Archive
July 2018
Vulnerabilities first published in this month (UTC), newest first.
2,170 results · Feed
-
Unscored —
The mintToken function of a smart contract implementation for AssetToken, an Ethereum token, has an integer overflow th…
-
Unscored —
The sell function of a smart contract implementation for MoneyTree (TREE), an Ethereum token, has an integer overflow i…
-
Unscored —
The sell function of a smart contract implementation for DateMe (DMX) (Contract Name: ProgressiveToken), an Ethereum to…
-
Unscored —
The mintToken function of a smart contract implementation for Super Carbon Coin (SCC), an Ethereum token, has an intege…
-
High 7.5CVE-2018-12018 Public exploit
Go Ethereum LES protocol implementation vulnerable to Denial of Service
The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack b…
-
Unscored —
The transfer and transferFrom functions of a smart contract implementation for Bittelux (BTX), an Ethereum token, have …
-
Unscored —
The transfer and transferFrom functions of a smart contract implementation for ChuCunLingAIGO (CCLAG), an Ethereum toke…
-
Unscored —
The mintToken function of a smart contract implementation for JavaSwapTest (JST), an Ethereum token, has an integer ove…
-
Unscored —
The mintToken, buy, and sell functions of a smart contract implementation for LEF, an Ethereum token, have an integer o…
-
Unscored —
A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to cause a denial …
-
Unscored —
The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen.
-
Unscored —
Golden Frog VyprVPN before 2018-06-21 has a vulnerability associated with the installation process on Windows.
-
Unscored —CVE-2018-13134 Public exploit
TP-Link Archer C1200 1.13 Build 2018/01/24 rel.52299 EU devices have XSS via the PATH_INFO to the /webpages/data URI.
-
Unscored —
GVToken Genesis Vision (GVT) is a smart contract running on Ethereum. The mint function has an integer overflow that al…
-
Unscored —
ATLANT (ATL) is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted toke…
-
Unscored —
SP8DE Token (SPX) is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted…
-
Unscored —
SP8DE PreSale Token (DSPX) is a smart contract running on Ethereum. The mint function has an integer overflow that allo…
-
Unscored —
SpadePreSale is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted toke…
-
Unscored —
Bitotal (TFUND) is a smart contract running on Ethereum. The mintTokens function has an integer overflow that allows mi…
-
Unscored —
The transfer and transferFrom functions of a smart contract implementation for Pandora (PDX), an Ethereum token, have a…
-
Unscored —
MoxyOnePresale is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted to…
-
Unscored —
Etherty Token (ETY) is a smart contract running on Ethereum. The mint function has an integer overflow that allows mint…
-
Unscored —
Spadeico is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens t…
-
Unscored —
onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f parameter…
-
Unscored —
onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files via the Delete File(s) …
-
Unscored —
RealOne Player 2.0 Build 6.0.11.872 allows remote attackers to cause a denial of service (array out-of-bounds access an…
-
Unscored —
The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScr…
-
Critical 9.8
Prototype Pollution in async merge-object
The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing…
-
High 8.8
SQL Injection in query-mysql
Node.js third-party module query-mysql versions 0.0.0, 0.0.1, and 0.0.2 are vulnerable to an SQL injection vulnerability due to lack of user input sanitization. This may allow an attacker to run arbitrary SQL queries when fetching data from database.
-
Medium 6.1
Cross-Site Scripting in public
The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious JavaScript.
-
Critical 9.8
Improper Input Validation in Deap
The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing propertie…
-
Critical 9.8
Prototype Pollution in merge-recursive
The utilities function in all versions <= 0.3.0 of the merge-recursive node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existi…
-
Medium 6.1
Cross-Site Scripting in glance
There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5. File name, which contains malicious HTML (eg. embedded iframe element or javascript: pseudo-protocol handler in <a> element) allows to execute JavaScript code against any user wh…
-
Critical 9.8
Prototype Pollution in merge-options
The utilities function in all versions <= 1.0.0 of the merge-options node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing…
-
Critical 9.8
Prototype Pollution in deep-extend
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing p…
-
Unscored —
The PAN-OS web interface administration page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier, PAN-OS 8.0.10 and…
-
Unscored —
The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.8 and earl…
-
Unscored —
The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earl…
-
Unscored —
The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-O…
-
Unscored —
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password cha…