Archive
14 December 2018
Vulnerabilities first published on this day (UTC), newest first.
21 results · Feed
-
Unscored —
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (z…
-
Unscored —
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber …
-
Unscored —
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intend…
-
Unscored —
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to exe…
-
Unscored —
In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration (in the Network Configuration p…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted in…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted met…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleti…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privi…
-
Medium 5.3
IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) contains a denial of service vulnerability. A re…
-
Medium 6.1
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows…
-
Unscored —CVE-2018-18006 EPSS 21%
Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any ext…
-
Medium 4.6
Medtronic 9790, 2090 CareLink, and 29901 Encore Programmers Missing Encryption of Sensitive Data
Medtronic CareLink and Encore Programmers do not encrypt or do not sufficiently encrypt sensitive PII and PHI information while at rest .
-
Medium 4.3
Exposure of Sensitive Information to an Unauthorized Actor in SonarSource SonarQube API
A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access contr…
-
Unscored —
GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00…
-
High 7.5CVE-2018-16873 EPSS 66%
Remote command execution via "go get" with "-u" flag in cmd/go
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is on…
-
Medium 5.9CVE-2018-16875 Public exploit
Denial of service in chain verification in crypto/x509
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting…
-
Medium 6.8
Directory traversal via "go get" command in cmd/go
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable…