Archive
June 2018
Vulnerabilities first published in this month (UTC), newest first.
34 results · Clear filters · Feed
-
Critical 9.1
Remote Code Execution in Micro Focus Secure Messaging Gateway
An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in co…
-
Critical 10.0
Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway
A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an ad…
-
Critical 9.8
OpenTSDB vulnerable to OS Command Injection
An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input.
-
Critical 9.8
Missing Authentication for Critical Function in Apache Cassandra
The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225…
-
Critical 9.6
TIBCO Spotfire Product Family Remote Code Execution Vulnerability
The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop…
-
Critical 9.0
It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An…
-
Critical 9.8
PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
-
Critical 10.0
McAfee Web Gateway - Authentication Bypass vulnerability
Authentication Bypass vulnerability in the administrative user interface in McAfee Web Gateway 7.8.1.0 through 7.8.1.5 allows remote attackers to execute arbitrary code via Java management extensions (JMX).
-
Critical 9.8CVE-2017-7658 EPSS 19%
Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked …
-
Critical 9.8
Rubyzip gem contains a Directory Traversal vulnerability in zip file component
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , a…
-
Critical 9.8CVE-2017-7657 EPSS 14%
Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a …
-
Critical 9.8
Centreon RCE Vulnerability
There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.
-
Critical 9.8
RichFaces vulnerable to Expression Language Injection
JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309.
-
Critical 9.8
Arbitrary code execution in Richfaces
JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, …
-
Critical 9.8
Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability
During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in…
-
Critical 9.8
CodeIgniter Session Fixation Vulnerability
A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled.
-
Critical 9.0
openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certifica…
-
Critical 9.8
Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a …
-
Critical 9.8
Symfony Authentication Bypass
An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which t…
-
Critical 9.8
SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided Jav…
-
Critical 9.8
The implementation of Action Message Format (AMF3) deserializers in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes due to improper code control
The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The abi…
-
Critical 9.1
Denial of Service in https-proxy-agent
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
-
Critical 9.8
npm-script-demo is malware
The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.
-
Critical 9.8
Chromium Remote Code Execution in electron
Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless …
-
Critical 10.0CVE-2017-16088 Public exploit
Sandbox Breakout in safe-eval
The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.
-
Critical 9.8
Remote Code Execution in pg
A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql whic…
-
Critical 9.8
pandora-doomsday is malware
The module pandora-doomsday infects other modules. It's since been unpublished from the registry.
-
Critical —
Command Injection in dns-sync
dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.
-
Critical 9.8
Unsafe eval() in summit allows arbitrary code execution
Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name.
-
Critical 9.8
Growl before 1.10.0 vulnerable to Command Injection
Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.
-
Critical 9.8
Default and unremovable support credentials (user:nwk password:nwk2) allow attackers to gain total super user control o…
-
Critical 9.8
Default and unremovable support credentials allow attackers to gain total super user control of an IoT device through a…
-
Critical 9.8
Command Injection in pdf-image
Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter.
-
Critical 9.8
Command Injection in pdfinfojs
The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine.