Skip to content
OpenAdvisories

Archive

20 December 2018

Vulnerabilities first published on this day (UTC), newest first.

← November 2018 2018 / December /20 January 2019 →
  1. 18
  2. 21
  3. 354
  4. 480
  5. 530
  6. 675
  7. 757
  8. 88
  9. 93
  10. 1032
  11. 1153
  12. 1281
  13. 1356
  14. 1421
  15. 152
  16. 16 
  17. 1778
  18. 1819
  19. 1931
  20. 20136
  21. 2130
  22. 2214
  23. 2340
  24. 2441
  25. 2526
  26. 2633
  27. 2711
  28. 2882
  29. 29 
  30. 3029
  31. 3134
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 7.5
    CVE-2018-1000850 Public exploit

    Directory Traversal vulnerability in Square Retrofit

    Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter that can result in By manipulating the URL an attacker could add or delete resources othe…

    com.squareup.retrofit2:retrofit Maven
  • High 8.8
    CVE-2018-1000843

    Cross-Site Request Forgery (CSRF) in Luigi

    Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery (CSRF) vulnerability in API endpoint: /api/<method> that can result in Task metadata such…

    luigi PyPI
  • High 7.5
    CVE-2018-1000817

    Asset Pipeline Grails Plugin vulnerable to Path Traversal

    Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack app…

    org.grails.plugins:asset-pipeline Maven
  • High 7.1
    CVE-2018-1784

    IBM API Connect 5.0.0.0 and 5.0.8.4 is affected by a NoSQL Injection in MongoDB connector for the LoopBack framework. I…

    IBM API Connect
  • High 7.7
    CVE-2018-1778

    IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication …

    IBM API Connect
  • High 8.4
    CVE-2018-1771

    IBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in t…

    IBM Domino
  • High 7.2
    CVE-2018-1973

    IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves f…

    IBM API Connect
  • High 8.0
    CVE-2018-5198

    WIZVERA Veraport Race Condition Vulnerability

    In Veraport G3 ALL on MacOS, a race condition when calling the Veraport API allow remote attacker to cause arbitrary file download and execution. This results in remote code execution.

    WIZVERA Veraport
  • High 8.0
    CVE-2018-5199

    WIZVERA Remote Code Execution Vulnerability

    In Veraport G3 ALL on MacOS, due to insufficient domain validation, It is possible to overwrite installation file to malicious file. A remote unauthenticated attacker may use this vulnerability to execute arbitrary file.

    WIZVERA Veraport
  • High 8.0
    CVE-2018-5200

    KMPlayer Heap Overflow Vulnerability

    KMPlayer 4.2.2.15 and earlier have a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted FLV format file. The problem is that more frame data is copied to heap memory than the size specified in the frame header. This results in a me…

    Pandora.tv KMPlayer
  • High 7.5
    CVE-2018-8653 Exploited EPSS 30%

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

    Microsoft Internet Explorer 11 Internet Explorer 10 Internet Explorer 9
    KEV Nov 3, 2021
  • High 7.5
    CVE-2018-20303

    Gogs Directory Traversal

    In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.

    gogs.io/gogs Go