Archive
June 2018
Vulnerabilities first published in this month (UTC), newest first.
1,787 results · Feed
-
Critical 9.8
OpenTSDB vulnerable to OS Command Injection
An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input.
-
Unscored —
A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt.cpp in PoDoFo 0.…
-
Critical 9.8
Missing Authentication for Critical Function in Apache Cassandra
The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225…
-
Unscored —
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.6 and below versions allows attacker to …
-
Unscored —
The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal…
-
Unscored —
ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a st…
-
Unscored —
PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (heap-based buffer ove…
-
Unscored —
remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excess…
-
Unscored —
PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (out-of-bounds write) …
-
Unscored —
ntfs_attr_find in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based ou…
-
Unscored —
In the Linux kernel 4.15.0, a NULL pointer dereference was discovered in hfs_ext_read_extent in hfs.ko. This can occur …
-
Unscored —
ntfs_read_locked_inode in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a use-af…
-
Unscored —
Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in…
-
Unscored —
The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 …
-
Unscored —
Electro Industries GaugeTech Nexus devices allow remote attackers to obtain potentially sensitive information via a dir…
-
Unscored —
Sollae Serial-Ethernet-Module and Remote-I/O-Device-Server devices have a default password of sollae for the TELNET ser…
-
Unscored —
Brickstream 2300 devices allow remote attackers to obtain potentially sensitive information via a direct request for th…
-
Unscored —
Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the…
-
Unscored —
Northern Electric & Power (NEP) inverter devices allow remote attackers to obtain potentially sensitive information via…
-
Unscored —
Baseon Lantronix MSS devices do not require a password for TELNET access.
-
Unscored —
Emerson Liebert IntelliSlot Web Card devices allow remote attackers to reconfigure access control via the config/config…
-
Unscored —
BWS Systems HA-Bridge devices allow remote attackers to obtain potentially sensitive information via a direct request f…
-
Unscored —
An improper access control vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0,…
-
Unscored —
An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and…
-
Unscored —
Under certain conditions, TMM may restart and produce a core file while processing APM data on BIG-IP 13.0.1 or 13.1.0.…
-
Unscored —
On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client…
-
Unscored —
Beckhoff TwinCAT 3 supports communication over ADS. ADS is a protocol for industrial automation in protected environmen…
-
Unscored —
Beckhoff TwinCAT supports communication over ADS. ADS is a protocol for industrial automation in protected environments…
-
Medium 5.3
IBM WebSphere Application Server Liberty prior to 18.0.0.2 could allow a remote attacker to obtain sensitive informatio…
-
Medium 5.4
IBM DOORS Next Generation (DNG/RRC) 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to emb…
-
Medium 5.9
IBM WebSphere MQ 8.0 and 9.0 could allow a remote attacker to obtain sensitive information, caused by the failure to pr…
-
High 7.5
Exposure of Sensitive Information in Apache Pluto
The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker coul…
-
High 8.1
An undisclosed vulnerability in IBM Rational DOORS 9.5.1 through 9.6.1.10 application allows an attacker to gain DOORS …
-
Unscored —
In Miniz 2.0.7, tinfl_decompress in miniz_tinfl.c has an infinite loop because sym2 and counter can both remain equal t…
-
Unscored —
In CraftedWeb through 2013-09-24, aasp_includes/pages/notice.php allows XSS via the e parameter.
-
Unscored —
In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcB_register_fields in bootstrap.c.
-
Unscored —
In libpbc.a in PBC through 2017-03-02, there is a heap-based buffer over-read in _pbcM_ip_new in map.c.
-
Unscored —CVE-2018-12912 Public exploit
An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via …
-
Unscored —
A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that cont…
-
Unscored —
In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcP_message_default in proto.c.