Archive
13 August 2018
Vulnerabilities first published on this day (UTC), newest first.
36 results · Feed
-
Unscored —
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has multiple stack-based buffer overflow vulnerabil…
-
Unscored —
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has two out-of-bounds read vulnerabilities could ca…
-
Medium 4.8
Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Cleartext Transmission of Sensitive Information
Communications between Medtronic MiniMed MMT pumps and wireless accessories are transmitted in cleartext. A sufficiently skilled attacker could capture these transmissions and extract sensitive information, such as device serial numbers.
-
Medium 5.3
Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replay
Medtronic MiniMed MMT devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote c…
-
Unscored —
VMware Horizon 6 (6.x.x before 6.2.7), Horizon 7 (7.x.x before 7.5.1), and Horizon Client (4.x.x and prior before 4.8.1…
-
Unscored —
Weak hashing algorithm in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows unauthenti…
-
Unscored —
Insecure configuration storage in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows re…
-
Unscored —
Sensitive Information Disclosure in Zipato Zipabox Smart Home Controller allows remote attacker get sensitive informati…
-
Unscored —
A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS …
-
Unscored —
A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored X…
-
Unscored —
Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authen…
-
Unscored —
SQL injection vulnerability in interface/de_identification_forms/find_drug_popup.php in versions of OpenEMR before 5.0.…
-
Unscored —
Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote…
-
Unscored —
Multiple SQL injection vulnerabilities in portal/find_appt_popup_user.php in versions of OpenEMR before 5.0.1.4 allow a…
-
Unscored —
Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authen…
-
Unscored —
Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authen…
-
Unscored —
Multiple SQL injection vulnerabilities in portal/add_edit_event_user.php in versions of OpenEMR before 5.0.1.4 allow a …
-
Unscored —
In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External E…
-
Unscored —
In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External …
-
Unscored —
A cross-site scripting (XSS) vulnerability was found in valeuraddons German Spelling Dictionary v1.3 (an Opera Browser …
-
Medium 5.3
An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. …
-
Unscored —
An issue was discovered in Edimax EW-7438RPn Mini v2 before version 1.26. There is XSS in an SSID field.
-
Unscored —
Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/par…
-
Unscored —
JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a…
-
Unscored —
Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain…
-
High 7.3
It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a direct…
-
Medium 5.0
The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privilege…
-
Low 3.7
IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages, EmailRelay) fails to check the S…
-
Unscored —
Sensitive information about the configuration of the IBM UrbanCode Deploy 6.1 through 6.9.6.0 server and database can b…
-
Medium 5.3
IBM UrbanCode Deploy 6.1 through 6.9.6.0 could allow a remote attacker to traverse directories on the system. An unauth…
-
Unscored —
A buffer overflow vulnerability in the web server of some Hikvision IP Cameras allows an attacker to send a specially c…
-
Unscored —CVE-2018-5924 EPSS 11%
A security vulnerability has been identified with certain HP Inkjet printers. A maliciously crafted file sent to an aff…
-
Unscored —
A security vulnerability has been identified with certain HP Inkjet printers. A maliciously crafted file sent to an aff…
-
Unscored —
Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 bui…
-
Unscored —
Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTM…
-
Medium 4.2
org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability
From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for aut…