Archive
August 2018
Vulnerabilities first published in this month (UTC), newest first.
125 results · Clear filters · Feed
-
Medium 4.4
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Imprope…
-
Medium 6.5
RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.…
-
Medium 5.9
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x) contains a Covert Ti…
-
Medium 4.0
IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous u…
-
Medium 5.3
A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xpr…
-
Medium 5.3
An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than …
-
Medium 6.2
A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was be…
-
Medium 5.4
A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) p…
-
Medium 4.8
An Improper Check for Unusual or Exceptional Conditions vulnerability exists in Schneider Electric's Modicon M221 produ…
-
Medium 5.3
An exploitable integer underflow vulnerability exists in the ZigBee firmware update routine of the hubCore binary of th…
-
Medium 6.5
IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information discl…
-
Medium 5.3
Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existen…
-
Medium 5.1
A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in ce…
-
Medium 6.8
An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binary of the Samsung Sm…
-
Medium 6.5
An exploitable vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.2…
-
Medium 5.4CVE-2018-14059 Public exploit
Pimcore XSS Vulnerability
Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions.
-
Medium 6.1
phpMyAdmin Cross-site Scripting (XSS) in the import dialog
An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature.
-
Medium 5.9
IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by incor…
-
Medium 6.3
IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to SQL injection. A remote attacker could send specially-cr…
-
Medium 6.5
Privilege Escalation in fscrypt
The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linu…
-
Medium 4.3
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attackers With Overall/Read permission to access the connection log for any agent.
-
Medium 5.3
Deserialization of Untrusted Data in Jenkins
A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL.
-
Medium 6.5
Infinite Loop in Jenkins Core
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
-
Medium 5.4
Improper Authentication in Jenkins
A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled.
-
Medium 6.5
Incorrect Authorization in Jenkins
A improper authorization vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in UpdateCenter.java that allows attackers to cancel a Jenkins restart scheduled through the update center.
-
Medium 6.1
Cobbler Arbitrary File Read
A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installati…
-
Medium 5.2
A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An aut…
-
Medium 4.3
A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malic…
-
Medium 4.3
The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access contr…
-
Medium 5.2
Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that…
-
Medium 4.3
katello Improper Privilege Management vulnerability
A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the reposito…
-
Medium 5.4
It was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 ser…
-
Medium 6.5CVE-2018-1140 EPSS 11%
A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker…
-
Medium 5.4
A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1…
-
Medium 5.3
A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was fo…
-
Medium 5.9
It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote att…
-
Medium 5.9
It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote att…
-
Medium 5.4
IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to hijack the clicking action of the victim. By p…
-
Medium 4.3
lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is di…
-
Medium 5.9
Wemo Insight Smart Plug - Remote Code Execution vulnerability
Stack-based Buffer Overflow vulnerability in libUPnPHndlr.so in Belkin Wemo Insight Smart Plug allows remote attackers to bypass local security protection via a crafted HTTP post packet.