Archive
August 2018
Vulnerabilities first published in this month (UTC), newest first.
106 results · Clear filters · Feed
-
High 7.5
Flask is vulnerable to Denial of Service via incorrect encoding of JSON data
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provid…
-
High 7.5
Insecure temporary file handling
pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks.
-
High 7.5
PyCryptodome integer overflow vulnerability
PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes.
-
High 8.8CVE-2018-14057 Public exploit
Pimcore CSRF Vulnerability
Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRF token only in the "Settings > Users / Roles" function.
-
High 8.3
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages …
-
High 8.6
IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, u…
-
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8…
-
High 7.8CVE-2018-8406 Exploited · Ransomware
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles obj…
KEV Mar 28, 2022 -
High 7.5CVE-2018-8390 EPSS 15%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8353, …
-
High 7.8CVE-2018-8405 Exploited · Ransomware
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles obj…
KEV Mar 28, 2022 -
High 7.5CVE-2018-8371 EPSS 15%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer…
-
High 7.5CVE-2018-8372 EPSS 26%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is…
-
High 7.5CVE-2018-8381 EPSS 15%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
High 7.5CVE-2018-8266 EPSS 29%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
High 7.5CVE-2018-8359 EPSS 15%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8353, CVE-2018-8355, C…
-
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is…
-
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Mar 25, 2022 -
High 8.8
A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows…
KEV Mar 25, 2022 -
High 7.5CVE-2018-8380 EPSS 15%
ChakraCore remote code execution vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
High 7.5CVE-2018-8385 EPSS 15%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, ChakraCore, Internet Explorer 11, Microsoft…
-
High 7.3
Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow …
-
High 7.3
It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a direct…
-
High 7.1
It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check aut…
-
High 8.5
A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its inte…
-
High 8.1
Laravel Framework RCE Vulnerability
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and Pendi…
KEV Jan 16, 2024 -
High 7.5
TIBCO ActiveMatrix BusinessWorks 5.X XML eXternal Entity Vulnerability
The BusinessWorks engine component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks, TIBCO ActiveMatrix BusinessWorks for z/Linux, and TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric contains a vulnerability that may allow XML e…
-
High 8.6
Gogs and Gitea SSRF Vulnerability
An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.
-
High 8.0
Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange
Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public …
-
High 7.5
Symfony Directory Traversal
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read() methods of these classes use a …
-
High 8.5
Specially crafted commands sent through the PubNub service in Insteon Hub 2245-222 with firmware version 1012 can cause…
-
High 7.5
SEOmatic plugin for Craft CMS SSTI Vulnerability
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
-
High 8.5
An exploitable buffer overflow vulnerability exists in the PubNub message handler for the 'ad' channel of Insteon Hub r…
-
High 7.2
Symfony Host Header Injection
An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. When using HttpCache, the values of the X-Forwarded-Host headers are implic…
-
High 8.8
IBM Maximo Asset Management 7.6 through 7.6.3 installs with a default administrator account that a remote intruder coul…
-
High 8.7
An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. The firmw…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…