July 2018

12 results · Clear filters · Feed

• Medium 6.5
  CVE-2017-2666 Public exploit

  Undertow-core vulnerable to HTTP Request Smuggling

  It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data int…

  [UNKNOWN] undertow undertow undertow Debian Ubuntu Maven
  Jul 27, 2018
• Medium 5.5
  CVE-2018-1002201 Public exploit EPSS 10%

  Improper Limitation of a Pathname to a Restricted Directory in zt-zip

  zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

  zeroturnaround zt-zip org.zeroturnaround:zt-zip Maven
  Jul 25, 2018
• Medium 6.5
  CVE-2018-1002202 Public exploit EPSS 13%

  Improper Limitation of a Pathname to a Restricted Directory in Zip4j

  zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

  zip4j zip4j net.lingala.zip4j:zip4j Maven
  Jul 25, 2018
• Medium 5.5
  CVE-2018-1002200 Public exploit EPSS 12%

  Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver

  plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

  Codehaus plexus-archiver org.codehaus.plexus:plexus-archiver plexus-archiver Debian Ubuntu Maven
  Jul 25, 2018
• Medium 5.3
  CVE-2018-10906 Public exploit

  In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is ac…

  [UNKNOWN] fuse fuse fuse3 Debian Ubuntu Alpine
  Jul 24, 2018
• Medium 6.5
  CVE-2018-14335 Public exploit EPSS 13%

  An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read…

  h2database Ubuntu
  Jul 24, 2018
• Medium 5.4
  CVE-2018-1513 Public exploit

  IBM Sterling B2B Integrator Standard Edition 5.2.0 through 5.2.6 is vulnerable to cross-site scripting. This vulnerabil…

  IBM Sterling B2B Integrator
  Jul 23, 2018
• Medium 5.4
  CVE-2018-1563 Public exploit

  IBM Sterling B2B Integrator Standard Edition (IBM Sterling File Gateway 2.2.0 through 2.2.6) is vulnerable to cross-sit…

  IBM Sterling File Gateway
  Jul 20, 2018
• Medium 5.8
  CVE-2018-1612 Public exploit EPSS 56%

  IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and…

  IBM QRadar SIEM
  Jul 17, 2018
• Medium 6.1
  CVE-2018-14042 Public exploit

  Bootstrap Cross-site Scripting vulnerability

  In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

  bootstrap twitter-bootstrap3 twitter-bootstrap3 org.webjars:bootstrap Debian Ubuntu npm Packagist Maven NuGet RubyGems
  Jul 13, 2018
• Medium 6.1
  CVE-2018-14041 Public exploit

  Bootstrap Cross-site Scripting vulnerability

  In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

  typo3/cms typo3/cms-core bootstrap org.webjars:bootstrap npm Packagist Maven NuGet RubyGems
  Jul 13, 2018
• Medium 6.1
  CVE-2018-14040 Public exploit

  Bootstrap vulnerable to Cross-Site Scripting (XSS)

  In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

  twitter-bootstrap3 bootstrap twitter-bootstrap3 twbs/bootstrap Debian Ubuntu npm Packagist Maven NuGet RubyGems
  Jul 13, 2018