Archive
July 2018
Vulnerabilities first published in this month (UTC), newest first.
2,170 results · Feed
-
Unscored —
The mintToken function of a smart contract implementation for BCaaS, an Ethereum token, has an integer overflow that al…
-
Unscored —
An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add an admin account via adm1n/admin_man…
-
Critical 9.8
Dolibarr SQL injection vulnerability in product/card.php
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter.
-
Critical 9.8
Dolibarr SQL injection vulnerability in product/card.php
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the country_id parameter.
-
Critical 9.8
Dolibarr SQL injection vulnerability in product/card.php
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the status_batch parameter.
-
Unscored —
The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.…
-
Critical 9.8
Dolibarr SQL injection vulnerability in product/card.php
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut_buy parameter.
-
Unscored —
An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add a user account via adm1n/admin_manag…
-
High 7.5
WeChat Pay Java SDK allows XXE
WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL.
-
Unscored —
Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG el…
-
Unscored —
An issue was discovered in Jirafeau before 3.4.1. The file "search by name" form is affected by one Cross-Site Scriptin…
-
Unscored —
The administration panel of Jirafeau before 3.4.1 is vulnerable to three CSRF attacks on search functionalities: search…
-
Unscored —
script.php in Jirafeau before 3.4.1 is affected by two stored Cross-Site Scripting (XSS) vulnerabilities. These are sto…
-
Unscored —
TCExam before 14.1.2 has XSS via an ff_ or xl_ field.
-
Unscored —
An issue has been found in libsndfile 1.0.28. There is a memory leak in psf_allocate in common.c, as demonstrated by sn…
-
Unscored —
admin/themes/default/items/tag-form.php in Omeka before 2.6.1 allows XSS by adding or editing a tag.
-
Unscored —
Fast C++ CSV Parser (aka fast-cpp-csv-parser) before 2018-07-06 has a heap-based buffer over-read in io::trim_chars in …
-
Unscored —
Google gperftools 2.7 has a memory leak in malloc_extension.cc, related to MallocExtension::Register and InitModule. NO…
-
Unscored —
TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes
TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerab…
-
Unscored —
TrackR Bravo MAC address can be exposed in close proximity and used to obtain the device ID
The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be …
-
Unscored —
TrackR Bravo is missing authentication for the cloud service and allows querying or sending of GPS data from unauthenticated users
Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which can be discovered as described in CVE-2016-6539. Updated apps, version 5.1.6 fo…
-
Unscored —
TrackR Bravo mobile application stores account passwords in cleartext
The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-…
-
Unscored —
Possible buffer overflow in msm_adsp_stream_callback_put due to lack of input validation of user-provided data that lea…
-
Unscored —CVE-2018-13410 Public exploit
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (inv…
-
Unscored —
In a firmware memory dump feature in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS …
-
Unscored —
In the cpuidle driver in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linu…
-
Unscored —
An integer overflow to buffer overflow vulnerability exists in the ADSPRPC heap manager in all Android releases(Android…
-
Unscored —CVE-2018-3608 Public exploit
A vulnerability in Trend Micro Maximum Security's (Consumer) 2018 (versions 12.0.1191 and below) User-Mode Hooking (UMH…
-
Unscored —
A race condition exists in a driver in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox O…
-
Unscored —
A pointer in an ADSPRPC command is not properly validated in all Android releases from CAF using the Linux kernel (Andr…
-
Unscored —
In __wlan_hdd_cfg80211_vendor_scan() in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox …
-
Unscored —
Possible buffer overflow in msm_adsp_stream_callback_put due to lack of input validation of user-provided data that lea…
-
Unscored —
In the audio debugfs in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD …
-
Unscored —
While padding or shrinking a nested wmi packet in all Android releases from CAF using the Linux kernel (Android for MSM…
-
Unscored —
While parsing over-the-air information elements in all Android releases from CAF using the Linux kernel (Android for MS…
-
Unscored —
While processing a debug log event from firmware in all Android releases from CAF using the Linux kernel (Android for M…
-
Unscored —
While processing a WMI_APFIND event in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox O…
-
Unscored —CVE-2018-5873 Public exploit
An issue was discovered in the __ns_get_path function in fs/nsfs.c in the Linux kernel before 4.11. Due to a race condi…
-
Unscored —
Due to a race condition in the MDSS MDP driver in all Android releases from CAF using the Linux kernel (Android for MSM…
-
Unscored —
Lack of copy_from_user and information leak in function "msm_ois_subdev_do_ioctl, file msm_ois.c can lead to a camera c…