Archive
26 July 2018
Vulnerabilities first published on this day (UTC), newest first.
44 results · Feed
-
Unscored —
Thomson Reuters UltraTax CS 2017 on Windows, in a client/server configuration, transfers customer records and bank acco…
-
Unscored —
Thomson Reuters UltraTax CS 2017 on Windows has a password protection option; however, the level of protection might be…
-
Unscored —
huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and…
-
Unscored —
The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware…
-
Unscored —CVE-2017-18344 Public exploit
The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properl…
-
Medium 4.2
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group…
-
Medium 4.8
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of s…
-
Medium 5.0
A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() f…
-
Medium 4.2
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry…
-
High 7.4CVE-2017-12150 EPSS 13%
It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when c…
-
Unscored —
Untrusted search path vulnerability in LOGICOOL Game Software versions before 8.87.116 allows an attacker to gain privi…
-
Unscored —
NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 and earlier, CSDX(D…
-
Unscored —
Directory traversal vulnerability in ChamaNet MemoCGI v2.1800 to v2.2200 allows remote attackers to read arbitrary file…
-
Unscored —
Untrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30.9 allows an attacker t…
-
Unscored —
The DHC Online Shop App for Android version 3.2.0 and earlier does not verify X.509 certificates from SSL servers, whic…
-
Unscored —
Cross-site scripting vulnerability in NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, …
-
Unscored —
Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitr…
-
Unscored —
SQL injection vulnerability in the Notifications application in the Cybozu Garoon 3.5.0 to 4.6.2 allows remote authenti…
-
Unscored —
Untrusted search path vulnerability in the installer of Glarysoft Glary Utilities (Glary Utilities 5.99 and earlier and…
-
High 7.8
A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the pre…
-
Low 3.5
Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomp…
-
Medium 6.5
A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" …
-
Medium 5.5
It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuratio…
-
Medium 6.5
keycloak-core discloses system properties
It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the atta…
-
Low 3.5
An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1…
-
Medium 4.1
A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If a…
-
Medium 4.1
An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14…
-
High 8.8CVE-2018-10900 Public exploit
Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation atta…
-
Medium 6.5
An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of cl…
-
Medium 6.5
XML External Entity Reference in jbpmmigration
It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potential…
-
Medium 5.1
A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and s…
-
Low 3.5
A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user…
-
High 8.7
Insecure cookie sharing in Hawtio
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sh…
-
Medium 5.4
Improper Control of Generation of Code in Apache Kafka
In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.
-
Low 2.2
Improper Input Validation in ansible
An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.
-
Medium 5.3
An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connectio…
-
Medium 5.3
OpenStack Neutron Race Condition vulnerability
A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following…
-
Medium 6.8
Improper Authentication in Apache Kafka
In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations…
-
Medium 6.5
CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the r…
-
Medium 6.1
foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting …