Archive
9 November 2018
Vulnerabilities first published on this day (UTC), newest first.
32 results · Feed
-
Unscored —
An issue was discovered in S-CMS v1.5. There is an XSS vulnerability in search.php via the keyword parameter.
-
High 8.1
Signing Key Extraction in Bits Service Release
Cloud Foundry Bits Service Release, versions prior to 2.14.0, uses an insecure hashing algorithm to sign URLs. A remote malicious user may obtain a signed URL and extract the signing key, allowing them complete read and write access to the the Bits Service st…
-
Unscored —
Sennheiser HeadSetup 7.3.4903 places Certification Authority (CA) certificates into the Trusted Root CA store of the lo…
-
Unscored —CVE-2018-19138 Public exploit
WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.html URI.
-
Unscored —
An issue has been found in JasPer 2.0.14. There is a memory leak in jas_malloc.c when called from jpc_unk_getparms in j…
-
Unscored —
DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter.
-
Unscored —CVE-2018-19137 Scanner template
DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter.
-
Medium 5.3
An issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote attacker sending a DNS quer…
-
Medium 5.4
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra…
-
Unscored —
A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cac…
-
Unscored —CVE-2018-19131 Public exploit
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.
-
Unscored —
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file …
-
Unscored —
In Libav 12.3, there is an invalid memory access in vc1_decode_frame in libavcodec/vc1dec.c that allows attackers to ca…
-
Unscored —
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 on Windows allows remote attackers to write to arbitrary imag…
-
Unscored —
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory.
-
Unscored —
In Libav 12.3, a NULL pointer dereference (RIP points to zero) issue in ff_mpa_synth_filter_float in libavcodec/mpegaud…
-
Unscored —
An issue has been found in libIEC61850 v1.3. It is a SEGV in Ethernet_receivePacket in ethernet_bsd.c.
-
Unscored —
In Libav 12.3, there is a heap-based buffer over-read in decode_frame in libavcodec/lcldec.c that allows an attacker to…
-
Unscored —
Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.
-
Medium 5.3
Flarum Core Leaks PII
In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address.
-
Unscored —
An issue has been found in libIEC61850 v1.3. It is a NULL pointer dereference in Ethernet_sendPacket in ethernet_bsd.c.
-
High 7.8
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local db2 ins…
-
Low 3.6
IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verificat…
-
Medium 5.3
IBM WebSphere MQ 8.0 through 9.1 is vulnerable to a error with MQTT topic string publishing that can cause a denial of …
-
High 7.4
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability th…
-
Medium 4.8
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow a user to bypass FGAC control and ga…
-
High 8.9
IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the developer portal and analy…
-
High 8.4
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared librar…
-
Medium 6.2
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local unprivi…
-
High 8.4
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to…
-
Medium 4.0
IBM Campaign 9.1.0, 9.1.2, 10.0, and 10.1 could allow an authenticated user with access to the local network to bypass …
-
Medium 4.3
IBM Marketing Operations 9.1.0, 9.1.2, and 10.1 could allow a remote attacker to obtain sensitive information. An attac…