Skip to content
OpenAdvisories

Archive

9 October 2018

Vulnerabilities first published on this day (UTC), newest first.

← September 2018 2018 / October /9 November 2018 →
  1. 151
  2. 278
  3. 340
  4. 429
  5. 5134
  6. 62
  7. 76
  8. 848
  9. 958
  10. 10110
  11. 1116
  12. 12114
  13. 13 
  14. 144
  15. 1533
  16. 1625
  17. 17262
  18. 1862
  19. 1942
  20. 202
  21. 214
  22. 2214
  23. 2369
  24. 2435
  25. 257
  26. 2637
  27. 2715
  28. 2840
  29. 2954
  30. 3040
  31. 3142
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.5
    CVE-2018-11796

    Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack

    In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and …

    Apache Software Foundation Apache Tika tika org.apache.tika:tika-core Ubuntu Maven
  • High 7.5
    CVE-2018-17958

    Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.

    qemu qemu Debian Ubuntu
  • High 7.2
    CVE-2018-17856

    Joomla RCE Vulnerability

    An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access com_joomlaupdate and trigger code execution.

    joomla/framework Packagist
  • High 7.5
    CVE-2018-18074 Public exploit

    Insufficiently Protected Credentials in Requests

    The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

    python-pip requests requests requests Debian Ubuntu PyPI