Archive
June 2018
Vulnerabilities first published in this month (UTC), newest first.
1,787 results · Feed
-
High —
Downloads Resources over HTTP in resourcehacker
resourcehacker is a Node wrapper of Resource Hacker (windows executable resource editor). resourcehacker downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out …
-
High 8.1
windows-selenium-chromedriver downloads Resources over HTTP
windows-selenium-chromedriver is a module that downloads the Selenium Jar file. windows-selenium-chromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping…
-
High —
Downloads Resources over HTTP in jstestdriver
jstestdriver is a wrapper for Google's jstestdriver. jstestdriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker c…
-
High 8.1
slimerjs-edge downloads Resources over HTTP
slimerjs-edge is a npm wrapper for installing the bleeding edge version of slimerjs. slimerjs-edge downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the re…
-
Medium —
Downloads Resources over HTTP in arcanist
arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positione…
-
Unscored —
WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKi…
-
Unscored —
An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 0…
-
Unscored —
WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKi…
-
Unscored —
Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior m…
-
Unscored —CVE-2018-10613 EPSS 18%
Multiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows platform in…
-
Unscored —
Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise v…
-
Unscored —
soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (application crash) …
-
Unscored —CVE-2018-11709 Scanner template
wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unau…
-
Unscored —
A remote attacker can bypass the System Manager Mode on the Canon MF210 and MF220 web interface without knowing the PIN…
-
Medium 5.3
Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup tabl…
-
High 7.5
In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values
In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a priva…
-
Medium 5.9
Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain…
-
High 7.5
The Bouncy Castle JCE Provider carry a propagation bug
In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic cu…
-
High 7.5
In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification
In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cas…
-
Unscored —
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sa…
-
Unscored —
Liblouis 3.5.0 has a stack-based Buffer Overflow in the function includeFile in compileTranslationTable.c.
-
Unscored —
An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Functions:…
-
Unscored —
Liblouis 3.5.0 has a stack-based Buffer Overflow in the function compileHyphenation in compileTranslationTable.c.
-
Unscored —
An issue was discovered on Canon LBP6650, LBP3370, LBP3460, and LBP7750C devices. It is possible to bypass the Administ…
-
Unscored —
An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Inspect::o…
-
Unscored —
Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different v…
-
Unscored —
An issue was discovered in LibSass <3.5.3. A NULL pointer dereference was found in the function Sass::Expand::operator …
-
Unscored —
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sa…
-
Unscored —
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sa…
-
Unscored —
The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, whic…
-
Unscored —
The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might …
-
Critical 9.8
Default and unremovable support credentials (user:nwk password:nwk2) allow attackers to gain total super user control o…
-
Unscored —
Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total super user…
-
Critical 9.8
Default and unremovable support credentials allow attackers to gain total super user control of an IoT device through a…
-
Unscored —
An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability in the rich text editor that can add an …
-
Unscored —
An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability that can add an article via /index.php?c…
-
Unscored —
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 13 of 46).
-
Unscored —
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 14 of 46).
-
Unscored —
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46).
-
Unscored —
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 45 of 46).