Archive
June 2018
Vulnerabilities first published in this month (UTC), newest first.
1,787 results · Feed
-
High 7.5
mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input
The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
-
High 7.5
Directory Traversal in utahcityfinder
utahcityfinder constructs lists of Utah cities with a certain prefix. utahcityfinder is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
noderequest is malware
noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
Critical —
Command Injection in dns-sync
dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.
-
High —
Directory Traversal in fsk-server
fsk-server is a simple http server. fsk-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
An exploitable denial of service vulnerability exists in the Ocularis Recorder functionality of Ocularis 5.5.0.242. A s…
-
Unscored —
Stack-based buffer overflow can occur In the WLAN driver if the pmkid_count value is larger than the PMKIDCache size in…
-
Unscored —
While sending a probe request indication in lim_send_sme_probe_req_ind() in all Android releases from CAF (Android for …
-
Unscored —
Buffer over -read can occur while processing a FILS authentication frame in all Android releases from CAF (Android for …
-
Unscored —
Type mismatch for ie_len can cause the WLAN driver to allocate less memory on the heap due to implicit casting leading …
-
Unscored —
dcc_curr_list is initialized with a default invalid value that is expected to be programmed by the user through a sysfs…
-
Unscored —
A Use After Free condition can occur in the IPA driver whenever the IPA IOCTLs IPA_IOC_NOTIFY_WAN_UPSTREAM_ROUTE_ADD/IP…
-
Unscored —
In the function csr_update_fils_params_rso(), insufficient validation on a key length can result in an integer underflo…
-
Unscored —
A race condition in drm_atomic_nonblocking_commit() in the display driver can potentially lead to a Use After Free scen…
-
Unscored —
Buffer Copy without Checking Size of Input can occur during the DRM SDE driver initialization sequence in all Android r…
-
Unscored —
A crafted binder request can cause an arbitrary unmap in MediaServer in all Android releases from CAF (Android for MSM,…
-
Unscored —
In the web application in BeaconMedaes TotalAlert Scroll Medical Air Systems running software versions prior to 4107600…
-
Unscored —
Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 10…
-
Unscored —
Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files header…
-
Unscored —
Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 10…
-
Unscored —
An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticke…
-
Unscored —
In ABB IP GATEWAY 3.39 and prior, by accessing a specific uniform resource locator (URL) on the web server, a malicious…
-
Unscored —
In ABB IP GATEWAY 3.39 and prior, the web server does not sufficiently verify that a request was performed by the authe…
-
Unscored —
In ABB IP GATEWAY 3.39 and prior, some configuration files contain passwords stored in plain-text, which may allow an a…
-
Unscored —
Soar Labs Soar Coin version up to and including git commit 4a2aa71ee21014e2880a3f7aad11091ed6ad434f (latest release as …
-
Unscored —
IBM Rhapsody DM 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to a XML External Entity Injection (XXE) attack w…
-
Medium 5.9
IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 could allow a remote atta…
-
Medium 5.3
IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 discloses sensitive infor…
-
Medium 4.3
IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 stores potentially sensitive inf…
-
Unscored —
This module enables you to delete any types of entities in bulk. The module doesn't sufficiently verify access permissi…
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Unscored —
Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 1…
-
Unscored —
SGIN.CN xiangyun platform V9.4.10 has XSS via the login_url parameter to /login.php.
-
Unscored —
libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.
-
Medium 6.5
XML External Entity processing vulnerability in Jenkins Black Duck Hub Plugin
A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read permission to make Jenkins process XML eternal entities in an XML document.
-
Medium 5.4
Jenkins Groovy Postbuild Plugin vulnerable to Cross-site Scripting
A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser whe…
-
Medium 4.3
Cross-Site Request Forgery in Jenkins
A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether …
-
High 8.1
Path Traversal in Jenkins
A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subs…
-
High 8.1
Jenkins Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration
An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/Read permission to read and write the Black Duck Hub plugin configuration.