Archive
June 2018
Vulnerabilities first published in this month (UTC), newest first.
1,787 results · Feed
-
Unscored —
Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domai…
-
Unscored —
phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request, or a cr…
-
Unscored —
tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.
-
Unscored —
Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Den…
-
Unscored —
tinyexr 0.9.5 has a segmentation fault in the wav2Decode function.
-
High 8.8
Access and integrity issue within Eclipse Jetty
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSes…
-
High 7.8
Ruby-ffi has a DLL loading issue
ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.
-
Unscored —
Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parame…
-
Unscored —
The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Adm…
-
Unscored —
Reflected Cross-Site Scripting (XSS) exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membe…
-
Unscored —
Reflected Cross-Site Scripting (XSS) exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circ…
-
Unscored —
SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omittin…
-
Unscored —
Reflected Cross-Site Scripting (XSS) exists in the Master File module in SLiMS 8 Akasia 8.3.1 via an admin/modules/mast…
-
Unscored —
Reflected Cross-Site Scripting (XSS) exists in the Bibliography module in SLiMS 8 Akasia 8.3.1 via an admin/modules/bib…
-
Unscored —
Reflected Cross-Site Scripting (XSS) exists in the Stock Take module in SLiMS 8 Akasia 8.3.1 via an admin/modules/stock…
-
Unscored —
NetApp OnCommand Unified Manager for 7-Mode (core package) versions prior to 5.2.3 may disclose sensitive LDAP account …
-
Medium 4.0
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains a vulnerability in the rmsock command that may be used to expose kernel memory.…
-
Unscored —
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force p…
-
Unscored —
The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer derefer…
-
High 8.0
Ansible Arbitrary Code Execution
Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this…
-
Medium 6.5
389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind …
-
High 7.5
Froxlor Incorrect Access Control
Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user.
-
Unscored —
An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustio…
-
Unscored —CVE-2018-12633 Public exploit
An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest…
-
Unscored —
CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/l…
-
Unscored —
CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware…
-
Unscored —
Redatam7 (formerly Redatam WebServer) allows remote attackers to discover the installation path via an invalid LFN para…
-
Unscored —
Redatam7 (formerly Redatam WebServer) allows remote attackers to read arbitrary files via /redbin/rpwebutilities.exe/te…
-
Unscored —
NEWMARK (aka New Mark) NMCMS 2.1 allows SQL Injection via the sect_id parameter to the /catalog URI.
-
Medium 6.1
phpMyAdmin XSS Vulnerability
An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer featur…
-
High 8.8
phpMyAdmin Improper Authentication
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an impro…
-
Unscored —
System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potenti…
-
Unscored —
Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log …
-
Unscored —
Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the…
-
Unscored —
Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favor…
-
Unscored —
Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values.
-
Unscored —
qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 …
-
Medium 6.5
Stored cross-site scripting vulnerability
RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console administrator could potentially exploit this vulnerability to store arbitrary HTML or JavaScript co…
-
Unscored —
RSA Authentication Manager Security Console, versions 8.3 P1 and earlier, contains a reflected cross-site scripting vul…
-
Unscored —
Telesquare SDT-CS3B1 and SDT-CW3B1 devices through 1.2.0 have a default factory account. Remote attackers can obtain ac…