October 2018

5 results · Clear filters · Feed

• Critical 9.8
  CVE-2017-18349 Public exploit Scanner template EPSS 39%

  Improper Input Validation in alilibaba:fastjson

  parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST…

  com.alibaba:fastjson ro.pippo:pippo-fastjson Maven
  Oct 23, 2018
• Critical 10.0
  CVE-2018-4013 Public exploit

  An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server …

  Live Networks LIVE555 Media Server liblivemedia liblivemedia Debian Ubuntu
  Oct 19, 2018
• Critical 9.1
  CVE-2018-10933 Public exploit EPSS 92%

  A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client cou…

  [UNKNOWN] libssh libssh libssh Debian Ubuntu Alpine
  Oct 17, 2018
• Critical 9.8
  CVE-2018-9206 Public exploit Scanner template EPSS 97%

  Unrestricted Upload of File with Dangerous Type in blueimp-file-upload

  Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

  Blueimp Blueimp jQuery-File-Upload blueimp-file-upload libjs-jquery-file-upload Debian Ubuntu npm
  Oct 11, 2018
• Critical 9.8
  CVE-2018-12542 Public exploit

  Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location

  In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\' (forward slashes) sequences that can resolve to a location th…

  The Eclipse Foundation Eclipse Vert.x io.vertx:vertx-web Maven
  Oct 10, 2018