Archive
11 December 2018
Vulnerabilities first published on this day (UTC), newest first.
53 results · Feed
-
Critical 9.8
Remote Logging functionality had a use after free vulnerability in McAfee Agent
Use After Free in Remote logging (which is disabled by default) in McAfee McAfee Agent (MA) 5.x prior to 5.6.0 allows remote unauthenticated attackers to cause a Denial of Service and potentially a remote code execution via a specially crafted HTTP header sen…
-
Unscored —
Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP…
-
Unscored —
By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that shou…
-
Unscored —
Under certain conditions SAP Mobile Secure Android client (before version 6.60.19942.0 SP28 1711) allows an attacker to…
-
Unscored —
TRACE method is enabled in SAP Business One Service Layer . Attacker can use XST (Cross Site Tracing) attack if fronten…
-
Unscored —
SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabili…
-
Unscored —
SAP Marketing (UICUAN (1.20, 1.30, 1.40), SAPSCORE (1.13, 1.14)) does not sufficiently encode user-controlled inputs, r…
-
Unscored —
SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result i…
-
Unscored —
SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untruste…
-
Unscored —
The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a stat…
-
Medium 6.8
TIBCO Managed File Transfer Credentials Disclosure
The Administrator Service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center, and TIBCO Managed File Transfer Internet Server contains vulnerabilities where an authenticated user with specific privileges can gain access to credentia…
-
Unscored —
doorGets 7.0 allows remote attackers to write to arbitrary files via directory traversal, as demonstrated by a dg-user/…
-
Critical 9.8
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PH…
KEV Nov 3, 2021 -
Medium 6.1
phpMyAdmin Cross-site Scripting (XSS) vulnerability
In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name.
-
High 8.8
phpMyAdmin CSRF Vulnerability
phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting …
-
Medium 6.5
phpMyAdmin Local file inclusion through transformation feature
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any d…
-
Unscored —
A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to …
-
Critical 9.8
Exposure of Sensitive Information to an Unauthorized Actor in urllib3
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended h…
-
High 8.1
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code thr…
-
Medium 5.4
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting. This v…
-
Medium 6.8
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attacker to conduct phis…
-
Medium 6.2
IBM DataPower Gateway 7.1.0.0 through 7.1.0.19, 7.2.0.0 through 7.2.0.16, 7.5.0.0 through 7.5.0.10, 7.5.1.0 through 7.5…
-
Unscored —
An integer overflow leading to a heap buffer overflow in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote …
-
Unscored —
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote at…
-
Unscored —
Incorrect object lifecycle in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially ex…
-
Unscored —
Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a…
-
Unscored —
Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71…
-
Unscored —
An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a …
-
Unscored —
Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote …
-
Unscored —
Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 a…
-
Unscored —
Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 a…
-
Unscored —
Incorrect object lifecycle in MediaRecorder in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potenti…
-
Unscored —
Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0…
-
Unscored —
Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remo…
-
Unscored —
Incorrect, thread-unsafe use of SkImage in Canvas in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to p…
-
Unscored —
Incorrect handling of Reflect.construct in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to perfo…
-
Unscored —
Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker who …
-
Unscored —
Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed…
-
Unscored —
Incorrect handling of bidirectional domain names with RTL characters in Omnibox in Google Chrome prior to 71.0.3578.80 …
-
Unscored —
Insufficient validate of external protocols in Shell Integration in Google Chrome on Windows prior to 71.0.3578.80 allo…