Archive
29 August 2018
Vulnerabilities first published on this day (UTC), newest first.
46 results · Feed
-
Unscored —
Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.
-
Unscored —CVE-2018-16134 Public exploit
Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI.
-
Critical 9.1
Cryptographically Weak Pseudo-Random Number Generator (PRNG) in akka-actor
Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS (both classic and Artery Remoting). Akka allows configuration of custom random number generators.…
-
Unscored —
The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to che…
-
Critical 9.8
An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all …
-
Critical 9.8
A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all re…
-
High 7.5
A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all re…
-
Medium 5.4
A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) p…
-
Medium 4.8
An Improper Check for Unusual or Exceptional Conditions vulnerability exists in Schneider Electric's Modicon M221 produ…
-
Unscored —
The Norton Identity Safe product prior to 5.3.0.976 may be susceptible to a privilege escalation issue via a hard coded…
-
Unscored —
An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (wh…
-
Unscored —
An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices. Any app co-…
-
Unscored —
An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices, allowing at…
-
Unscored —
The Alcatel A30 device with a build fingerprint of TCL/5046G/MICKEY6US:7.0/NRD90M/J63:user/release-keys contains a hidd…
-
Unscored —
qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishan…
-
Unscored —CVE-2018-15912 Public exploit
An issue was discovered in manjaro-update-system.sh in manjaro-system 20180716-1 on Manjaro Linux. A local attacker can…
-
Unscored —
CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php.
-
Unscored —
Technicolor (formerly RCA) TC8305C devices allow remote attackers to cause a denial of service (networking outage) via …
-
Unscored —
Various VIVOTEK FD8*, FD9*, FE9*, IB8*, IB9*, IP9*, IZ9*, MS9*, SD9*, and other devices before XXXXXX-VVTK-xx06a allow …
-
Unscored —
XML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier allows remote attackers to read arbitrary fi…
-
Unscored —
This module enables you to build eCommerce websites and applications with Drupal. The module doesn't sufficiently check…
-
Unscored —
ABB eSOMS version 6.0.2 may allow unauthorized access to the system when LDAP is set to allow anonymous authentication,…
-
Critical 9.8
Grafana Authentication Bypass
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
-
Unscored —
Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects v…
-
Unscored —CVE-2018-12824 EPSS 11%
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead …
-
Unscored —
Adobe Flash Player 30.0.0.134 and earlier have a security bypass vulnerability. Successful exploitation could lead to s…
-
Unscored —
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead …
-
Unscored —
Adobe Acrobat and Reader versions 2018.011.20055 and earlier, 2017.011.30096 and earlier, and 2015.006.30434 and earlie…
-
Unscored —
Adobe Photoshop CC 2018 before 19.1.6 and Photoshop CC 2017 before 18.1.6 have a memory corruption vulnerability. Succe…
-
Unscored —
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Succ…
-
Unscored —
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have an input validation bypass vulnerability. Successful…
-
Unscored —
Adobe Photoshop CC 2018 before 19.1.6 and Photoshop CC 2017 before 18.1.6 have a memory corruption vulnerability. Succe…
-
Unscored —
Adobe Flash Player 30.0.0.134 and earlier have a "use of a component with a known vulnerability" vulnerability. Success…
-
Unscored —
Adobe Acrobat and Reader versions 2018.011.20055 and earlier, 2017.011.30096 and earlier, and 2015.006.30434 and earlie…
-
Unscored —
Adobe Creative Cloud Desktop Application before 4.6.1 has an improper certificate validation vulnerability. Successful …
-
Unscored —
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead …
-
Unscored —
A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2…
-
Unscored —
When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. …
-
Unscored —CVE-2018-8004 Public exploit
There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apach…
-
Unscored —
Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to …