Archive
19 September 2018
Vulnerabilities first published on this day (UTC), newest first.
57 results · Feed
-
Unscored —CVE-2018-17229 Public exploit
Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overf…
-
Unscored —
Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer over…
-
Unscored —
Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and applic…
-
Unscored —
nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call.
-
Unscored —
A directory traversal vulnerability in the Connect Service of the BlackBerry Enterprise Mobility Server (BEMS) 2.8.17.2…
-
Unscored —
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could…
-
Unscored —
A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) p…
-
High 8.8
Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such a…
-
Unscored —
X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with mana…
-
Unscored —
In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key an…
-
Unscored —
In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on n…
-
Unscored —
In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of gra…
-
Medium 6.1
Elasticsearch subject to cross site scripting
X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could a…
-
Unscored —
Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered…
-
High 8.8
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD C…
-
High 8.8
An exploitable buffer overflow vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camer…
-
Critical 9.8
A missing error check exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application f…
-
Unscored —
Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access…
-
Unscored —
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6. The decode_bundle function inside lib/ofp-actions.c …
-
Unscored —
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in l…
-
Unscored —
An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php an…
-
Unscored —
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c…
-
High 8.8
An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Cam…
-
High 8.8
An exploitable buffer overflow vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camer…
-
High 8.1
An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running a…
-
High 7.5
An exploitable buffer overflow vulnerability exists in the UPnP implementation used by the Foscam C1 Indoor HD Camera r…
-
Unscored —
XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to creat…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote att…
-
Unscored —
NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over us…
-
Unscored —CVE-2018-1149 EPSS 15%
cgi_system in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP reques…
-
Medium 6.5
IBM GPFS (IBM Spectrum Scale 5.0.1.0 and 5.0.1.1) allows a local, unprivileged user to cause a kernel panic on a node r…
-
Unscored —
Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers …
-
Unscored —
The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which…
-
Unscored —
The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to an authentication bypass exploit, which is…
-
Unscored —
WECON PLC Editor version 1.3.3U may allow an attacker to execute code under the current process when processing project…
-
High 7.5
IBM Tivoli Monitoring 6.2.3 through 6.2.3.5 and 6.3.0 through 6.3.0.7 are vulnerable to both TEPS user privilege escala…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper le…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while proce…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, possibility…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, asynchronou…