Archive
9 October 2018
Vulnerabilities first published on this day (UTC), newest first.
58 results · Feed
-
Unscored —
qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account.
-
Unscored —
The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is…
-
Unscored —
There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4.
-
Unscored —
Mediamanager in REDAXO before 5.6.4 has XSS.
-
Unscored —
Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attackers to cause a denial of service attack remotely via a spec…
-
Unscored —
Code injection in the /ui/login form Language parameter in Epicentro E_7.3.2+ allows attackers to execute JavaScript co…
-
Unscored —
Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attackers to execute code remotely via a specially crafted GET re…
-
High 7.5
Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and …
-
Unscored —
qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - Use…
-
Unscored —
Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.
-
High 7.5
Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.
-
Unscored —
An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can app…
-
Unscored —
An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access lev…
-
Unscored —
An issue was discovered in Joomla! before 3.8.13. com_installer actions do not have sufficient CSRF hardening in the ba…
-
High 7.2
Joomla RCE Vulnerability
An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access com_joomlaupdate and trigger code execution.
-
Unscored —
An issue was discovered in Joomla! before 3.8.13. Inadequate checks in com_contact could allow mail submission in disab…
-
Unscored —
An out-of-bounds vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application process…
-
Unscored —
An XXE vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application processes special…
-
Unscored —
An issue was discovered in libgig 4.1.0. There is an operator new[] failure (due to a big pSampleLoops heap request) in…
-
Unscored —
The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inj…
-
Unscored —
An issue was discovered in libgig 4.1.0. There is a heap-based buffer over-read in DLS::Region::GetSample() in DLS.cpp.
-
Unscored —
OpenJPEG 2.3.0 has a NULL pointer dereference for "red" in the imagetopnm function of jp2/convert.c
-
Unscored —
An issue was discovered in GoPro gpmf-parser before 1.2.1. There is a divide-by-zero error in GPMF_ScaledData in GPMF_p…
-
Unscored —
An issue was discovered in libgig 4.1.0. There is an FPE (divide-by-zero error) in DLS::Sample::Sample in DLS.cpp.
-
Unscored —
EmpireCMS v7.5 has an arbitrary file upload vulnerability in the LoadInMod function in e/class/moddofun.php, exploitabl…
-
Unscored —
An issue was discovered in libgig 4.1.0. There is a heap-based buffer over-read in RIFF::List::GetListTypeString in RIF…
-
Unscored —
An issue was discovered in libgig 4.1.0. There is a NULL pointer dereference in the function DLS::File::GetFirstSample(…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote…
-
Unscored —
An issue was discovered in libgig 4.1.0. There is operator new[] failure (due to a big pWavePoolTable heap request) in …
-
Unscored —
VMware ESXi (6.7, 6.5, 6.0), Workstation (15.x and 14.x) and Fusion (11.x and 10.x) contain a denial-of-service vulnera…
-
Unscored —
An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid paramete…
-
Unscored —
An issue was discovered in DuomiCMS 3.0. Remote PHP code execution is possible via the search.php searchword parameter …
-
Unscored —
XSS exists in Waimai Super Cms 20150505 via the fname parameter to the admin.php?m=Food&a=addsave or admin.php?m=Food&a…
-
Critical 9.8CVE-2018-14649 EPSS 12%
It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug sh…
-
Unscored —
WikidForum 2.20 has SQL Injection via the rpc.php parent_post_id or num_records parameter, or the index.php?action=sear…
-
High 7.5CVE-2018-18074 Public exploit
Insufficiently Protected Credentials in Requests
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
-
Unscored —
Navigate CMS has Stored XSS via the navigate.php Title field in an edit action.
-
Unscored —
An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The FingerprintManager class for …
-
Unscored —
An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The Passcode feature allows authe…