Archive
December 2018
Vulnerabilities first published in this month (UTC), newest first.
92 results · Clear filters · Feed
-
High 7.5
A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circula…
-
High 7.5
folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in …
-
High 7.5
A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulne…
-
High 7.5
An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This aff…
-
High 7.5
Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of ser…
-
High 8.1
The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires co…
-
High 7.8
An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing check…
-
High 7.5
A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This behavior can lead to…
-
High 8.1
The TK_set_deviceModel_req_handle function in the cloud communication component in Guardzilla GZ621W devices with firmw…
-
High 8.1
The remote upgrade feature in Guardzilla GZ180 devices allow command injection via a crafted new firmware version param…
-
High 8.8
ok-file-formats through 2018-10-16 has a heap-based buffer over-read in the ok_mo_decode2 function in ok_mo.c.
-
High 8.8
Cross-Site Request Forgery (CSRF) in hswebframework.web:hsweb-commons
A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful.
-
High 8.8
Archive_Tar contains Potential RCE if filename starts with phar://
PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called with…
-
High 7.2
Craft CMS Vulnerable to Server-Side Template Injection
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Se…
-
High 7.5
An issue was discovered in the fileDownload function in the CommonController class in FEBS-Shiro before 2018-11-05. An …
-
High 8.3
Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-…
-
High 8.1
Cisco Adaptive Security Appliance Software Privilege Escalation Vulnerability
A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, but unprivileged (levels 0 and 1), remote attacker to perform privileged actions by using the web management interface. The vulner…
-
High 7.8
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, …
KEV Oct 24, 2022 -
High 7.8CVE-2018-19322 Exploited · Ransomware
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, …
KEV Oct 24, 2022 -
High 7.8
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING…
KEV Oct 24, 2022 -
High 8.8
Alzip Stack Overflow Vulnerability
Alzip 10.76.0.0 and earlier is vulnerable to a stack overflow caused by improper bounds checking. By persuading a victim to open a specially-crafted LZH archive file, a attacker could execute arbitrary code execution.
-
High 7.5CVE-2018-1000850 Public exploit
Directory Traversal vulnerability in Square Retrofit
Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter that can result in By manipulating the URL an attacker could add or delete resources othe…
-
High 8.8
Cross-Site Request Forgery (CSRF) in Luigi
Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery (CSRF) vulnerability in API endpoint: /api/<method> that can result in Task metadata such…
-
High 7.5
Asset Pipeline Grails Plugin vulnerable to Path Traversal
Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack app…
-
High 7.1
IBM API Connect 5.0.0.0 and 5.0.8.4 is affected by a NoSQL Injection in MongoDB connector for the LoopBack framework. I…
-
High 7.7
IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication …
-
High 8.4
IBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in t…
-
High 7.2
IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves f…
-
High 8.0
WIZVERA Veraport Race Condition Vulnerability
In Veraport G3 ALL on MacOS, a race condition when calling the Veraport API allow remote attacker to cause arbitrary file download and execution. This results in remote code execution.
-
High 8.0
WIZVERA Remote Code Execution Vulnerability
In Veraport G3 ALL on MacOS, due to insufficient domain validation, It is possible to overwrite installation file to malicious file. A remote unauthenticated attacker may use this vulnerability to execute arbitrary file.
-
High 8.0
KMPlayer Heap Overflow Vulnerability
KMPlayer 4.2.2.15 and earlier have a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted FLV format file. The problem is that more frame data is copied to heap memory than the size specified in the frame header. This results in a me…
-
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Nov 3, 2021 -
High 7.5
Gogs Directory Traversal
In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.
-
High 7.6
Pivotal Concourse allows malicious redirect urls on login
Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to th…
-
High 7.5
Cleartext Transmission of Sensitive Information in Apache nifi
The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certific…
-
High 7.5
Apache NiFi Improper Input Validation vulnerability
When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receivi…
-
High 7.5
RDF4J vulnerable to zip slip
RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.
-
High 8.1
An exploitable vulnerability exists in the HTTP client functionality of the Webroot BrightCloud SDK. The configuration …
-
High 7.8
Sylabs Singularity Improper Input Validation
Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks.
-
High 7.5
rendertron can remotely shut down Chrome instance
Rendertron 1.0.0 includes an _ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET request allows any unauthorized remote attacker to disable the core service of the application.