Archive
16 July 2018
Vulnerabilities first published on this day (UTC), newest first.
44 results · Feed
-
High 7.0
pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS…
-
Unscored —CVE-2018-13832 Public exploit
Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) pl…
-
Unscored —
The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 allows re…
-
Medium 5.9
git-annex private data exfiltration to compromised remote
git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.
-
Medium 5.2
Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An a…
-
Unscored —
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.…
-
Medium 4.3
The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", f…
-
Medium 5.9
git-annex GPG decryption attack via compromised remote
git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data that wa…
-
Unscored —CVE-2018-14324 Public exploit
The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin…
-
Unscored —
A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attac…
-
Unscored —
A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, local attacker to acce…
-
Unscored —
A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthentica…
-
Unscored —
A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attac…
-
Unscored —
ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively sma…
-
Unscored —
A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11…
-
Unscored —
A vulnerability in the detection engine parsing of Security Socket Layer (SSL) protocol packets for Cisco Firepower Sys…
-
Unscored —
ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor fi…
-
Unscored —
A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attac…
-
Unscored —
A vulnerability in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms could …
-
Unscored —
Norton App Lock prior to v1.3.0.332 can be susceptible to a bypass exploit. In this type of circumstance, the exploit c…
-
Unscored —
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticat…
-
Unscored —
Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow auth…
-
Unscored —
Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow aut…
-
Unscored —
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier coul…
-
Unscored —
Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could all…
-
Unscored —
An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a conte…
-
Unscored —CVE-2018-11716 EPSS 14%
An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to a…
-
Unscored —
The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated remote code…
-
Unscored —
The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclo…
-
Unscored —
The Notes Client Single Logon feature in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3, and 9.0 on Windows allo…
-
Unscored —
X File Explorer (aka xfe) might allow local users to bypass intended access restrictions and gain access to arbitrary f…
-
Unscored —
The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5…
-
Unscored —
The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remo…
-
Unscored —
The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input.
-
Medium 4.8
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client ce…
-
Medium 6.5
Infinispan Rest API Does Not Enforce Auth Constraints
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
-
Unscored —
An issue was discovered in a smart contract implementation for EUC (EUC), an Ethereum token. The contract has an intege…
-
Unscored —
An issue was discovered in a smart contract implementation for UserWallet 0x0a7bca9FB7AfF26c6ED8029BB6f0F5D291587c42, a…
-
Unscored —
An issue was discovered in a smart contract implementation for Virgo_ZodiacToken, an Ethereum token. In this contract, …
-
Unscored —
An issue was discovered in a smart contract implementation for MKCB, an Ethereum token. If the owner sets the value of …