Archive
December 2018
Vulnerabilities first published in this month (UTC), newest first.
123 results · Clear filters · Feed
-
Medium 6.1CVE-2018-6341 Public exploit
Cross-Site Scripting in react-dom
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x,…
-
Medium 6.5
JasPer 2.0.14 has a memory leak in base/jas_malloc.c in libjasper.a when "--output-format jp2" is used.
-
Medium 5.5
In GNU Binutils 2.31.1, there is a use-after-free in the error function in elfcomm.c when called from the process_archi…
-
Medium 6.1
Bypass Application Control with simple DLL
A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows execution bypass, for example, with simple DLL through interpreters such as PowerShell.
-
Medium 6.6
A local, authenticated attacker can bypass the passcode in the VideoLAN VLC media player app before 3.1.5 for iOS by op…
-
Medium 6.5
MFSBGN03838 rev.1 - UCMDB Configuration Management Service, Multiple Vulnerabilities
Remote Directory Traversal and Remote Disclosure of Privileged Information in UCMDB Configuration Management Service, version 10.22, 10.22 CUP1, 10.22 CUP2, 10.22 CUP3, 10.22 CUP4, 10.22 CUP5, 10.22 CUP6, 10.22 CUP7, 10.33, 10.33 CUP1, 10.33 CUP2, 10.33 CUP3,…
-
Medium 6.1
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field.
-
Medium 5.4
HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.
-
Medium 5.4
CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view/cu_views URI.
-
Medium 5.4
Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.
-
Medium 6.1
Moderate severity vulnerability that affects org.hswebframework.web:hsweb-commons
An issue was discovered in hsweb 3.0.4. It is a reflected XSS vulnerability due to the absence of type parameter checking in FlowableModelManagerController.java.
-
Medium 6.1
PHP League CommonMark vulnerable to Cross-Site Scripting (XSS)
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via a newline character (e.g., writing jav…
-
Medium 4.8
Kirby XSS Vulnerability
Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.
-
Medium 5.4
Evolution CMS Stored Cross-site Scripting (XSS)
Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.
-
Medium 5.4
Evolution CMS Cross-site Scripting (XSS)
Evolution CMS 1.4.x allows XSS via the manager/ search parameter.
-
Medium 4.3
ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, th…
-
Medium 6.1CVE-2018-19799 Public exploit
Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.
-
Medium 6.5
Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote a…
-
Medium 6.5
Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows re…
-
Medium 5.9
Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-1526…
-
Medium 6.5
Apache Tika Denial of Service due to Infinite Loop in Tika's SQLite3Parser
A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.
-
Medium 4.8CVE-2018-20418 Public exploit
Craft CMS Cross-site Scripting (XSS) Vulnerability
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.
-
Medium 6.5
Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch
Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username i…
-
Medium 5.9
Improper Restriction of XML External Entity Reference in Elasticsearch
Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially cra…
-
Medium 6.5
Header Injection
Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can be added. This attack appear to be exploitable via Crafting a value to be sent as a cookie. This vulnerability appears to…
-
Medium 6.5
Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, s…
-
Medium 6.5
PyKMIP Denial of service vulnerability
OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262) vulnerability in PyKMIP server that can result in DOS: the server can be made unavailable by one or more clients opening all of t…
-
Medium 6.1
PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in all distribut…
-
Medium 6.1
Cross Site Scripting (XSS) vulnerability in easymon
easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Can be used to steal cookies, depending on the cookie settings.. This attack app…
-
Medium 6.1
Microweber XSS Vulnerability
Microweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution of JavaScript code.
-
Medium 6.5
aiohttp-session creates non-expiring sessions
aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a co…
-
Medium 5.4
Grafana XSS Vulnerability
Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated us…
-
Medium 6.1
Fat Free CRM vulnerable to Cross-site Scripting
FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear t…
-
Medium 5.1
All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerabil…
-
Medium 6.5
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an atta…
-
Medium 5.1
IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable to a denial of ser…
-
Medium 6.3
Bypass Application Control through an ASP.NET form
A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows a remote or local user to execute blacklisted files through an ASP.NET form.
-
Medium 6.5
Permissive parameters and privilege escalation
An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users …
-
Medium 6.1
Cross-site Scripting in xain
An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter.
-
Medium 6.5
Moderate severity vulnerability that affects org.apache.oozie:oozie-core
Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users. The malicious user can construct an XML that results workflows running in other user's name.