Archive
September 2018
Vulnerabilities first published in this month (UTC), newest first.
1,170 results · Feed
-
High 7.0
A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a w…
-
Medium 5.3CVE-2018-14647 EPSS 11%
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it eas…
-
Unscored —
This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed …
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Internet Br…
-
Unscored —
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Notes Fixed in …
-
Unscored —
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Email Fixed in …
-
Unscored —
This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Samsung Emai…
-
Unscored —
This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy Apps …
-
Unscored —
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fix…
-
Unscored —
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fix…
-
Unscored —
The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.
-
Unscored —
The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.
-
High 8.3
tgstation-server cached user logins in legacy server
In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 (fixed in 3.2.5.0), active logins would be cached, allowing subsequent logins to succeed with any username or password.
-
Unscored —CVE-2018-17281 EPSS 52%
There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x thro…
-
Unscored —
Druide Antidote through 9.5.1 on Windows and Linux allows remote code execution through the update mechanism by leverag…
-
Unscored —
The random() function of the smart contract implementation for CryptoSaga, an Ethereum game, generates a random value w…
-
Unscored —
On Honeywell Mobile Computers (CT60 running Android OS 7.1, CN80 running Android OS 7.1, CT40 running Android OS 7.1, C…
-
Unscored —
Multiple SQL injection vulnerabilities in the login page in RXTEC RXAdmin UPDATE 06 / 2012 allow remote attackers to ex…
-
Unscored —
An issue was discovered in the HDF HDF5 1.10.3 library. There is a stack-based buffer overflow in the function H5S_exte…
-
Unscored —
A NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c in the HDF HDF5 through 1.10.3 library allows attack…
-
Unscored —
ReadCode() in decompress.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (invali…
-
Unscored —
A heap-based buffer over-read in H5O_attr_decode() in H5Oattr.c in the HDF HDF5 through 1.10.3 library allows attackers…
-
Unscored —
A heap-based buffer overflow in ReadGifImageDesc() in gifread.c in the HDF HDF5 through 1.10.3 library allows attackers…
-
Unscored —
A SIGFPE signal is raised in the function H5D__select_io() of H5Dselect.c in the HDF HDF5 through 1.10.3 library during…
-
High 7.5
True Key (TK) - DLL Search Order Hijacking vulnerability
DLL Search Order Hijacking vulnerability in Microsoft Windows Client in McAfee True Key (TK) before 5.1.165 allows local users to execute arbitrary code via specially crafted malware.
-
High 7.2
CMS Supervisor Information Disclosure
A vulnerability in the Supervisor component of Avaya Call Management System allows local administrative user to extract sensitive information from users connecting to a remote CMS host. Affected versions of CMS Supervisor include R17.0.x and R18.0.x.
-
Medium 5.9
True Key (TK) - Cross Site Scripting Exposure
Cross Site Scripting Exposure in McAfee True Key (TK) 4.0.0.0 and earlier allows local users to expose confidential data via a crafted web site.
-
Unscored —
Memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c in the HDF HDF5 through 1.10.3 library allows attac…
-
Unscored —
A SIGFPE signal is raised in the function apply_filters() of h5repack_filters.c in the HDF HDF5 through 1.10.3 library …
-
Unscored —
The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform …
-
Unscored —
The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to imperson…
-
Unscored —
An issue was discovered in springboot_authority through 2017-03-06. There is stored XSS via the admin/role/edit roleKey…
-
Unscored —
The SBIbuddy (aka com.sbi.erupee) application 1.41 and 1.42 for Android might allow an attacker to sniff private inform…
-
Unscored —
An issue was discovered in PublicCMS V4.0.180825. For an invalid login attempt, the response length is different depend…
-
Unscored —
The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to discover…
-
Unscored —
The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform …
-
Unscored —
An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A bu…
-
Unscored —
Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the …
-
Unscored —
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. …
-
Unscored —
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. …