Archive
July 2018
Vulnerabilities first published in this month (UTC), newest first.
2,170 results · Feed
-
Medium 6.8
When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for th…
-
Medium 4.5
An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the appli…
-
Low 3.3
A memory allocation vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the appl…
-
High —
Path Traversal in superstatic
Affected of `superstatic` are vulnerable to path traversal when used on Windows. Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize `\\` to `/` in paths on all platforms (a kn…
-
Medium 4.3
It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying …
-
High 8.4
A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project (SCM rep…
-
Medium 5.8
The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. …
-
High 7.2
ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Onl…
-
Medium 4.1
The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacke…
-
Medium 6.5
A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowle…
-
Low 2.6
Undertow Request Smuggling vulnerability
It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.
-
High 7.5
Moderate severity vulnerability that affects io.undertow:undertow-core
It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.
-
High 7.7
It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to aut…
-
High 7.5
An issue has been found in the parsing of authoritative answers in PowerDNS Recursor before 4.0.8, leading to a NULL po…
-
Medium 6.5
A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not prop…
-
Medium 5.5
Improper Limitation of a Pathname to a Restricted Directory in WildFly
WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.
-
Low 2.3
In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an applic…
-
Medium 6.5CVE-2017-2666 Public exploit
Undertow-core vulnerable to HTTP Request Smuggling
It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data int…
-
High 7.0
Drive Encryption (MDE) - Authentication Bypass vulnerability
Authentication Bypass vulnerability in TPM autoboot in McAfee Drive Encryption (MDE) 7.1.0 and above allows physically proximate attackers to bypass local security protection via specific set of circumstances.
-
Medium 6.5
It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks d…
-
Medium 6.5
It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when u…
-
Medium 5.9
An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperl…
-
High 8.7
It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE fl…
-
High 7.4
A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max…
-
Unscored —
An issue was discovered in the Linux kernel through 4.17.10. There is a use-after-free in try_merge_free_space() when m…
-
Unscored —
An issue was discovered in the Linux kernel through 4.17.10. There is a buffer overflow in truncate_inline_inode() in f…
-
Unscored —
An issue was discovered in the Linux kernel through 4.17.10. There is out-of-bounds access in write_extent_buffer() whe…
-
Unscored —
An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference in fscrypt_do_page_cry…
-
Unscored —
An issue was discovered in the Linux kernel through 4.17.10. There is an out-of-bounds access in __remove_dirty_segment…
-
Unscored —
An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic in hfsplus_l…
-
Unscored —
An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in io_ctl_map_page…
-
Unscored —
An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in btrfs_root_node…
-
Unscored —
An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in __del_reloc_roo…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.2. A Denial of Service can occur …
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x befo…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x befo…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x befo…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x befo…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x befo…
-
Unscored —
Thomson Reuters UltraTax CS 2017 on Windows, in a client/server configuration, transfers customer records and bank acco…