Archive
September 2018
Vulnerabilities first published in this month (UTC), newest first.
1,170 results · Feed
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of che…
-
Medium 5.9
Moderate severity vulnerability that affects org.apache.tika:tika-core
In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while proce…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of len…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of len…
-
High 7.5CVE-2018-11761 Public exploit
High severity vulnerability that affects org.apache.tika:tika-core
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while proce…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while proce…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while reloc…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, userspace c…
-
Medium 5.5
Comparison errorr in org.apache.tika:tika-core
In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a race cond…
-
Unscored —CVE-2018-17182 Public exploit
An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles…
-
Unscored —CVE-2018-17144 Public exploit
Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16…
-
Medium 6.1
McAfee Application Control (MAC) - Whitelist bypass using a hard drive solidified by MACC
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external syste…
-
Medium 5.6
Endpoint Security for Linux Threat Prevention (ENSLTP) privilege escalation vulnerability
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged …
-
Medium 4.4
McAfee Application Control and Change Control (MACC) - password management security feature bypass (SFB) leading to an authentication bypass
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
-
Unscored —
The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such as the QBee Cam appli…
-
Unscored —
admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......…
-
High 8.8
Matrix Synapse Improper Signature Validation
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
-
Unscored —
admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./...…
-
Unscored —
Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability vi…
-
High 7.5
DSA-2018-147: Dell EMC Isilon OneFS and IsilonSD Edge Remote Process Crash Vulnerability
Dell EMC Isilon OneFS versions 7.1.1.x, 7.2.1.x, 8.0.0.x, 8.0.1.x, 8.1.0.x and 8.1.x prior to 8.1.2 and Dell EMC IsilonSD Edge versions 8.0.0.x, 8.0.1.x, 8.1.0.x and 8.1.x prior to 8.1.2 contain a remote process crash vulnerability. An unauthenticated remote …
-
Medium 6.8
Garden-runC prevents deletion of some app environments
Cloud Foundry Garden-runC release, versions prior to 1.16.1, prevents deletion of some app environments based on file attributes. A remote authenticated malicious user may create and delete apps with crafted file attributes to cause a denial of service for ne…
-
Unscored —
The onlyOwner modifier of a smart contract implementation for Coinlancer (CL), an Ethereum ERC20 token, has a potential…
-
Unscored —
The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, genera…
-
High 7.5
Smarty Path Traversal Vulnerability
Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security re…
-
Unscored —
Accusoft PrizmDoc version 13.3 and earlier contains a Stored Cross-Site Scripting issue through a crafted PDF file.
-
Unscored —
An issue was discovered in CIRCONTROL Open Charge Point Protocol (OCPP) before 1.5.0, as used in CirCarLife, PowerStudi…
-
Unscored —CVE-2018-16671 Scanner template
An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is system software information disclosure due to lac…
-
Unscored —
An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authenticati…
-
Unscored —CVE-2018-16668 Scanner template
An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the …
-
Unscored —CVE-2017-6913 Public exploit
Cross-site scripting (XSS) vulnerability in the Open-Xchange webmail before 7.6.3-rev28 allows remote attackers to inje…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while proce…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, WLAN handle…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when flashi…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of len…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Venus HW se…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, buffer over…
-
Unscored —
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while proce…