Archive
July 2018
Vulnerabilities first published in this month (UTC), newest first.
220 results · Clear filters · Feed
-
Medium 6.5
A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowle…
-
Medium 6.5
A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not prop…
-
Medium 5.5
Improper Limitation of a Pathname to a Restricted Directory in WildFly
WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.
-
Medium 6.5CVE-2017-2666 Public exploit
Undertow-core vulnerable to HTTP Request Smuggling
It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data int…
-
Medium 6.5
It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks d…
-
Medium 6.5
It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when u…
-
Medium 5.9
An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperl…
-
Medium 4.2
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group…
-
Medium 4.8
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of s…
-
Medium 5.0
A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() f…
-
Medium 4.2
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry…
-
Medium 6.5
A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" …
-
Medium 5.5
It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuratio…
-
Medium 6.5
keycloak-core discloses system properties
It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the atta…
-
Medium 4.1
A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If a…
-
Medium 4.1
An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14…
-
Medium 6.5
An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of cl…
-
Medium 6.5
XML External Entity Reference in jbpmmigration
It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potential…
-
Medium 5.1
A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and s…
-
Medium 5.4
Improper Control of Generation of Code in Apache Kafka
In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.
-
Medium 5.3
An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connectio…
-
Medium 5.3
OpenStack Neutron Race Condition vulnerability
A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following…
-
Medium 6.8
Improper Authentication in Apache Kafka
In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations…
-
Medium 6.5
CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the r…
-
Medium 6.1
foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting …
-
Medium 5.9
It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the p…
-
Medium 6.1
libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024…
-
Medium 5.5
Improper Limitation of a Pathname to a Restricted Directory in SharpZipLib
SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
-
Medium 5.5CVE-2018-1002203 EPSS 11%
Arbitrary File Write via Archive Extraction in unzipper
unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
-
Medium 5.5
Improper Limitation of a Pathname to a Restricted Directory in zt-zip
zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
-
Medium 6.5
Improper Limitation of a Pathname to a Restricted Directory in Zip4j
zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
-
Medium 5.5
Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver
plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
-
Medium 5.5CVE-2018-1002205 EPSS 10%
DotNetZip Zip-Slip Vulnerability
DotNetZip.Semvered before 1.11.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
-
Medium 5.5
Arbitrary File Write via Archive Extraction in mholt/archiver
mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnera…
-
Medium 5.5
Directory Traversal in SharpCompress
SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
-
Medium 5.5CVE-2018-1002204 EPSS 13%
Arbitrary File Write in adm-zip
adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
-
Medium 5.5
Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a cr…
-
Medium 5.3CVE-2018-10906 Public exploit
In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is ac…
-
Medium 6.5
An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read…
-
Medium 6.1
Apache TomEE console vulnerable to Cross-site Scripting
The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not s…