Archive
July 2018
Vulnerabilities first published in this month (UTC), newest first.
2,170 results · Feed
-
Medium 5.5
SB10244 - Network Security Management (NSM) - Abuse of Functionality vulnerability
Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management (NSM) 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via appliance web interface.
-
High 7.5CVE-2018-13864 Public exploit
Play Framework's Assets controller vulnerable to directory traversal
A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted…
-
Unscored —
samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple…
-
Unscored —
The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly lead…
-
Unscored —
TeamViewer through 13.1.1548 stores a password in Unicode format within TeamViewer.exe process memory between "[00 88] …
-
Unscored —
In HTSlib 1.8, a race condition in cram/cram_io.c might allow local users to overwrite arbitrary files via a symlink at…
-
Unscored —
An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account pass…
-
Unscored —
manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file exte…
-
High 7.0
pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS…
-
Unscored —CVE-2018-13832 Public exploit
Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) pl…
-
Unscored —
The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 allows re…
-
Medium 5.9
git-annex private data exfiltration to compromised remote
git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.
-
Medium 5.2
Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An a…
-
Unscored —
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.…
-
Medium 4.3
The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", f…
-
Medium 5.9
git-annex GPG decryption attack via compromised remote
git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data that wa…
-
Unscored —CVE-2018-14324 Public exploit
The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin…
-
Unscored —
A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attac…
-
Unscored —
A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, local attacker to acce…
-
Unscored —
A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthentica…
-
Unscored —
A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attac…
-
Unscored —
ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively sma…
-
Unscored —
A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11…
-
Unscored —
A vulnerability in the detection engine parsing of Security Socket Layer (SSL) protocol packets for Cisco Firepower Sys…
-
Unscored —
ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor fi…
-
Unscored —
A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attac…
-
Unscored —
A vulnerability in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms could …
-
Unscored —
Norton App Lock prior to v1.3.0.332 can be susceptible to a bypass exploit. In this type of circumstance, the exploit c…
-
Unscored —
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticat…
-
Unscored —
Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow auth…
-
Unscored —
Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow aut…
-
Unscored —
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier coul…
-
Unscored —
Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could all…
-
Unscored —
An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a conte…
-
Unscored —CVE-2018-11716 EPSS 14%
An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to a…
-
Unscored —
The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated remote code…
-
Unscored —
The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclo…
-
Unscored —
The Notes Client Single Logon feature in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3, and 9.0 on Windows allo…
-
Unscored —
X File Explorer (aka xfe) might allow local users to bypass intended access restrictions and gain access to arbitrary f…
-
Unscored —
The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5…