Archive
August 2018
Vulnerabilities first published in this month (UTC), newest first.
1,015 results · Feed
-
Unscored —
Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authen…
-
Unscored —
Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authen…
-
Unscored —
Multiple SQL injection vulnerabilities in portal/add_edit_event_user.php in versions of OpenEMR before 5.0.1.4 allow a …
-
Unscored —
In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External E…
-
Unscored —
In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External …
-
Unscored —
A cross-site scripting (XSS) vulnerability was found in valeuraddons German Spelling Dictionary v1.3 (an Opera Browser …
-
Medium 5.3
An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. …
-
Unscored —
An issue was discovered in Edimax EW-7438RPn Mini v2 before version 1.26. There is XSS in an SSID field.
-
Unscored —
Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/par…
-
Unscored —
JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a…
-
Unscored —
Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain…
-
High 7.3
It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a direct…
-
Medium 5.0
The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privilege…
-
Low 3.7
IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages, EmailRelay) fails to check the S…
-
Unscored —
Sensitive information about the configuration of the IBM UrbanCode Deploy 6.1 through 6.9.6.0 server and database can b…
-
Medium 5.3
IBM UrbanCode Deploy 6.1 through 6.9.6.0 could allow a remote attacker to traverse directories on the system. An unauth…
-
Unscored —
A buffer overflow vulnerability in the web server of some Hikvision IP Cameras allows an attacker to send a specially c…
-
Unscored —CVE-2018-5924 EPSS 11%
A security vulnerability has been identified with certain HP Inkjet printers. A maliciously crafted file sent to an aff…
-
Unscored —
A security vulnerability has been identified with certain HP Inkjet printers. A maliciously crafted file sent to an aff…
-
Unscored —
Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 bui…
-
Unscored —
Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTM…
-
Medium 4.2
org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability
From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for aut…
-
Unscored —
Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being l…
-
Critical 10.0
Open Redirect in url-parse
Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.
-
Unscored —
Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credenti…
-
Unscored —
A vulnerability was discovered in the Java VM component of Oracle Database Server. Supported versions that are affected…
-
Critical —
active-support impersonates 'activesupport' gem
active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker could exploit this vulnerability to execute arbitrary code on the system.
-
Unscored —
Dell WMS versions 1.1 and prior are impacted by multiple unquoted service path vulnerabilities. Affected software insta…
-
Unscored —
Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance (IDPA) …
-
Unscored —CVE-2018-13341 Public exploit
Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for sp…
-
Unscored —CVE-2018-10630 EPSS 11%
For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped w…
-
Unscored —
NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The device allows access…
-
Unscored —
NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The device is vulnerable…
-
Unscored —
NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The directory of the dev…
-
Unscored —
NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. A cross-site request for…
-
Medium 4.4
Medtronic MyCareLink 24950 Patient Monitor Insufficient Verification of Data Authenticity
Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable cardiac device information can potentially upload…
-
Medium 5.2
Medtronic MyCareLink Patient Monitor Network Credential Weakness
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication.
-
Unscored —
PHP Scripts Mall hotel-booking-script 2.0.4 allows XSS via the First Name, Last Name, or Address field.
-
Unscored —
PHP Scripts Mall hotel-booking-script 2.0.4 allows remote attackers to cause a denial of service via crafted JavaScript…
-
Unscored —
The aoedisk_debugfs_show function in drivers/block/aoe/aoeblk.c in the Linux kernel through 4.16.4rc4 allows local user…