Archive
5 December 2018
Vulnerabilities first published on this day (UTC), newest first.
30 results · Feed
-
Unscored —CVE-2018-18312 EPSS 13%
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invali…
-
Unscored —
SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file…
-
Unscored —
In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores use…
-
Unscored —
Tarantella Enterprise before 3.11 allows bypassing Access Control.
-
Unscored —
Tarantella Enterprise before 3.11 allows Directory Traversal.
-
Unscored —
Local attackers can trigger a stack-based buffer overflow on vulnerable installations of Antiy-AVL ATool security manag…
-
Unscored —
Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to recover the plainte…
-
Medium 5.9
Kubernetes Arbitrary Command Injection
In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection.
-
Critical 9.8
Privilege Escalation in Kubernetes
In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backe…
-
High 8.1
Minikube RCE via DNS Rebinding
In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, …
-
Unscored —
Data leakage in cryptographic libraries for Intel IPP before 2019 update1 release may allow an authenticated user to po…
-
Unscored —
login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.
-
Unscored —
cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible w…
-
Unscored —
This module enables Drupal to synchronize entities with Salesforce records. The module includes a page that does not su…
-
Unscored —
Dell Encryption Enterprise \ Dell Data Protection Encryption Information Disclosure Vulnerability
Dell Encryption (formerly Dell Data Protection | Encryption) v10.1.0 and earlier contain an information disclosure vulnerability. A malicious user with physical access to the machine could potentially exploit this vulnerability to access the unencrypted RegBa…
-
High 8.4
NFS Volume release errand leaks cf admin credentials in logs
Cloud Foundry NFS volume release, 1.2.x prior to 1.2.5, 1.5.x prior to 1.5.4, 1.7.x prior to 1.7.3, logs the cf admin username and password when running the nfsbrokerpush BOSH deploy errand. A remote authenticated user with access to BOSH can obtain the admin…
-
Unscored —
IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt …
-
Medium 5.9
IBM QRadar SIEM 7.2 and 7.3 uses hard-coded credentials which could allow an attacker to bypass the authentication conf…
-
Medium 5.4
IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…
-
Medium 4.0
IBM QRadar SIEM 7.2 and 7.3 allows web pages to be stored locally which can be read by another user on the system. IBM …
-
High 8.4
IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating…
-
Medium 5.3
IBM QRadar Advisor with Watson 1.14.0 discloses sensitive information to unauthorized users. The information can be use…
-
High 7.1
IBM QRadar SIEM 7.2 and 7.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A r…
-
Medium 4.3
IBM Maximo Asset Management 7.6 could allow an authenticated user to enumerate usernames using a specially crafted HTTP…
-
Low 3.7
IBM QRadar SIEM 7.2.8 and 7.3 does not validate, or incorrectly validates, a certificate. This weakness might allow an …
-
Unscored —
The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer…
-
Unscored —
A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.…
-
Unscored —
NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause …
-
Medium 6.5CVE-2018-19859 Public exploit
OpenRefine Directory Traversal
OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive.
-
Unscored —
HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in w…