Archive
June 2018
Vulnerabilities first published in this month (UTC), newest first.
1,787 results · Feed
-
Unscored —
In libpbc.a in PBC through 2017-03-02, there is a buffer over-read in calc_hash in map.c.
-
Medium 5.3
Eclipse Jetty Server generates error message containing sensitive information
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad chara…
-
Unscored —
Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensit…
-
Unscored —
Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the w…
-
Medium 6.8
TIBCO Spotfire Product Family Information Disclosure Vulnerability
The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop…
-
Medium 6.5
TIBCO Spotfire Server information disclosure vulnerabilities
The Spotfire server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contain multiple vulnerabilities that may allow for the disclosure of information, including user and data source credentia…
-
Critical 9.6
TIBCO Spotfire Product Family Remote Code Execution Vulnerability
The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop…
-
Critical 9.0
It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An…
-
High 8.1
Race condition in org.apache.hbase:hbase-thrift
CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would…
-
Unscored —CVE-2018-12905 EPSS 42%
joyplus-cms 1.6.0 has XSS in admin_player.php, related to manager/index.php "system manage" and "add" actions.
-
Unscored —
In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to …
-
Critical 9.8
PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
-
Unscored —CVE-2018-12904 Public exploit
In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could caus…
-
Medium 6.6
iSM: Dell EMC iDRAC Service Module Improper File Permission Vulnerability
Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the default file permission of the hosts file of the host operating system (/etc/hosts) to world writable. A malicious low privi…
-
Unscored —
In Easy Magazine through 2012-10-26, there is XSS in the search bar of the web site.
-
Unscored —CVE-2018-12900 EPSS 25%
Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, …
-
Unscored —
In CyberArk Endpoint Privilege Manager (formerly Viewfinity) 10.2.1.603, there is persistent XSS via an account name on…
-
Medium 5.3
A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x67). The vulnerability is pr…
-
Medium 5.3
A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x69). The vulnerability is pr…
-
Medium 5.3
An IBM WebSphere MQ (Maintenance levels 7.1.0.0 - 7.1.0.9, 7.5.0.0 - 7.5.0.8, 8.0.0.0 - 8.0.0.8, 9.0.0.0 - 9.0.0.2, and…
-
Medium 5.8
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using malformed SAML responses from the SAML identity provider …
-
Unscored —
WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin…
-
Unscored —
Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVP…
-
Unscored —
An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, u…
-
Unscored —
An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases,…
-
High 7.5
Sprockets path traversal leads to information leak
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root di…
-
Unscored —
A vulnerability has been identified in SCALANCE M875 (All versions). The web interface on port 443/tcp could allow a st…
-
Unscored —
A vulnerability has been identified in SCALANCE M875 (All versions). The web interface on port 443/tcp could allow a Cr…
-
Unscored —
A vulnerability has been identified in SCALANCE M875 (All versions). An attacker with access to the local file system m…
-
Medium 5.0
ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup …
-
Unscored —
A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to th…
-
Unscored —
A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All ver…
-
Unscored —
A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All ver…
-
Unscored —
A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to th…
-
Unscored —
A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to th…
-
Unscored —
There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (…
-
Unscored —
An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface.
-
Unscored —
An issue was discovered in multiple models of Axis IP Cameras. There is an Incorrect Size Calculation.
-
Unscored —
There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to c…
-
Unscored —
An issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption.