Archive
18 October 2018
Vulnerabilities first published on this day (UTC), newest first.
62 results · Feed
-
Medium 5.5
Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Dat…
-
High 7.3
Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains Improper File Permission Vulnerabilities. The a…
-
High 7.5
DoS Attack via Range Requests
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or start…
-
Critical 9.6
Privilege Escalation in spring-security-oauth2
Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker c…
-
Low 3.4
Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains an Information Exposure vulnerability. The log …
-
Unscored —
An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del user_id[] parameter.
-
Unscored —
In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafe…
-
Unscored —
An issue was discovered in PHPSHE 1.7. admin.php?mod=db&act=del allows remote attackers to delete arbitrary files via d…
-
Unscored —
In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[] parameter.
-
Unscored —
A stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a a…
-
Unscored —CVE-2015-4633 Public exploit
Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and…
-
Unscored —CVE-2015-4630 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x…
-
Unscored —CVE-2015-4631 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before…
-
Unscored —
Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.0…
-
Unscored —
The get_count function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31, allows remote attackers to…
-
Unscored —
An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. Stack Exhaustion occurs…
-
Medium 6.5
libpg_query memory leak
An issue was discovered in libpg_query 10-1.0.2. There is a memory leak in pg_query_raw_parse in pg_query_parse.c, which might lead to a denial of service.
-
Unscored —
A heap-based buffer over-read exists in libopencad 0.2.0 in the ReadCHAR function in lib/dwg/io.cpp, resulting in an ap…
-
Unscored —
A heap-based buffer over-read exists in libopencad 0.2.0 in the ReadMCHAR function in lib/dwg/io.cpp, resulting in an a…
-
Medium 6.1
LibreNMS XSS Vulnerability
Persistent Cross-Site Scripting (XSS) issues in LibreNMS before 1.44 allow remote attackers to inject arbitrary web script or HTML via the dashboard_name parameter in the /ajax_form.php resource, related to html/includes/forms/add-dashboard.inc.php, html/incl…
-
Critical 9.8
IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the syst…
-
Medium 6.2
IBM InfoSphere Information Server 11.7 is affected by a weak password encryption vulnerability that could allow a local…
-
Unscored —
Memory safety bugs present in Firefox 61 and Firefox ESR 60.1. Some of these bugs showed evidence of memory corruption …
-
Unscored —
Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text …
-
Unscored —
Service workers can use redirection to avoid the tainting of cross-origin resources in some instances, allowing a malic…
-
Unscored —
When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can b…
-
Unscored —
A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dy…
-
Unscored —
WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. This allowed a mal…
-
Unscored —
A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cach…
-
Unscored —
If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these password…
-
Unscored —
Memory safety bugs present in Firefox 61. Some of these bugs showed evidence of memory corruption and we presume that w…
-
Unscored —
Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the messag…
-
Unscored —
dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forw…
-
Unscored —
A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in …
-
Unscored —
A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system…
-
Unscored —
A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by fo…
-
Unscored —
A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown…
-
Unscored —
A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resultin…
-
Unscored —
A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and wri…
-
Unscored —
A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that …