Archive
August 2018
Vulnerabilities first published in this month (UTC), newest first.
1,015 results · Feed
-
Unscored —
Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application. The LG ID is…
-
Unscored —
Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents. The…
-
Unscored —CVE-2018-6622 Public exploit
An issue was discovered that affects all producers of BIOS firmware who make a certain realistic interpretation of an o…
-
High 8.8CVE-2018-14057 Public exploit
Pimcore CSRF Vulnerability
Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRF token only in the "Settings > Users / Roles" function.
-
Medium 6.5
Pimcore SQLi Vulnerability
Pimcore before 5.3.0 allows SQL Injection via the REST web service API.
-
Unscored —
An issue was discovered in Xen through 4.11.x. ARM never properly implemented grant table v2, either in the hypervisor …
-
Unscored —
An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1…
-
Unscored —
An issue was discovered in Xen through 4.11.x. The logic in oxenstored for handling writes depended on the order of eva…
-
Unscored —
An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virt…
-
Medium 4.3
IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 does not set the secure attribute on authorization toke…
-
Unscored —
An authenticated attacker can execute arbitrary code using command ejection in Eltex ESP-200 firmware version 1.2.0.
-
Unscored —
An authenticated attacker with low privileges can activate high privileged user and use it to expand attack surface in …
-
Unscored —
An authenticated attacker with low privileges can extract password hash information for all users in Eltex ESP-200 firm…
-
Unscored —
An attacker without authentication can login with default credentials for privileged users in Eltex ESP-200 firmware ve…
-
Unscored —
An authenticated attacker with low privileges can use insecure sudo configuration to expand attack surface in Eltex ESP…
-
Unscored —
A Buffer Overflow exploited through web interface by remote attacker can cause remote code execution in Kraftway 24F2XG…
-
Unscored —
Denial of service via crafting malicious link and sending it to a privileged user can cause Denial of Service in Kraftw…
-
Unscored —
An attacker with low privileges can cause denial of service in Kraftway 24F2XG Router firmware version 3.5.30.1118.
-
Unscored —
Router Default Credentials in Kraftway 24F2XG Router firmware version 3.5.30.1118 allow remote attackers to get privile…
-
Unscored —
Usage of SSLv2 and SSLv3 leads to transmitted data decryption in Kraftway 24F2XG Router firmware 3.5.30.1118.
-
Unscored —
A Buffer Overflow exploited through web interface by remote attacker can cause denial of service in Kraftway 24F2XG Rou…
-
Critical 9.8
Code Injection in cryo
A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization.
-
Critical 9.8
Command Injection in git-dummy-commit
A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.
-
Critical 9.8CVE-2018-3783 Public exploit
Privilege Escalation due to Blind NoSQL Injection in flintcms
A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset.
-
Unscored —
Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy l…
-
Unscored —
The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a…
-
High 8.3
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages …
-
Medium 5.9
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticat…
-
Unscored —
The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerabilit…
-
Unscored —
ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applica…
-
Unscored —
An issue was discovered in the LINE jp.naver.line application 8.8.1 for Android. The Passcode feature allows authentica…
-
Unscored —
An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The LAContext class for Biometric (TouchID…
-
Unscored —
An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The Passcode feature allows authentication…
-
Unscored —
admin/vqmods.app/vqmods.inc.php in LiteCart before 2.1.3 allows remote authenticated attackers to upload a malicious fi…
-
Unscored —
An issue found in Progress Telerik JustAssembly through 2018.1.323.2 and JustDecompile through 2018.2.605.0 makes it po…
-
Unscored —
libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a craft…
-
Unscored —
libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause …
-
Unscored —
libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-o…
-
High 8.6
IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, u…
-
Unscored —
The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlie…