Archive
August 2018
Vulnerabilities first published in this month (UTC), newest first.
106 results · Clear filters · Feed
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server imple…
-
High 8.5
An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP …
-
High 7.5
An input validation flaw exists in ttembed. With a crafted input file, an attacker may be able to trigger a denial of s…
-
High 7.5CVE-2018-1336 EPSS 20%
In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to…
-
High 7.5CVE-2018-10920 Public exploit
Improper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison …
-
High 8.8CVE-2018-3924 EPSS 44%
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader versio…
-
High 8.0
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1…
-
High 8.8
Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library versio…
-
High 7.5CVE-2018-8034 EPSS 21%
The host name verification missing in Apache Tomcat
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
-
High 8.8
IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary co…
-
High 8.8
A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remot…
-
High 7.8
A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too smal…
-
High 8.8
A memory corruption vulnerability exists in the ANI-parsing functionality of Computerinsel Photoline 20.54. A specially…
-
High 8.8
A memory corruption vulnerability exists in the PCX-parsing functionality of Computerinsel Photoline 20.54. A specially…
-
High 8.8
A memory corruption vulnerability exists in the PSD-parsing functionality of Computerinsel Photoline 20.54. A specially…
-
High 7.2
It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects …
-
High 8.8
Exposure of Sensitive Information in Jenkins Kubernetes Plugin
An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.
-
High 7.4
Jenkins Inedo BuildMaster Plugin globally and unconditionally disabled SSL/TLS certificate validation
A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMasterApi.java that allows attackers to impersonate any service that Jenkins connects to.
-
High 7.4
Jenkins Inedo ProGet Plugin globally and unconditionally disabled SSL/TLS certificate validation
A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfiguration.java that allows attackers to impersonate any service that Jenkins connects to.
-
High 8.8
Jenkins Accurev Plugin CSRF vulnerability and missing permission checks
An exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.
-
High 7.4
Jenkins TraceTronic ECU-TEST Plugin Man in the middle vulnerability
A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java that allows attackers to impersonate any service that Jenkins connects to.