Skip to content
OpenAdvisories

Archive

16 October 2018

Vulnerabilities first published on this day (UTC), newest first.

← September 2018 2018 / October /16 November 2018 →
  1. 151
  2. 278
  3. 340
  4. 429
  5. 5134
  6. 62
  7. 76
  8. 848
  9. 958
  10. 10110
  11. 1116
  12. 12114
  13. 13 
  14. 144
  15. 1533
  16. 1625
  17. 17262
  18. 1862
  19. 1942
  20. 202
  21. 214
  22. 2214
  23. 2369
  24. 2435
  25. 257
  26. 2637
  27. 2715
  28. 2840
  29. 2954
  30. 3040
  31. 3142
All Critical High Medium Low Exploited only Public exploit

25 results · Feed

  • Unscored —
    CVE-2018-18308 Public exploit

    In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (a…

  • Unscored —
    CVE-2018-11022

    kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allow…

  • Unscored —
    CVE-2018-11020

    kernel/omap/drivers/rpmsg/rpmsg_omx.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows atta…

  • Unscored —
    CVE-2018-11021

    kernel/omap/drivers/video/omap2/dsscomp/device.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 …

  • Unscored —
    CVE-2018-11019

    kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allow…

  • Unscored —
    CVE-2018-11024

    kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD (3rd) Fire OS 4.5.5.3 allo…

  • Unscored —
    CVE-2018-11025

    kernel/omap/drivers/mfd/twl6030-gpadc.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows at…

  • Unscored —
    CVE-2018-11023

    kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD (3rd) Fire OS 4.5.5.3 allo…

  • Unscored —
    CVE-2018-14772 Public exploit

    Pydio 4.2.1 through 8.2.1 has an authenticated remote code execution vulnerability in which an attacker with administra…

  • Unscored —
    CVE-2018-6974

    VMware ESXi (6.7 before ESXi670-201810101-SG, 6.5 before ESXi650-201808401-BG, and 6.0 before ESXi600-201808401-BG), Wo…

    VMware Workstation Fusion ESXi Virtualization
  • Medium —
    GHSA-cgpw-2gph-2r9g

    Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.App, and Microsoft.AspNetCore.Server.Kestrel.Core

    Microsoft is aware of a denial of service vulnerability in ASP.NET Core when a malformed request is terminated. An attacker who successfully exploited this vulnerability could cause a denial of service attack. The update addresses the vulnerability by correct…

    Microsoft.AspNetCore.All Microsoft.AspNetCore.App Microsoft.AspNetCore.Server.Kestrel.Core NuGet
  • Medium —
    GHSA-3m2r-q8x3-xmf7

    Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv

    Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where a specially crafted request can cause excess resource consumption in Kestrel.

    Microsoft.AspNetCore.All Microsoft.AspNetCore.Server.Kestrel.Core Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions NuGet
  • Medium 5.4
    CVE-2018-1777

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allow…

    IBM WebSphere Application Server
  • Critical 9.8
    CVE-2018-18389

    Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication

    Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an…

    org.neo4j:neo4j-enterprise Maven
  • High 7.5
    CVE-2018-18385

    Asciidoctor Infinite Loop vulnerability

    Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening…

    asciidoctor asciidoctor asciidoctor Debian Ubuntu RubyGems
  • Unscored —
    CVE-2018-18384

    Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compresse…

    unzip unzip unzip unzip Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2018-10839

    Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could le…

    The QEMU Project Qemu-kvm qemu qemu Virtualization Debian Ubuntu
  • Unscored —
    CVE-2018-13399

    The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escal…

    Atlassian Fisheye and Crucible
  • Unscored —
    CVE-2018-18381

    Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Typ…

  • Unscored —
    CVE-2018-18382

    Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can…

  • Unscored —
    CVE-2018-18376

    goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about curren…

  • Unscored —
    CVE-2018-18377

    goform/setReset on Orange AirBox Y858_FL_01.16_04 devices allows attackers to reset a router to factory settings, which…

  • Unscored —
    CVE-2018-18374

    XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.

  • Unscored —
    CVE-2018-18375

    goform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data (name, number, username, a…

  • Unscored —
    CVE-2018-18307

    A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. NOTE…