Archive
June 2018
Vulnerabilities first published in this month (UTC), newest first.
1,787 results · Feed
-
Unscored —
The mg_handle_cgi function in mongoose.c in Mongoose 6.11 allows remote attackers to cause a denial of service (heap-ba…
-
Unscored —
SQL injection vulnerability in ConnX ESP HR Management 4.4.0 allows remote attackers to execute arbitrary SQL commands …
-
Medium 6.5
Auth0 angular-jwt misinterprets allowlist as regex
Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain.
-
Unscored —CVE-2018-11525 Public exploit
The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection.
-
Unscored —CVE-2018-11526 Public exploit
The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.
-
Unscored —
D-Link DIR-620 devices, with a certain Rostelekom variant of firmware 1.0.37, have a hardcoded rostel account, which ma…
-
Unscored —CVE-2018-8727 Scanner template
Path Traversal in Gateway in Mirasys DVMS Workstation 5.12.6 and earlier allows an attacker to traverse the file system…
-
Unscored —
An issue was discovered in AKCMS 6.1. CSRF can delete an article via an admincp deleteitem action to index.php.
-
Unscored —
An issue was discovered in AKCMS 6.1. CSRF can add an admin account via a /index.php?file=account&action=manageaccounts…
-
Unscored —
library/DBTech/Security/Action/Sessions.php in DragonByte vBSecurity 3.x through 3.3.0 for vBulletin 3 and vBulletin 4 …
-
Unscored —
There is a heap-based buffer overflow in bmp_compress1_row in appliers.cpp in sam2p 0.49.4 that leads to a denial of se…
-
Unscored —
FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00578dd8, triggered when the user opens a malformed JPEG file …
-
Unscored —
FastStone Image Viewer 6.2 has a User Mode Write AV at 0x005cb509, triggered when the user opens a malformed JPEG file …
-
Unscored —
FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00578cb3, triggered when the user opens a malformed JPEG file …
-
Unscored —
FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00578cc4, triggered when the user opens a malformed JPEG file …
-
Unscored —
FastStone Image Viewer 6.2 has a User Mode Read and Execute AV at 0x0057898e, triggered when the user opens a malformed…
-
Unscored —
FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00402d7d, triggered when the user opens a malformed JPEG file …
-
Unscored —
FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00402d6a, triggered when the user opens a malformed JPEG file …
-
Medium 5.0
ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add o…
-
High 7.5
Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB by default). The broker crashes due to …
-
Medium 6.5
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the di…
-
Medium 5.3
The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and in…
-
Unscored —
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The mount target path check in m…
-
Unscored —
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additi…
-
Unscored —
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. Arbitrary unmounts can be perfor…
-
Unscored —
An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load() instead of yaml.safe_load() w…
-
Unscored —
An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for URLs in the submit page, a user can …
-
Unscored —
An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a t…
-
Unscored —
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.w…
-
Unscored —
An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-se…
-
Unscored —
Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior utilizes a fixed-length heap buffer whe…
-
Unscored —
Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior utilizes a fixed-length stack buffer wh…
-
Unscored —
Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior performs read operations on a memory bu…
-
Unscored —
An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers …
-
Unscored —CVE-2018-1333 EPSS 17%
DoS for HTTP/2 connections by crafted requests
By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).
-
Unscored —CVE-2018-9021 Public exploit
An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to exe…
-
Unscored —
An improper input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to conduct SQL i…
-
Unscored —
An input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to poison log files with …
-
Unscored —
An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to exe…
-
Unscored —
An input validation vulnerability in CA Privileged Access Manager 2.x allows unprivileged users to execute arbitrary co…