26 June 2018

144 results · Feed

• Critical 10.0
  CVE-2018-6667

  McAfee Web Gateway - Authentication Bypass vulnerability

  Authentication Bypass vulnerability in the administrative user interface in McAfee Web Gateway 7.8.1.0 through 7.8.1.5 allows remote attackers to execute arbitrary code via Java management extensions (JMX).

  McAfee Web Gateway
  Jun 26, 2018
• Critical 9.8
  CVE-2017-7658 EPSS 19%

  Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)

  In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked …

  The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven
  Jun 26, 2018
• Unscored —
  CVE-2018-1000542 Public exploit

  netbeans-mmd-plugin version <= 1.4.3 contains a XML External Entity (XXE) vulnerability in MMD file import that can res…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000514

  LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can resul…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000558

  OCS Inventory NG ocsreports 2.4 and ocsreports 2.3.1 version 2.4 and 2.3.1 contains a SQL Injection vulnerability in we…

  ocsinventory-server ocsinventory-server Debian Ubuntu
  Jun 26, 2018
• Medium 6.5
  CVE-2018-1000519

  aiohttp-session Session Fixation vulnerability

  aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttp_session/redis_storage.py#L42) that can result in Session Hijacking. This attack …

  aiohttp-session PyPI
  Jun 26, 2018
• Unscored —
  CVE-2018-1000554

  Trovebox version <= 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in user component that ca…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000504

  Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allow…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000536

  Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegratio…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000533 Public exploit Scanner template EPSS 73%

  klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000503

  MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view p…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000507

  WP User Groups version 2.0.0 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that can result…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000528 EPSS 46%

  GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulne…

  gosa gosa Debian Ubuntu
  Jun 26, 2018
• Unscored —
  CVE-2018-1000508

  WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting (XSS) vulnerability in Settings screen that can result in a…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000511

  WP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody…

  Jun 26, 2018
• Medium 6.1
  CVE-2018-1000529 Public exploit

  Stored Cross Site Scripting in Grails Fields Plugin

  Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8.

  org.grails:grails-core org.grails.plugins:fields Maven
  Jun 26, 2018
• Unscored —
  CVE-2018-1000524

  miniSphere version 5.2.9 and earlier contains a Integer Overflow vulnerability in layer_resize() function in map_engine…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000515

  ventrian News-Articles version NewsArticles.00.09.11 contains a XML External Entity (XXE) vulnerability in News-Article…

  Jun 26, 2018
• High 8.0
  CVE-2018-1000517 EPSS 32%

  BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflo…

  busybox busybox Debian Ubuntu
  Jun 26, 2018
• High 7.5
  CVE-2018-1000518

  websockets is vulnerable to denial of service by memory exhaustion

  aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This a…

  websockets PyPI
  Jun 26, 2018
• Medium 6.1
  CVE-2018-1000534

  Joplin Vulnerable to Cross-site Scripting in Note Content

  Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here h…

  joplin npm
  Jun 26, 2018
• Medium 6.1
  CVE-2018-1000516

  Galaxy cross-site scripting (XSS)

  The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Many templates used in the Galaxy server did not properly sanitize user's input, which would allow for cross-site scriptin…

  galaxy-app PyPI
  Jun 26, 2018
• Unscored —
  CVE-2018-1000556

  WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete …

  wordpress Ubuntu
  Jun 26, 2018
• Unscored —
  CVE-2018-1000538

  Minio Inc. Minio S3 server version prior to RELEASE.2018-05-16T23-35-33Z contains a Allocation of Memory Without Limits…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000549

  Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pag…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000512

  Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode…

  Jun 26, 2018
• High 8.1
  CVE-2018-1000523

  Topydo Improper Input Validation vulnerability

  topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of d4f843dac71308b2f29a7c2cdc76f055c3841523 that can result in Injection of arbitrary bytes to the terminal, including term…

  topydo PyPI
  Jun 26, 2018
• Unscored —
  CVE-2018-1000502

  MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add Ne…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000547

  coreBOS version 7.0 and earlier contains a Incorrect Access Control vulnerability in Module: Contacts that can result i…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000553

  Trovebox version <= 4.0.0-rc6 contains a Server-Side request forgery vulnerability in webhook component that can result…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000513

  LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in J…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000520

  ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mb…

  mbedtls mbedtls Debian Ubuntu
  Jun 26, 2018
• Unscored —
  CVE-2018-1000546

  Triplea version <= 1.9.0.0.10291 contains a XML External Entity (XXE) vulnerability in Importing game data that can res…

  triplea triplea Debian Ubuntu
  Jun 26, 2018
• Unscored —
  CVE-2018-1000540

  LoboEvolution version < 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity (XXE) vulnerability in …

  Jun 26, 2018
• Medium 6.5
  CVE-2018-1000500

  Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arb…

  busybox busybox busybox Debian Ubuntu Alpine
  Jun 26, 2018
• Unscored —
  CVE-2018-1000532

  beep version 1.3 and up contains a External Control of File Name or Path vulnerability in --device option that can resu…

  beep beep Debian Ubuntu
  Jun 26, 2018
• Unscored —
  CVE-2018-1000548

  Umlet version < 14.3 contains a XML External Entity (XXE) vulnerability in File parsing that can result in disclosure o…

  umlet Ubuntu
  Jun 26, 2018
• Unscored —
  CVE-2018-1000501

  Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/…

  Jun 26, 2018
• Unscored —
  CVE-2018-1000550

  The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi …

  sympa sympa Debian Ubuntu
  Jun 26, 2018
• Unscored —
  CVE-2018-1000552

  Trovebox version <= 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code inj…

  Jun 26, 2018