Archive
11 September 2018
Vulnerabilities first published on this day (UTC), newest first.
39 results · Feed
-
Unscored —
The Subsonic Music Streamer application 4.4 for Android has Improper Certificate Validation of the Subsonic server cert…
-
Low 3.9
RSA BSAFE SSL-J versions prior to 6.2.4 contain a Heap Inspection vulnerability that could allow an attacker with physi…
-
Medium 5.9
RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel …
-
Medium 4.0
Dell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions vulnerability. A remote authe…
-
Medium 5.9
RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also known…
-
Unscored —
Pivotal Cloud Foundry Elastic Runtime version 1.4.0 through 1.4.5, 1.5.0 through 1.5.11 and 1.6.0 through 1.6.11 is vul…
-
Unscored —
Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated atta…
-
Medium 4.6
A cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11. An attacker w…
-
Medium 4.2
Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Se…
-
Medium 6.5
Uncontrolled Resource Consumption in Undertow
It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.
-
Unscored —
The AirWatch Agent for iOS prior to 5.8.1 contains a data protection vulnerability whereby the files and keychain entri…
-
Unscored —
The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database. This v…
-
Unscored —
SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection. This …
-
Unscored —
Under certain conditions, Crystal Report using SAP Business One, versions 9.2 and 9.3, connection type allows an attack…
-
Unscored —
In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31. 7.40, 7.41, 7.50, does not su…
-
Unscored —
The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode …
-
Unscored —
SAP HANA (versions 1.0 and 2.0) Extended Application Services classic model OData parser does not sufficiently validate…
-
Unscored —
SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_SEP…
-
Unscored —
The Omni Commerce Connect API (OCC) of SAP Hybris Commerce, versions 6.*, is vulnerable to server-side request forgery …
-
Unscored —
SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_2) …
-
Unscored —
Under certain conditions SAP Adaptive Server Enterprise, version 16.0, allows some privileged users to access informati…
-
Unscored —
Missing authorization check in SAP HCM Fiori "People Profile" (GBX01 HR version 6.0) for an authenticated user which ma…
-
Unscored —
Users of an SAP Mobile Platform (version 3.0) Offline OData application, which uses Offline OData-supplied delta tokens…
-
Unscored —
SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulti…
-
High 7.6
Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames…
-
Medium 6.5
A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch wit…
-
High 7.0
A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrs…
-
Unscored —
It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform befo…
-
Unscored —
CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file becaus…
-
Medium 5.9
Smarty Path Traversal Vulnerability
Smarty before 3.1.33-dev-4 allows attackers to bypass the trusted_dir protection mechanism via a file:./../ substring in an include statement.
-
Medium 4.2
Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or con…
-
Medium 5.3
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker i…
-
Medium 4.3
A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqRepor…
-
High 8.0
A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it i…
-
Medium 5.3
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a r…
-
Medium 5.3
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker i…
-
Medium 5.9
An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a …
-
High 8.8
IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. By send…
-
Unscored —
In Bro through 2.5.5, there is a memory leak potentially leading to DoS in scripts/base/protocols/krb/main.bro in the K…