Skip to content
OpenAdvisories

Archive

20 August 2018

Vulnerabilities first published on this day (UTC), newest first.

← July 2018 2018 / August /20 September 2018 →
  1. 179
  2. 240
  3. 350
  4. 41
  5. 521
  6. 681
  7. 712
  8. 824
  9. 914
  10. 1028
  11. 11 
  12. 123
  13. 1336
  14. 1434
  15. 15109
  16. 1615
  17. 1729
  18. 188
  19. 19 
  20. 2067
  21. 2128
  22. 2225
  23. 2346
  24. 2434
  25. 2527
  26. 268
  27. 2727
  28. 2854
  29. 2946
  30. 3056
  31. 3113
All Critical High Medium Low Exploited only Public exploit

67 results · Feed

  • Unscored —
    CVE-2018-12579

    An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Prof…

  • Medium 5.3
    CVE-2018-14020

    Paymorrow Improper Input Validation vulnerability

    An issue was discovered in the Paymorrow module 1.0.0 before 1.0.2 and 2.0.0 before 2.0.1 for OXID eShop. An attacker can bypass delivery-address change detection if the payment module doesn't use eShop's checkout procedure properly. To do so, the attacker mu…

    oxid-esales/paymorrow-module Packagist
  • Unscored —
    CVE-2018-14023

    Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage.

  • Unscored —
    CVE-2015-5160

    libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which al…

    libvirt libvirt Debian Ubuntu
  • Critical 9.8
    CVE-2015-5243

    phpWhois arbitrary code execution via a crafted whois record

    phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.

    ivankristianto/phpwhois serluck/phpwhois truckersmp/phpwhois phpwhois/phpwhois Packagist
  • Medium 5.4
    CVE-2018-1394

    Multiple IBM Rational products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra…

    IBM Rational Collaborative Lifecycle Management Rational Quality Manager Rational DOORS Next Generation
  • Medium 5.9
    CVE-2018-1517

    A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflic…

    IBM SDK, Java Technology Edition
  • High 7.4
    CVE-2018-1656

    The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 ,…

    IBM SDK, Java Technology Edition
  • Unscored —
    CVE-2016-7048

    The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote a…

  • Unscored —
    CVE-2017-16748

    An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework…

    ICS-CERT Niagara AX Framework and Niagara 4 Framework
  • Unscored —
    CVE-2017-16744 Public exploit

    A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prio…

    ICS-CERT Niagara AX Framework and Niagara 4 Framework
  • Medium 5.4
    CVE-2017-1753

    Multiple IBM Rational products are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, wh…

    IBM Rational Collaborative Lifecycle Management Rational Quality Manager Rational DOORS Next Generation
  • Unscored —
    CVE-2018-1000219

    OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'scan' parameter in line #41 of int…

  • Medium 6.1
    CVE-2018-1000225

    Cobbler XSS Vulnerability

    Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege esc…

    cobbler cobbler Ubuntu PyPI
  • Unscored —
    CVE-2018-1000221

    pkgconf version 1.5.0 to 1.5.2 contains a Buffer Overflow vulnerability in dequote() that can result in dequote() funct…

  • Unscored —
    CVE-2018-1000215

    Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON library that can result in Denial…

    cjson libglvnd Debian Azure Linux
  • Unscored —
    CVE-2018-1000216

    Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can res…

    libglvnd Azure Linux
  • Unscored —
    CVE-2018-1000223

    soundtouch version up to and including 2.0.0 contains a Buffer Overflow vulnerability in SoundStretch/WavFile.cpp:WavIn…

    soundtouch soundtouch Debian Ubuntu
  • Unscored —
    CVE-2018-1000217

    Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can …

    libglvnd Azure Linux
  • Unscored —
    CVE-2018-1000222

    Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Rem…

    libgd2 libgd2 gd Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-1000224 Public exploit

    Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned compariso…

  • Critical 9.8
    CVE-2018-1000226 Scanner template EPSS 13%

    Cobbler Improper Validation of Security Tokens

    Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in P…

    cobbler cobbler Ubuntu PyPI
  • Unscored —
    CVE-2018-1000218

    OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'file' parameter in line #43 of int…

  • Unscored —
    CVE-2018-14077

    Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to backup the device configuration via a dire…

  • Unscored —
    CVE-2018-14078

    Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to reset the admin password via the /ConfigWi…

  • Unscored —
    CVE-2018-14079

    Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to obtain sensitive information via /Status/S…

  • Unscored —
    CVE-2018-1000648

    LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write vulnerability in Patient file l…

  • Unscored —
    CVE-2018-1000634

    The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains an Improper Access Control vulnerability i…

  • Unscored —
    CVE-2018-1000652

    JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML Parser that can result i…

    jabref jabref Debian Ubuntu
  • Unscored —
    CVE-2018-1000637

    zutils version prior to version 1.8-pre2 contains a Buffer Overflow vulnerability in zcat that can result in Potential …

    zutils zutils Debian Ubuntu
  • Medium 6.1
    CVE-2018-1000640

    OpenCart-Overclocked Cross-site Scripting Vulnerability

    OpenCart-Overclocked version <=1.11.1 contains a Cross Site Scripting (XSS) vulnerability in User input entered unsanitised within JS function in the template that can result in Unauthorised actions and access to data, stealing session information, denial of …

    villagedefrance/opencart-overclocked Packagist
  • Unscored —
    CVE-2018-1000655

    Jsish version 2.4.65 contains a CWE-476: NULL Pointer Dereference vulnerability in Function jsi_ValueCopyMove from jsiV…

  • Unscored —
    CVE-2018-1000642

    FlightAirMap version <=v1.0-beta.21 contains a Cross Site Scripting (XSS) vulnerability in GET variable used within reg…

  • Unscored —
    CVE-2018-1000633

    The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log Files vul…

  • Unscored —
    CVE-2018-1000635

    The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains a Information Exposure Through Sent Data v…

  • High 7.5
    CVE-2018-1000632

    Dom4j contains a XML Injection vulnerability

    dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable vi…

    dom4j:dom4j dom4j dom4j org.dom4j:dom4j Debian Ubuntu Maven
  • Unscored —
    CVE-2018-1000646

    LibreHealthIO LH-EHR version REL-2.0.0 contains an Authenticated Unrestricted File Write vulnerability in Import templa…

  • Unscored —
    CVE-2018-1000636

    JerryScript version Tested on commit f86d7459d195c8ba58479d1861b0cc726c8b3793. Analysing history it seems that the issu…

    iotjs Ubuntu
  • Unscored —
    CVE-2018-1000645

    LibreHealthIO lh-ehr version <REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of t…

  • Unscored —
    CVE-2018-1000657

    Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stab…

    rustc Debian