Archive
August 2018
Vulnerabilities first published in this month (UTC), newest first.
1,015 results · Feed
-
Unscored —
ASUS HG100 devices allow denial of service via an IPv4 packet flood.
-
Unscored —
Cross-site scripting (XSS) vulnerability in intervalCheck.jsp in Coremail XT 3.0 allows remote attackers to inject arbi…
-
Unscored —
Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI.
-
Unscored —CVE-2018-14028 EPSS 15%
In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files …
-
Medium 6.1
Cloudtoken Insufficiently Protects Credentials
Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subnet to gain temporary AWS credentials for the users' roles.
-
Unscored —
AppArmor cupsd Sandbox Bypass Due to Use of Hard Links
The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. A local attacker could possibly use this issue to escape confinement. This flaw affects versions prior to 2.2.7-1ubuntu2.1 in Ubuntu 18.04 LTS, prior to 2.2.4-7ubuntu3.…
-
Unscored —
The lxc-user-nic component of LXC allows unprivileged users to open arbitrary files
lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used t…
-
Unscored —
PHP Scripts Mall advanced-real-estate-script 4.0.9 allows remote attackers to cause a denial of service (page structure…
-
Unscored —
PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php.
-
Unscored —
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has CSRF via client/auditor/updprofile.php.
-
Unscored —
PHP Scripts Mall advanced-real-estate-script has XSS via the Name field of a profile.
-
Unscored —
PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 allows remote attackers to cause a denial of service (page…
-
Unscored —
The transferProxy and approveProxy functions of a smart contract implementation for SmartMesh (SMT), an Ethereum ERC20 …
-
Unscored —
Information leakage vulnerability in NetIQ eDirectory before 9.1.1 HF1 due to shared memory usage.
-
Unscored —
Unvalidated redirect vulnerability in in NetIQ eDirectory before 9.1.1 HF1.
-
High 7.1
It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check aut…
-
Unscored —
Stack-based buffer overflow in the Cisco Thor decoder before commit 18de8f9f0762c3a542b1122589edb8af859d9813 allows loc…
-
Critical 9.8CVE-2018-10931 EPSS 68%
Cobbler has Exposed Dangerous Method or Function
It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the da…
-
High 8.5
A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its inte…
-
Unscored —
An Information Exposure issue was discovered in Hitachi Command Suite 8.5.3. A remote attacker may be able to exploit a…
-
Unscored —
PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field, a related issue to …
-
High 8.1
Laravel Framework RCE Vulnerability
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and Pendi…
KEV Jan 16, 2024 -
Unscored —
PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields.
-
Unscored —CVE-2018-15181 Public exploit
JioFi 4G Hotspot M2S devices allow attackers to cause a denial of service (secure configuration outage) via an XSS payl…
-
Unscored —
PHP Scripts Mall Myperfectresume / JobHero / Resume Clone Script 2.0.6 has Stored XSS via the Full Name and Title field…
-
Medium 6.5
It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploa…
-
Unscored —
One of the data structures that holds TCP segments in all versions of FreeBSD prior to 11.2-RELEASE-p1, 11.1-RELEASE-p1…
-
Medium 5.3
Improper Authorization in aedes
Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.
-
Unscored —
An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of…
-
Unscored —
This module enables you to add or overwrite PHP configuration on a drupal website. The module doesn't sufficiently allo…
-
Unscored —
An integer overflow in the unprotected distributeToken function of a smart contract implementation for EETHER (EETHER),…
-
Unscored —
CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation…
-
High 7.5
TIBCO ActiveMatrix BusinessWorks 5.X XML eXternal Entity Vulnerability
The BusinessWorks engine component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks, TIBCO ActiveMatrix BusinessWorks for z/Linux, and TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric contains a vulnerability that may allow XML e…
-
Unscored —
An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/add_page allows a CSRF attack to a…
-
Unscored —
ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (h…
-
Unscored —
An issue was discovered in Juunan06 eCommerce through 2018-08-05. There is a CSRF vulnerability in ee/eBoutique/app/tem…
-
Unscored —
An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a us…
-
Unscored —
An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html tha…
-
Unscored —
AuraCMS 2.3 allows XSS via a Bukutamu -> AddGuestbook action.
-
Unscored —
A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via…