Archive
July 2018
Vulnerabilities first published in this month (UTC), newest first.
2,170 results · Feed
-
Unscored —
Improper Input Validation in Linux io-prefetch in Snapdragon Mobile and Snapdragon Wear, A SQL injection vulnerability …
-
Unscored —
Due to a race condition while processing the power stats debug file to read status, a double free condition can occur i…
-
Unscored —
In Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security …
-
Unscored —
While flashing meta image, a buffer over-read may potentially occur when the image size is smaller than the image heade…
-
Unscored —
While flashing a meta image, a buffer over-read can potentially occur when the number of images are out of the maximum …
-
Medium 6.3
The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pat…
-
Unscored —CVE-2018-11124 Public exploit
Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allow…
-
Medium 4.4
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a…
-
High 7.1
IBM FileNet Content Manager, IBM Content Foundation, and IBM Case Foundation Administration Console for Content Platfor…
-
Medium 5.4
IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to e…
-
Medium 5.9
IBM API Connect information disclosure
IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using …
-
Medium 6.1
IBM Planning Analytics 2.0.0 through 2.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to em…
-
Medium 5.4
IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This…
-
Medium 5.4
IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to e…
-
Unscored —CVE-2018-13110 Public exploit
All ADB broadband gateways / routers based on the Epicentro platform are affected by a privilege escalation vulnerabili…
-
Unscored —
An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel before 4.17.4 …
-
Unscored —CVE-2018-13108 Public exploit
All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerabili…
-
Unscored —CVE-2018-13405 Public exploit
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an…
-
Unscored —
All ADB broadband gateways / routers based on the Epicentro platform are affected by an authorization bypass vulnerabil…
-
Low 3.1
Multiple IBM Rational products could disclose sensitive information by an attacker that intercepts vulnerable requests.…
-
Medium 4.3
IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 could reveal sensitive information in HTTP 500 Internal Server Er…
-
Medium 5.4
IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject …
-
Low 3.7
An undisclosed vulnerability in Jazz common products exists with potential for information disclosure. IBM X-Force ID: …
-
Medium 4.4
IBM WebSphere MQ 7.5, 8.0, and 9.0 through 9.0.4 could allow a local user to obtain highly sensitive information via tr…
-
Medium 5.4
IBM Jazz based applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary …
-
Medium 5.4
IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject …
-
Medium 5.4
IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject …
-
Medium 4.3
IBM Jazz Foundation products could allow an authenticated user to obtain sensitive information from a stack trace that …
-
Medium 5.4
IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows…
-
Medium 4.8
The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to …
-
High 7.3
Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology SSL VPN Cl…
-
High 7.5
Mercurial Improper Input Validation vulnerability
The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.
-
High 7.5
Mercurial Improper Input Validation vulnerability
The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.
-
Critical 9.8
Mercurial mishandles integer addition and subtraction
mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.
-
Unscored —
Gleez CMS 1.2.0 has CSRF, as demonstrated by a /page/add request.
-
Medium 6.1
Angular Redactor XSS Vulnerability
Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035.
-
Unscored —
In Bitcoin Core before v0.13.0, a non-final alert is able to block the special "final alert" (which is supposed to over…
-
Unscored —
Bitcoin Core before v0.13.0 allows denial of service (memory exhaustion) triggered by the remote network alert system (…
-
Unscored —
DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account.
-
Unscored —
In CyberArk Endpoint Privilege Manager (formerly Viewfinity), Privilege Escalation is possible if the attacker has one …