Skip to content
OpenAdvisories

Archive

September 2018

Vulnerabilities first published in this month (UTC), newest first.

← August 2018 2018 / September October 2018 →
  1. 120
  2. 228
  3. 331
  4. 452
  5. 554
  6. 651
  7. 765
  8. 87
  9. 97
  10. 1047
  11. 1139
  12. 1269
  13. 13104
  14. 1431
  15. 159
  16. 1626
  17. 1738
  18. 1878
  19. 1957
  20. 2043
  21. 2163
  22. 226
  23. 2316
  24. 2427
  25. 2554
  26. 2663
  27. 2715
  28. 2862
  29. 292
  30. 306
All Critical High Medium Low Exploited only Public exploit

104 results · Clear filters · Feed

  • Medium 6.2
    CVE-2017-1679

    IBM OpenPages GRC Platform 7.2, 7.3, 7.4, and 8.0 could allow an attacker to obtain sensitive information from error lo…

    IBM OpenPages GRC Platform
  • Medium 5.3
    CVE-2018-14625

    A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from w…

    [UNKNOWN] kernel: linux-raspi2 linux-hwe Debian Ubuntu
  • Medium 4.3
    CVE-2018-16704

    Gleez CMS Vulnerability Allows Forced Browsing to Profile Page of Other Users

    An issue was discovered in Gleez CMS v1.2.0. Because of an Insecure Direct Object Reference vulnerability, it is possible for attackers (logged in users) to view profile page of other users, as demonstrated by navigating to user/3 on demo.gleezcms.org.

    gleez/cms Packagist
  • Medium 5.3
    CVE-2018-1757

    IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive informa…

    IBM Security Identity Governance and Intelligence
  • Medium 5.4
    CVE-2017-1115

    IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, wh…

    IBM Campaign
  • Medium 5.4
    CVE-2017-1114

    IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra…

    IBM Campaign
  • Medium 6.2
    CVE-2016-9040

    An exploitable denial of service exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnera…

    Joyent SmartOS
  • Medium 6.1
    CVE-2018-1000665

    Improper Neutralization of Input During Web Page Generation in Dojo Dojo Objective Harness

    Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/_base/i18nExhaustive.js in the DOH that can result in V…

    dojo dojo org.dojotoolkit:dojo Debian Ubuntu Maven
  • Medium 6.1
    CVE-2018-16459

    Cross-Site Scripting in exceljs

    An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser.

    https://github.com/guyonroche exceljs exceljs npm
  • Medium 5.4
    CVE-2018-16551

    Stored XSS in LavaLite 5.5

    LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.

    lavalite/cms Packagist
  • Medium 5.3
    CVE-2016-1000232

    ReDoS via long string of semicolons in tough-cookie

    NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability …

    tough-cookie npm
  • Medium 6.1
    CVE-2018-16516

    Flask-Admin Cross-site Scripting vulnerability

    helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.

    flask-admin PyPI
  • Medium 6.5
    CVE-2018-10930

    A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this fla…

    Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu
  • Medium 5.3
    CVE-2018-10924

    It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use …

    Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu
  • Medium 6.5
    CVE-2018-10911

    A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attack…

    Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu
  • Medium 5.5
    CVE-2018-10914

    It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash wh…

    Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu
  • Medium 5.3
    CVE-2018-14627

    The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is require…

    [UNKNOWN] JBoss/WildFly
  • Medium 6.1
    CVE-2018-16406

    Moderate severity vulnerability that affects mayan-edms

    An issue was discovered in Mayan EDMS before 3.0.2. The Cabinets app has XSS via a crafted cabinet label.

    mayan-edms PyPI
  • Medium 6.1
    CVE-2018-16407

    Moderate severity vulnerability that affects mayan-edms

    An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled.

    mayan-edms PyPI
  • Medium 6.1
    CVE-2018-16405

    mayan-edms Cross-site Scripting vulnerability

    An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS.

    mayan-edms mayan-edms-ng PyPI
  • Medium 6.1
    CVE-2018-16347

    Gleez CMS Vulnerable to Cross-site Scripting in media/imagecache/resize

    An issue was discovered in Gleez CMS v1.2.0. There is XSS via media/imagecache/resize.

    gleez/cms Packagist
  • Medium 5.4
    CVE-2018-16342

    Showdoc XSS Vulnerability

    ShowDoc v1.8.0 has XSS via a new page.

    showdoc/showdoc Packagist
  • Medium 6.1
    CVE-2018-16330

    Pandao editor.md vulnerable to XSS in IMG attributes

    Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.

    editor.md npm
  • Medium 4.8
    CVE-2018-16327

    Subrion Cross-site Scripting (XSS)

    There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.

    intelliants/subrion Packagist