Archive
August 2018
Vulnerabilities first published in this month (UTC), newest first.
1,015 results · Feed
-
Low 3.1
IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD RES…
-
Medium 4.0
IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous u…
-
Low 3.3
A vulnerability has been identified in IBM Cloud Orchestrator 2.3, 2.3.0.1, 2.4, and 2.4.0.1 that could allow an attack…
-
Unscored —
The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/a…
-
Unscored —
An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below…
-
Unscored —
A hardcoded passphrase, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensi…
-
Unscored —
An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below…
-
Unscored —
A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to con…
-
Unscored —
Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP…
-
Unscored —
A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensi…
-
Unscored —
Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and …
-
Unscored —
Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, al…
-
Unscored —
Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows att…
-
High 7.5
High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12
The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.
-
Unscored —
waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing d…
-
High 8.1CVE-2018-10936 Public exploit
Moderate severity vulnerability that affects org.postgresql:pgjdbc-aggregate
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker coul…
-
Medium 5.3
A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xpr…
-
Medium 5.3
An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than …
-
High 7.5
Mosca REDoS Vulnerability
This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.1.0.…
-
Medium 6.2
A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was be…
-
Unscored —
ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar in \application\User\Controller\ProfileContro…
-
Unscored —
PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/login_control.php via the _back parameter to the ok_f …
-
Unscored —
Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different cu…
-
Unscored —
A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beg…
-
Unscored —
In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth AVDTP dissector could crash. This was a…
-
Unscored —
In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth Attribute Protocol dissector could cras…
-
Unscored —
In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Radiotap dissector could crash. This was addresse…
-
Unscored —
Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.
-
Unscored —CVE-2018-16134 Public exploit
Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI.
-
Critical 9.1
Cryptographically Weak Pseudo-Random Number Generator (PRNG) in akka-actor
Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS (both classic and Artery Remoting). Akka allows configuration of custom random number generators.…
-
Unscored —
The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to che…
-
Critical 9.8
An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all …
-
Critical 9.8
A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all re…
-
High 7.5
A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all re…
-
Medium 5.4
A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) p…
-
Medium 4.8
An Improper Check for Unusual or Exceptional Conditions vulnerability exists in Schneider Electric's Modicon M221 produ…
-
Unscored —
The Norton Identity Safe product prior to 5.3.0.976 may be susceptible to a privilege escalation issue via a hard coded…
-
Unscored —
An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (wh…