Archive
21 September 2018
Vulnerabilities first published on this day (UTC), newest first.
63 results · Feed
-
High 7.5
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of a database field in video-core's HT…
-
High 7.5
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core H…
-
High 7.5
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core H…
-
High 7.5
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core H…
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung S…
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung S…
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung S…
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung S…
-
Unscored —
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability in…
-
High 8.4
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to…
-
High 8.4
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 tool db2licm is affected by buff…
-
Medium 5.9
Moderate severity vulnerability that affects org.apache.mesos:mesos
Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT imp…
-
Critical 9.8
smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.
-
High 7.5
A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read ac…
-
Unscored —
An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether th…
-
Unscored —
The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's …
-
Unscored —
An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes it…
-
Unscored —
Stored XSS exists in CuppaCMS through 2018-09-03 via an administrator/#/component/table_manager/view/cu_menus section n…
-
Unscored —
Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search …
-
High 7.5CVE-2018-17297 Public exploit
Unzip function in ZipUtil.java in Hutool allows remote attackers to overwrite arbitrary files via directory traversal
The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.
-
Unscored —
Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /#Email/view saved draft message.
-
Unscored —
An issue was discovered in WAVM before 2018-09-16. The loadModule function in Include/Inline/CLI.h lacks checking of th…
-
Unscored —
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as d…