Archive
June 2018
Vulnerabilities first published in this month (UTC), newest first.
1,787 results · Feed
-
Medium 6.1
Ignite Realtime Openfire vulnerable to cross-site scripting
Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the secu…
-
High 8.8
Symfony CSRF Token Fixation
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior ca…
-
Unscored —
There is a heap out of bounds read in radare2 2.6.0 in java_switch_op() in libr/anal/p/anal_java.c via a crafted Java b…
-
Unscored —
There is a heap out of bounds read in radare2 2.6.0 in _6502_op() in libr/anal/p/anal_6502.c via a crafted iNES ROM bin…
-
Unscored —
An issue was discovered on Momentum Axel 720P 5.1.8 devices. A password of EHLGVG is hard-coded for the root and admin …
-
Unscored —
There is a use after free in radare2 2.6.0 in r_anal_bb_free() in libr/anal/bb.c via a crafted Java binary file.
-
Unscored —
Norton App Lock prior to version 1.3.0.329 can be susceptible to a bypass exploit. In this type of circumstance, the ex…
-
Medium 6.1
Symfony Open Redirect
An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthenticationSuccessHandler or DefaultAuthenticationFailureHandler takes the content of the _target_path parameter and generates…
-
High —
private_address_check contains race condition
private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public a…
-
Low 3.1
IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.6 could allow an authenticated user to execut…
-
High 7.4
A vulnerability in GSKit affects IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.3, and 5.0.0 that could allow a local atta…
-
High 7.5
Matrix Synapse Security Filtering Flaw
The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly.
-
Medium 6.1
Yii2-StateMachine extension for Yii2 XSS Vulnerability
The Yii2-StateMachine extension v2.x.x for Yii2 has XSS.
-
Unscored —CVE-2018-12292 Public exploit
A use-after-free vulnerability exists in DOMProxyHandler::EnsureExpandoObject in Pale Moon before 27.9.3.
-
Medium 6.5
open build service allows anyone to upload rpms
A vulnerability in open build service allows remote attackers to upload arbitrary RPM files. Affected releases are SUSE open build service prior to 2.1.16.
-
Unscored —
xowl/request.php in Ximdex 4.0 has XSS via the content parameter.
-
Unscored —
The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter.
-
High 8.0
TIBCO Administrator - Enterprise Edition Cross-Site Scripting Vulnerability
The TIBCO Administrator server component of of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains multiple vulnerabilities wherein a malicious user could theoretically perform cros…
-
Medium 5.8
XML eXternal Entity Expansion Vulnerabilities with TIBCO Runtime Agent
The TIBCO Designer component of TIBCO Software Inc.'s TIBCO Runtime Agent, and TIBCO Runtime Agent for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion (XXE) attacks to disclose host machine information. Af…
-
Medium 6.5
XML eXternal Entity Expansion Vulnerabilities with TIBCO Administrator
The TIBCO Administrator server component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion …
-
Unscored —
system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code.
-
Unscored —
Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv…
-
Unscored —
portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI.
-
Unscored —
acccheck.pl in acccheck 0.2.1 allows Command Injection via shell metacharacters in a username or password file, as demo…
-
Unscored —
Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::Va…
-
Unscored —
Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 (as well as in RTsoft's Dink Smallwood HD / Proto…
-
Unscored —
In the KGSL driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux …
-
Unscored —
improper validation of array index in WiFi driver function sapInterferenceRssiCount() leads to array out-of-bounds acce…
-
Unscored —
In the WLAN driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux …
-
Unscored —
In the WLAN driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux …
-
Unscored —
While processing a DSP buffer in an audio driver's event handler, an index of a buffer is not checked before accessing …
-
Unscored —
Buffer overflow can occur due to improper input validation in multiple WMA event handler functions in all Android relea…
-
Unscored —
Early or late retirement of rotation requests can result in a Use After Free condition in all Android releases from CAF…
-
Unscored —
An arbitrary address write can occur if a compromised WLAN firmware sends incorrect data to WLAN driver in all Android …
-
Unscored —
In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a resul…
-
Unscored —
In the video driver function set_output_buffers(), binfo can be accessed after being freed in a failure scenario in all…
-
Unscored —
In the function wma_pdev_div_info_evt_handler() in all Android releases from CAF (Android for MSM, Firefox OS for MSM, …
-
Unscored —
Buffer over flow can occur while processing a HTT_T2H_MSG_TYPE_TX_COMPL_IND message with an out-of-range num_msdus valu…
-
Unscored —
Due to a race condition in the QTEECOM driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QR…
-
Unscored —
In wma_ndp_end_response_event_handler(), the variable len_end_rsp is a uint32 which can be overflowed if the value of v…