Skip to content
OpenAdvisories

Archive

13 November 2018

Vulnerabilities first published on this day (UTC), newest first.

← October 2018 2018 / November /13 December 2018 →
  1. 129
  2. 228
  3. 33
  4. 46
  5. 522
  6. 647
  7. 750
  8. 838
  9. 932
  10. 108
  11. 119
  12. 1243
  13. 1338
  14. 14157
  15. 1542
  16. 1639
  17. 1720
  18. 185
  19. 1910
  20. 2036
  21. 2115
  22. 2212
  23. 2313
  24. 241
  25. 253
  26. 2661
  27. 2796
  28. 2842
  29. 2944
  30. 3037
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.5
    CVE-2018-16470

    Rack vulnerable to Denial of Service

    There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.

    rack rack rack RubyGems
  • High 8.8
    CVE-2018-8009

    Path Traversal in Hadoop

    Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.

    Apache Software Foundation Apache Hadoop org.apache.hadoop:hadoop-main Maven
  • High 7.1
    CVE-2018-12416

    TIBCO DataSynapse GridServer Manager Component Vulnerable to Cross-Site Request Forgery

    The GridServer Broker and GridServer Director components of TIBCO Software Inc.'s TIBCO DataSynapse GridServer Manager contain vulnerabilities which may allow an unauthenticated user to perform cross-site request forgery (CSRF). Affected releases are TIBCO So…

    TIBCO Software TIBCO DataSynapse GridServer Manager
  • High 8.0
    CVE-2018-16850

    postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER …

    The PostgreSQL Project postgresql postgresql15 postgresql-10 Ubuntu Alpine
  • High 8.8
    CVE-2018-1792

    IBM WebSphere MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, 9.0.1 through 9.0.5, and 9.1.0.0 could allow a loca…

    IBM MQ
  • High 7.4
    CVE-2018-17187

    Improper Certificate Validation in proton-j

    The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not v…

    Apache Software Foundation Apache Qpid Proton-J qpid-proton qpid-proton Debian Ubuntu Maven
  • High 8.1
    CVE-2018-15795

    CredHub Service Broker uses guessable client secret

    Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA client. A remote malicious user may guess the client secret and obtain or modify credentials for users of the CredHub S…

    Pivotal Cloud Foundry CredHub Service Broker org.springframework.credhub:spring-credhub-core Maven
  • High 7.5
    CVE-2018-19246 Public exploit EPSS 22%

    LFI in PHP-Proxy 5.1.0

    PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access to their web server) is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 app_key value from the default …

    athlon1600/php-proxy Packagist