Archive
5 July 2018
Vulnerabilities first published on this day (UTC), newest first.
133 results · Feed
-
Unscored —
Gleez CMS 1.2.0 has CSRF, as demonstrated by a /page/add request.
-
Medium 6.1
Angular Redactor XSS Vulnerability
Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035.
-
Unscored —
In Bitcoin Core before v0.13.0, a non-final alert is able to block the special "final alert" (which is supposed to over…
-
Unscored —
Bitcoin Core before v0.13.0 allows denial of service (memory exhaustion) triggered by the remote network alert system (…
-
Unscored —
DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account.
-
Unscored —
In CyberArk Endpoint Privilege Manager (formerly Viewfinity), Privilege Escalation is possible if the attacker has one …
-
Unscored —CVE-2018-12739 Public exploit
In BEESCMS 4.0, CSRF allows administrators to be added arbitrarily, a related issue to CVE-2018-10266.
-
Unscored —
Core FTP LE version 2.2 Build 1921 is prone to a buffer overflow vulnerability that may result in a DoS or remote code …
-
Unscored —CVE-2018-12571 EPSS 30%
uniquesig0/InternalSite/InitParams.aspx in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to t…
-
Unscored —
An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seed…
-
Unscored —
An issue was discovered on D-Link DIR-890L with firmware 1.21B02beta01 and earlier, DIR-885L/R with firmware 1.21B03bet…
-
Unscored —CVE-2018-8738 Public exploit
Airties 5444 1.0.0.18 and 5444TT 1.0.0.18 devices allow XSS.
-
Unscored —CVE-2018-8046 EPSS 66%
The getTip() method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when pass…
-
Unscored —
Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before …
-
Unscored —
Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.…
-
Unscored —
An issue was discovered on Dongguan Diqee Diqee360 devices. The affected vacuum cleaner suffers from an authenticated r…
-
Unscored —
An issue was discovered on Diqee Diqee360 devices. A firmware update process, integrated into the firmware, starts at b…
-
Unscored —
The condor_schedd component in HTCondor before 8.6.8 and 8.7.x before 8.7.5 allows remote authenticated users to cause …
-
Unscored —
Huawei smart phones Emily-AL00A with software 8.1.0.106(SP2C00) and 8.1.0.107(SP5C00) have a Factory Reset Protection (…
-
Unscored —
The _sell function of a smart contract implementation for GROWCHAIN (GROW), an Ethereum token, has an integer overflow.
-
Unscored —
The transfer, transferFrom, and mint functions of a smart contract implementation for PFGc, an Ethereum token, have an …
-
Unscored —
In Go Doc Dot Org (gddo) through 2018-06-27, an attacker could use specially crafted <go-import> tags in packages being…
-
Unscored —
Time-of-check to time-of-use (TOCTOU) race condition in org.onosproject.acl (aka the access control application) in ONO…
-
Medium 6.5
Singularity Incorrect Access Control
Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features.
-
Unscored —
The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empt…
-
Unscored —
In J2 Innovations FIN Stack 4.0, the authentication webform is vulnerable to reflected XSS via the query string to /log…
-
Unscored —
In FFmpeg 4.0.1, due to a missing check for negative values of the mquant variable, the vc1_put_blocks_clamped function…
-
Unscored —
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_pro…
-
Unscored —
In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in l…
-
Unscored —
In FFmpeg 4.0.1, improper handling of frame types (other than EAC3_FRAME_TYPE_INDEPENDENT) that have multiple independe…
-
Unscored —
Entrust Datacard Syntera CS 5.x has XSS via the name field of "Domain or Computer Name" in the login page.
-
Unscored —
In FFmpeg 3.2 and 4.0.1, an improper argument (AVCodecParameters) passed to the avpriv_request_sample function in the h…
-
Unscored —
In FFmpeg 4.0.1, due to a missing check of a profile value before setting it, the ff_mpeg4_decode_picture_header functi…
-
Critical 9.1
Denial of Service in memjs
`memjs` versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage.
-
Unscored —
In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could …
-
Unscored —
Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing che…
-
Unscored —
In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a …
-
Unscored —
Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allow…
-
Medium 6.1
grape subject to Cross-site Scripting
ruby-grape ruby gem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter.
-
High 7.5
Path Traversal in buttle
Path traversal in buttle module versions <= 0.2.0 allows to read any file in the server.