Skip to content
OpenAdvisories

Archive

5 July 2018

Vulnerabilities first published on this day (UTC), newest first.

← June 2018 2018 / July /5 August 2018 →
  1. 18
  2. 266
  3. 3113
  4. 416
  5. 5133
  6. 696
  7. 78
  8. 89
  9. 9431
  10. 1087
  11. 1198
  12. 1235
  13. 1386
  14. 14 
  15. 1512
  16. 1644
  17. 1732
  18. 18253
  19. 1956
  20. 20157
  21. 211
  22. 223
  23. 2361
  24. 2449
  25. 2533
  26. 2644
  27. 2777
  28. 289
  29. 2910
  30. 3014
  31. 31129
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.5
    CVE-2018-3766

    Path Traversal in buttle

    Path traversal in buttle module versions <= 0.2.0 allows to read any file in the server.

    https://github.com/jtrussell buttle buttle npm
  • High 8.8
    CVE-2016-10522

    Cross-site request forgery in rails_admin

    rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the …

    https://github.com/sferik rails_admin ruby gem rails_admin ruby-rails-admin Ubuntu RubyGems
  • High —
    CVE-2018-8038 Public exploit EPSS 10%

    High severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2, and org.apache.cxf.fediz:fediz-spring3

    Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the application plugins, or in the Identity Provider itself when parsing certain XML-based parameters.

    Apache Software Foundation Apache CXF Fediz org.apache.cxf.fediz:fediz-spring2 org.apache.cxf.fediz:fediz-spring Maven
  • High 7.5
    CVE-2018-12018 Public exploit

    Go Ethereum LES protocol implementation vulnerable to Denial of Service

    The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack b…

    github.com/ethereum/go-ethereum Go