Archive
August 2018
Vulnerabilities first published in this month (UTC), newest first.
1,015 results · Feed
-
Unscored —
LibreHealthIO LH-EHR version REL-2.0.0 contains an Authenticated Unrestricted File Write vulnerability in Import templa…
-
Unscored —
JerryScript version Tested on commit f86d7459d195c8ba58479d1861b0cc726c8b3793. Analysing history it seems that the issu…
-
Unscored —
LibreHealthIO lh-ehr version <REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of t…
-
Unscored —
Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stab…
-
Unscored —
LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Deletion vulnerability in Import temp…
-
Unscored —
LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write in letter.php (2) vulnerability…
-
Unscored —
LatexDraw version <=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing functionality that can result…
-
Critical 10.0
Eclipse RDF4j vulnerable to XML External Entity
Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This atta…
-
Unscored —
Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can result in disclosure of…
-
High 7.5
Flask is vulnerable to Denial of Service via incorrect encoding of JSON data
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provid…
-
Unscored —
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach …
-
Unscored —
zzcms version 8.3 and earlier contains a SQL Injection vulnerability in zt/top.php line 5 that can result in could be a…
-
Unscored —
YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered par…
-
Unscored —CVE-2018-1000638 Public exploit
MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={p…
-
Unscored —
LibreHealthIO lh-ehr version REL-2.0.0 contains a SQL Injection vulnerability in Show Groups Popup SQL query functions …
-
Unscored —
The Symantec Encryption Management Server (SEMS) product, prior to version 3.4.2 MP1, may be susceptible to a denial of…
-
High 7.5
Insecure temporary file handling
pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks.
-
Unscored —
arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier f…
-
Unscored —
An issue was discovered in Reprise License Manager (RLM) through 12.2BL2. Attackers can use the web interface to read a…
-
Unscored —
An issue was discovered in the license editor in Reprise License Manager (RLM) through 12.2BL2. It is a cross-site scri…
-
Unscored —
The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not alwa…
-
Unscored —
An issue was discovered in daveismyname simple-cms through 2014-03-11. admin/addpage.php does not require authenticatio…
-
Unscored —
tp5cms through 2017-05-25 has CSRF via admin.php/category/delete.html.
-
Unscored —
CMSUno before 1.5.3 has XSS via the title field.
-
Unscored —
my little forum 2.4.12 allows CSRF for deletion of users.
-
Unscored —
tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter.
-
Unscored —
In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter.
-
Unscored —
An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete an…
-
Unscored —
fileshare.cmd on Telus Actiontec T2200H T2200H-31.128L.03 devices allows OS Command Injection via shell metacharacters …
-
Unscored —
The editor in Xiuno BBS 4.0.4 allows stored XSS.
-
High 7.5
PyCryptodome integer overflow vulnerability
PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes.
-
Unscored —
In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker can send a cra…
-
Critical 9.8
dojox vulnerable to unescaped string injection
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
-
Unscored —
A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes …
-
Unscored —
/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url par…
-
Unscored —
A vulnerability in the permission and encryption implementation of Zemana Anti-Logger 1.9.3.527 and prior (fixed in 1.9…
-
Unscored —
The unpack implementation in Swoole version 4.0.4 lacks correct size checks in the deserialization process. An attacker…
-
Unscored —
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP requ…
-
Unscored —
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a speciall…
-
Unscored —
Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents. The LG I…