Skip to content
OpenAdvisories

Archive

13 November 2018

Vulnerabilities first published on this day (UTC), newest first.

← October 2018 2018 / November /13 December 2018 →
  1. 129
  2. 228
  3. 33
  4. 46
  5. 522
  6. 647
  7. 750
  8. 838
  9. 932
  10. 108
  11. 119
  12. 1243
  13. 1338
  14. 14157
  15. 1542
  16. 1639
  17. 1720
  18. 185
  19. 1910
  20. 2036
  21. 2115
  22. 2212
  23. 2313
  24. 241
  25. 253
  26. 2661
  27. 2796
  28. 2842
  29. 2944
  30. 3037
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.1
    CVE-2018-16471

    Rack vulnerable to Cross-site Scripting

    There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape …

    rack rack rack ruby-rack Debian Ubuntu RubyGems
  • Medium 5.4
    CVE-2018-14657

    Keycloak Improper Bruteforce Detection

    A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.

    Red Hat keycloak org.keycloak:keycloak-parent Maven
  • Medium 6.1
    CVE-2018-14658

    Keycloak Open Redirect

    A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack

    Red Hat keycloak org.keycloak:keycloak-core Maven
  • Medium 4.6
    CVE-2018-14655

    Keycloak vulnerable to cross-site scripting via the state parameter

    A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

    Red Hat keycloak org.keycloak:keycloak-parent Maven
  • Medium 4.3
    CVE-2018-1808

    IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input cont…

    IBM WebSphere Commerce
  • Medium 5.5
    CVE-2018-15452

    Cisco Advanced Malware Protection for Endpoints on Windows DLL Preloading Vulnerability

    A vulnerability in the DLL loading component of Cisco Advanced Malware Protection (AMP) for Endpoints on Windows could allow an authenticated, local attacker to disable system scanning services or take other actions to prevent detection of unauthorized intrus…

    Cisco Cisco AMP for Endpoints Network devices
  • Medium 6.8
    CVE-2018-18591

    MFSBGN03823 rev.1 - Micro Focus Service Manager, unauthorized disclosure of data

    A potential unauthorized disclosure of data vulnerability has been identified in Micro Focus Service Manager versions: 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51. The vulnerability could be exploited to release unauthorized disclosure of data.

    Micro Focus Micro Focus Service Manager