Archive
8 November 2018
Vulnerabilities first published on this day (UTC), newest first.
38 results · Feed
-
Unscored —
An issue was discovered in Telexy QPath 5.4.462. A low privileged authenticated user supplying a specially crafted seri…
-
Medium 5.4
Cisco Prime Service Catalog Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to…
-
Medium 6.5
Cisco Prime Collaboration Assurance File Overwrite Vulnerability
A vulnerability in the web-based UI of Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to overwrite files on the file system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabi…
-
Unscored —
keepalived 2.0.8 used mode 0666 when creating new temporary files upon a call to PrintData or PrintStats, potentially l…
-
Unscored —
keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData o…
-
Unscored —
keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly un…
-
Unscored —
keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintDat…
-
Unscored —
A Vulnerability in the firmwaredownload command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1…
-
Unscored —
A Vulnerability in the help command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.…
-
Unscored —
A Vulnerability in the supportsave command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1…
-
Medium 6.5
Cisco Integrated Management Controller Supervisor SQL Injection Vulnerability
A vulnerability in the web framework code of Cisco Integrated Management Controller (IMC) Supervisor could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation of user-supplied inp…
-
Medium 4.3
Cisco Video Surveillance Media Server Denial of Service Vulnerability
A vulnerability in the web-based management interface of Cisco Video Surveillance Media Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the web-based management interface of an affected system. The vulnerability is…
-
Medium 5.3
Cisco Registered Envelope Service Information Disclosure Vulnerability
A vulnerability in the user management functions of Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to discover sensitive user information. The attacker could use this information to conduct additional reconnaissance attacks.…
-
Medium 6.3
Cisco Energy Management Suite Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulner…
-
Medium 5.3
Cisco Meeting Server Information Disclosure Vulnerability
A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper protections on data that is returned from user meeting requests when the Guest access via ID …
-
Medium 6.3
Cisco Energy Management Suite XML External Entity Vulnerability
A vulnerability in the web-based user interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper han…
-
Unscored —
An issue was discovered in MinDoc through v1.0.2. It allows attackers to gain privileges by uploading an image file wit…
-
Medium 5.8
Cisco Firepower Detection Engine TCP Intrusion Prevention System Rule Bypass Vulnerability
A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured Intrusion Prevention System (IPS) rule that inspects certain types of TCP traffic. The vulnerability is due to in…
-
Critical 9.8CVE-2018-15381 EPSS 87%
Cisco Unity Express Arbitrary Command Execution Vulnerability
A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied c…
-
Critical 9.8
Cisco Stealthwatch Management Console Authentication Bypass Vulnerability
A vulnerability in the Stealthwatch Management Console (SMC) of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected system. The vuln…
-
Medium 4.8
Cisco Content Security Management Appliance (SMA) Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Content Security Management Appliance (SMA) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management inter…
-
Critical 9.8
Cisco Small Business Switches Privileged Access Vulnerability
A vulnerability in the Cisco Small Business Switches software could allow an unauthenticated, remote attacker to bypass the user authentication mechanism of an affected device. The vulnerability exists because under specific circumstances, the affected softwa…
-
Medium 5.5CVE-2018-15437 Public exploit
Cisco Immunet and Cisco AMP for Endpoints System Scan Denial of Service Vulnerability
A vulnerability in the system scanning component of Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints running on Microsoft Windows could allow a local attacker to disable the scanning functionality of the product. This could allow execut…
-
Unscored —
Cisco Meraki Local Status Page Privilege Escalation Vulnerability
A vulnerability in the local status page functionality of the Cisco Meraki MR, MS, MX, Z1, and Z3 product lines could allow an authenticated, remote attacker to modify device configuration files. The vulnerability occurs when handling requests to the local st…
-
High 8.1
Improper Authentication in hive:hive-exec
In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use.
-
Medium 4.3
Moderate severity vulnerability that affects org.apache.hive:hive-jdbc
In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics.
-
Unscored —
A vulnerability in the web management interface of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d coul…
-
Unscored —
A vulnerability in the Brocade Webtools firmware update section of Brocade Fabric OS before 8.2.1, 8.1.2f, 8.0.2f, 7.4.…
-
Unscored —
A Vulnerability in the secryptocfg command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1…
-
Unscored —
A vulnerability in Secure Shell implementation of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could…
-
Unscored —
A vulnerability in the secryptocfg export command of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d co…
-
Unscored —
The skin-management feature in tianti 2.3 allows remote authenticated users to bypass intended permission restrictions …
-
Unscored —
LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access violation and application …
-
Unscored —
In BageCMS 3.1.3, upload/index.php has a CSRF vulnerability that can be used to upload arbitrary files and get server p…
-
Unscored —
tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin…
-
Unscored —
The Google Cardboard application 1.8 for Android and 1.2 for iOS sends potentially private cleartext information to the…
-
Unscored —
In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of servic…
-
Unscored —
In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp (called from psdimage.cpp in the PSD image reader) may suffer from…