Skip to content
OpenAdvisories

Archive

20 December 2018

Vulnerabilities first published on this day (UTC), newest first.

← November 2018 2018 / December /20 January 2019 →
  1. 18
  2. 21
  3. 354
  4. 480
  5. 530
  6. 675
  7. 757
  8. 88
  9. 93
  10. 1032
  11. 1153
  12. 1281
  13. 1356
  14. 1421
  15. 152
  16. 16 
  17. 1778
  18. 1819
  19. 1931
  20. 20136
  21. 2130
  22. 2214
  23. 2340
  24. 2441
  25. 2526
  26. 2633
  27. 2711
  28. 2882
  29. 29 
  30. 3029
  31. 3134
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Medium 6.5
    CVE-2018-17244

    Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch

    Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username i…

    Elastic Elasticsearch org.elasticsearch:elasticsearch Maven
  • Medium 5.9
    CVE-2018-17247

    Improper Restriction of XML External Entity Reference in Elasticsearch

    Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially cra…

    Elastic Elasticsearch org.elasticsearch:elasticsearch Maven
  • Medium 6.5
    CVE-2018-1000883

    Header Injection

    Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can be added. This attack appear to be exploitable via Crafting a value to be sent as a cookie. This vulnerability appears to…

    plug Hex
  • Medium 6.5
    CVE-2018-1000873

    Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353

    Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, s…

    jackson-databind com.fasterxml.jackson.datatype:jackson-datatype-jsr310 Ubuntu Maven
  • Medium 6.5
    CVE-2018-1000872

    PyKMIP Denial of service vulnerability

    OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262) vulnerability in PyKMIP server that can result in DOS: the server can be made unavailable by one or more clients opening all of t…

    pykmip python-pykmip python-pykmip Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2018-1000874

    PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in all distribut…

  • Medium 6.1
    CVE-2018-1000855

    Cross Site Scripting (XSS) vulnerability in easymon

    easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Can be used to steal cookies, depending on the cookie settings.. This attack app…

    easymon RubyGems
  • Medium 6.1
    CVE-2018-1000826

    Microweber XSS Vulnerability

    Microweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution of JavaScript code.

    microweber/microweber Packagist
  • Medium 6.5
    CVE-2018-1000814

    aiohttp-session creates non-expiring sessions

    aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a co…

    aiohttp-session PyPI
  • Medium 5.4
    CVE-2018-1000816

    Grafana XSS Vulnerability

    Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated us…

    grafana github.com/grafana/grafana Ubuntu Go
  • Medium 6.1
    CVE-2018-1000842

    Fat Free CRM vulnerable to Cross-site Scripting

    FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear t…

    fat_free_crm RubyGems
  • Medium 5.1
    CVE-2018-7365

    All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerabil…

    ZTE uSmartView
  • Medium 6.5
    CVE-2018-1661

    IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an atta…

    IBM DataPower Gateways
  • Medium 5.1
    CVE-2018-1677

    IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable to a denial of ser…

    IBM DataPower Gateways
  • Medium 6.3
    CVE-2018-6669

    Bypass Application Control through an ASP.NET form

    A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows a remote or local user to execute blacklisted files through an ASP.NET form.

    McAfee Application and Change Control
  • Medium 6.5
    CVE-2018-20301

    Permissive parameters and privilege escalation

    An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users …

    coherence Hex
  • Medium 6.1
    CVE-2018-20302

    Cross-site Scripting in xain

    An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter.

    xain Hex