Skip to content
OpenAdvisories

Archive

June 2018

Vulnerabilities first published in this month (UTC), newest first.

← May 2018 2018 / June July 2018 →
  1. 1151
  2. 25
  3. 3 
  4. 4136
  5. 560
  6. 630
  7. 7237
  8. 896
  9. 91
  10. 101
  11. 11349
  12. 1256
  13. 1359
  14. 1471
  15. 1548
  16. 164
  17. 1726
  18. 1827
  19. 1948
  20. 2035
  21. 2141
  22. 2226
  23. 2310
  24. 244
  25. 2529
  26. 26144
  27. 2731
  28. 2820
  29. 2937
  30. 305
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 7.5
    CVE-2018-1306 Public exploit EPSS 42%

    Exposure of Sensitive Information in Apache Pluto

    The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker coul…

    Apache Software Foundation Apache Pluto org.apache.portals.pluto:pluto-container Maven
  • High 7.5
    CVE-2018-3760 Public exploit EPSS 26%

    Sprockets path traversal leads to information leak

    There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root di…

    HackerOne Sprockets sprockets ruby-sprockets Debian Ubuntu RubyGems
  • High 8.8
    CVE-2018-12613 Public exploit EPSS 98%

    phpMyAdmin Improper Authentication

    An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an impro…

    phpmyadmin/phpmyadmin phpmyadmin Alpine Packagist
  • High 7.5
    CVE-2018-8229 Public exploit EPSS 71%

    ChakraCore RCE Vulnerability

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…

    Microsoft Microsoft Edge ChakraCore Microsoft.ChakraCore Browsers NuGet
  • High 8.1
    CVE-2018-6961 Exploited Public exploit EPSS 85%

    VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web …

    VMware NSX SD-WAN by VeloCloud
    KEV Mar 25, 2022
  • High 8.8
    CVE-2018-5158 Public exploit EPSS 10%

    Malicious PDF can inject JavaScript into PDF Viewer

    The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability af…

    Mozilla Firefox Firefox ESR firefox Browsers Debian Ubuntu npm
  • High 7.5
    CVE-2016-9079 Exploited Public exploit EPSS 87%

    A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been di…

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
    KEV Jun 22, 2023
  • High 8.8
    CVE-2018-4233 Public exploit EPSS 54%

    An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iClou…

    qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Debian Ubuntu
  • High 7.8
    CVE-2018-12036 Public exploit

    Path Traversal in OWASP Dependency-Check

    OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.

    org.owasp:dependency-check-maven Maven
  • High 7.5
    CVE-2018-0296 Exploited Public exploit EPSS 100%

    A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, rem…

    KEV Nov 3, 2021
  • High —
    CVE-2017-16086 Public exploit

    ReDoS via long UserAgent header in ua-parser

    ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial of Service) attack when given a specially crafted UserAgent header.

    HackerOne ua-parser node module ua-parser npm