Archive
June 2018
Vulnerabilities first published in this month (UTC), newest first.
1,787 results · Feed
-
Unscored —
Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the userna…
-
Unscored —
SAJ Solar Inverter allows remote attackers to obtain potentially sensitive information via a direct request for the inv…
-
Medium 6.1
Cloud Foundry UAA open redirect
Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects…
-
Unscored —
Pivotal Operations Manager, versions 2.1.x prior to 2.1.6 and version 2.0.14, includes NGINX packages that lacks securi…
-
Medium 5.9
Moderate severity vulnerability that affects org.springframework:spring-core
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and Ma…
-
Medium 5.9
Spring Framework Cross Site Tracing (XST)
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If a…
-
Unscored —CVE-2018-12602 Public exploit
A CSRF vulnerability exists in LFCMS 3.7.0: users can be added arbitrarily.
-
Unscored —
NuCom WR644GACV devices before STA006 allow an attacker to download the configuration file without credentials. By down…
-
Unscored —
IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal.
-
Unscored —
Improperly implemented option-field processing in the TCP/IP stack on Allen-Bradley L30ERMS safety devices v30 and earl…
-
Unscored —
The buy function of a smart contract implementation for Gold Reward (GRX), an Ethereum ERC20 token, allows a potential …
-
Unscored —
The mintToken function of a smart contract implementation for Target Coin (TGT), a tradable Ethereum ERC20 token, has n…
-
Unscored —
The mintToken function of a smart contract implementation for PolyAI (AI), a tradable Ethereum ERC20 token, has no peri…
-
Unscored —
The mintToken function of a smart contract implementation for Fujinto (NTO), a tradable Ethereum ERC20 token, has no pe…
-
Unscored —
The mintToken function of a smart contract implementation for BitAsean (BAS), a tradable Ethereum ERC20 token, has no p…
-
Unscored —
The mintToken function of a smart contract implementation for Internet Node Token (INT), a tradable Ethereum ERC20 toke…
-
Unscored —
The sell function of a smart contract implementation for SEC, a tradable Ethereum ERC20 token, allows a potential trap …
-
Unscored —
The mintToken function of a smart contract implementation for Substratum (SUB), a tradable Ethereum ERC20 token, has no…
-
Unscored —
The sell function of a smart contract implementation for Substratum (SUB), a tradable Ethereum ERC20 token, allows a po…
-
Unscored —
The mintToken function of a smart contract implementation for GOAL Bonanza (GOAL), a tradable Ethereum ERC20 token, has…
-
Unscored —
The sell function of a smart contract implementation for SwftCoin (SWFTC), a tradable Ethereum ERC20 token, allows a po…
-
Unscored —
The sell function of a smart contract implementation for Internet Node Token (INT), a tradable Ethereum ERC20 token, al…
-
Unscored —
The sell function of a smart contract implementation for Target Coin (TGT), a tradable Ethereum ERC20 token, allows a p…
-
Unscored —
The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem (GVE), an Ethereum ERC20…
-
Unscored —
The approveAndCallcode function of a smart contract implementation for Block 18 (18T), an tradable Ethereum ERC20 token…
-
Unscored —
The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from …
-
Unscored —
An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c co…
-
Unscored —CVE-2018-12705 Public exploit
DIGISOL DG-BR4000NG devices have XSS via the SSID (it is validated only on the client side).
-
Unscored —CVE-2018-12706 Public exploit
DIGISOL DG-BR4000NG devices have a Buffer Overflow via a long Authorization HTTP header.
-
Unscored —
GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that alr…
-
Unscored —
A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cp…
-
Unscored —
finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) …
-
Unscored —
demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger exc…
-
Unscored —
The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Contr…
-
Unscored —
The webService binary on Insteon HD IP Camera White 2864-222 devices has a Buffer Overflow via a crafted pid, pwd, or u…
-
Unscored —CVE-2018-12692 EPSS 28%
TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to execute arbitrary …
-
Unscored —
mao10cms 6 allows XSS via the article page.
-
Unscored —
TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote attackers to cause a denial of service (r…
-
Unscored —
mao10cms 6 allows XSS via the m=bbs&a=index page.
-
Unscored —CVE-2018-12693 EPSS 16%
Stack-based buffer overflow in TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authentica…