Skip to content
OpenAdvisories

Archive

26 June 2018

Vulnerabilities first published on this day (UTC), newest first.

← May 2018 2018 / June /26 July 2018 →
  1. 1151
  2. 25
  3. 3 
  4. 4136
  5. 560
  6. 630
  7. 7237
  8. 896
  9. 91
  10. 101
  11. 11349
  12. 1256
  13. 1359
  14. 1471
  15. 1548
  16. 164
  17. 1726
  18. 1827
  19. 1948
  20. 2035
  21. 2141
  22. 2226
  23. 2310
  24. 244
  25. 2529
  26. 26144
  27. 2731
  28. 2820
  29. 2937
  30. 305
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 7.5
    CVE-2018-3760 Public exploit Scanner template EPSS 26%

    Sprockets path traversal leads to information leak

    There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root di…

    HackerOne Sprockets ruby-sprockets sprockets Debian Ubuntu RubyGems
  • High 8.8
    CVE-2018-1000610

    Jenkins Configuration as Code Plugin has Insufficiently Protected Credentials

    A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkin…

    io.jenkins:configuration-as-code Maven
  • High 8.8
    CVE-2018-1000603

    CSRF vulnerability and missing permission checks in Openstack Cloud Plugin allowed capturing credentials

    A exposure of sensitive information vulnerability exists in Jenkins Openstack Cloud Plugin 2.35 and earlier in BootSource.java, InstancesToRun.java, JCloudsCleanupThread.java, JCloudsCloud.java, JCloudsComputer.java, JCloudsPreCreationThread.java, JCloudsRete…

    org.jenkins-ci.plugins:openstack-cloud Maven
  • High 8.8
    CVE-2018-1000600 Scanner template EPSS 91%

    CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials

    A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another met…

    com.coravy.hudson.plugins.github:github Maven
  • High 8.0
    CVE-2018-1000517 EPSS 32%

    BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflo…

    busybox busybox Debian Ubuntu
  • High 7.5
    CVE-2018-1000518

    websockets is vulnerable to denial of service by memory exhaustion

    aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This a…

    websockets PyPI
  • High 8.1
    CVE-2018-1000523

    Topydo Improper Input Validation vulnerability

    topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of d4f843dac71308b2f29a7c2cdc76f055c3841523 that can result in Injection of arbitrary bytes to the terminal, including term…

    topydo PyPI
  • High 7.2
    CVE-2018-1000527

    Froxlor PHP Object Injection vulnerability

    Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $_POST['ssl…

    froxlor/froxlor Packagist
  • High 7.5
    CVE-2017-7656

    Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)

    In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a versi…

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven
  • High 8.1
    CVE-2018-0572

    baserCMS vulnerable to Access Control Bypass

    baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass access restriction to view or alter a restricted content via unspecified vectors.

    baserCMS Users Community BaserCMS baserproject/basercms Packagist
  • High 8.8
    CVE-2018-0569

    OS Command Injection in baserCMS

    baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbitrary OS commands via unspecified vectors.

    baserCMS Users Community BaserCMS baserproject/basercms Packagist