Archive
27 June 2018
Vulnerabilities first published on this day (UTC), newest first.
31 results · Feed
-
Unscored —
An improper access control vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0,…
-
Unscored —
An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and…
-
Unscored —
Under certain conditions, TMM may restart and produce a core file while processing APM data on BIG-IP 13.0.1 or 13.1.0.…
-
Unscored —
On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client…
-
Unscored —
Beckhoff TwinCAT 3 supports communication over ADS. ADS is a protocol for industrial automation in protected environmen…
-
Unscored —
Beckhoff TwinCAT supports communication over ADS. ADS is a protocol for industrial automation in protected environments…
-
Medium 5.3
IBM WebSphere Application Server Liberty prior to 18.0.0.2 could allow a remote attacker to obtain sensitive informatio…
-
Medium 5.4
IBM DOORS Next Generation (DNG/RRC) 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to emb…
-
Medium 5.9
IBM WebSphere MQ 8.0 and 9.0 could allow a remote attacker to obtain sensitive information, caused by the failure to pr…
-
High 7.5
Exposure of Sensitive Information in Apache Pluto
The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker coul…
-
High 8.1
An undisclosed vulnerability in IBM Rational DOORS 9.5.1 through 9.6.1.10 application allows an attacker to gain DOORS …
-
Unscored —
In Miniz 2.0.7, tinfl_decompress in miniz_tinfl.c has an infinite loop because sym2 and counter can both remain equal t…
-
Unscored —
In CraftedWeb through 2013-09-24, aasp_includes/pages/notice.php allows XSS via the e parameter.
-
Unscored —
In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcB_register_fields in bootstrap.c.
-
Unscored —
In libpbc.a in PBC through 2017-03-02, there is a heap-based buffer over-read in _pbcM_ip_new in map.c.
-
Unscored —CVE-2018-12912 Public exploit
An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via …
-
Unscored —
A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that cont…
-
Unscored —
In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcP_message_default in proto.c.
-
Unscored —
In libpbc.a in PBC through 2017-03-02, there is a buffer over-read in calc_hash in map.c.
-
Medium 5.3
Eclipse Jetty Server generates error message containing sensitive information
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad chara…
-
Unscored —
Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensit…
-
Unscored —
Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the w…
-
Medium 6.8
TIBCO Spotfire Product Family Information Disclosure Vulnerability
The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop…
-
Medium 6.5
TIBCO Spotfire Server information disclosure vulnerabilities
The Spotfire server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contain multiple vulnerabilities that may allow for the disclosure of information, including user and data source credentia…
-
Critical 9.6
TIBCO Spotfire Product Family Remote Code Execution Vulnerability
The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop…
-
Critical 9.0
It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An…
-
High 8.1
Race condition in org.apache.hbase:hbase-thrift
CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would…
-
Unscored —CVE-2018-12905 EPSS 42%
joyplus-cms 1.6.0 has XSS in admin_player.php, related to manager/index.php "system manage" and "add" actions.
-
Unscored —
In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to …
-
Critical 9.8
PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
-
Unscored —CVE-2018-12904 Public exploit
In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could caus…