Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Den…
-
Unscored —
tinyexr 0.9.5 has a segmentation fault in the wav2Decode function.
-
High 8.8
Access and integrity issue within Eclipse Jetty
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSes…
-
High 7.8
Ruby-ffi has a DLL loading issue
ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.
-
Unscored —
Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parame…
-
Unscored —
The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Adm…
-
Unscored —
Reflected Cross-Site Scripting (XSS) exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membe…
-
Unscored —
Reflected Cross-Site Scripting (XSS) exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circ…
-
Unscored —
SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omittin…
-
Unscored —
Reflected Cross-Site Scripting (XSS) exists in the Master File module in SLiMS 8 Akasia 8.3.1 via an admin/modules/mast…
-
Unscored —
Reflected Cross-Site Scripting (XSS) exists in the Bibliography module in SLiMS 8 Akasia 8.3.1 via an admin/modules/bib…
-
Unscored —
Reflected Cross-Site Scripting (XSS) exists in the Stock Take module in SLiMS 8 Akasia 8.3.1 via an admin/modules/stock…
-
Unscored —
NetApp OnCommand Unified Manager for 7-Mode (core package) versions prior to 5.2.3 may disclose sensitive LDAP account …
-
Medium 4.0
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains a vulnerability in the rmsock command that may be used to expose kernel memory.…
-
Unscored —
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force p…
-
Unscored —
The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer derefer…
-
High 8.0
Ansible Arbitrary Code Execution
Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this…
-
Medium 6.5
389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind …
-
High 7.5
Froxlor Incorrect Access Control
Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user.
-
Unscored —
An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustio…
-
Unscored —CVE-2018-12633 Public exploit
An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest…
-
Unscored —
CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/l…
-
Unscored —
CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware…