Archive
2 January 2019
Vulnerabilities first published on this day (UTC), newest first.
29 results · Feed
-
Unscored —CVE-2018-13045 Public exploit
SQL injection vulnerability in the "Bazar" page in Yeswiki Cercopitheque 2018-06-19-1 and earlier allows attackers to e…
-
Unscored —
An issue was discovered in ExpressVPN on Windows. The Xvpnd.exe process (which runs as a service with SYSTEM privileges…
-
Critical 9.8CVE-2018-19361 EPSS 11%
Deserialization of Untrusted Data in jackson-databind
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
-
Critical 9.8CVE-2018-19362 EPSS 11%
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
-
Unscored —
In Artifex Ghostscript before 9.26, a carefully crafted PDF file can trigger an extremely long running computation when…
-
Critical 9.8CVE-2018-19360 EPSS 11%
Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
-
Unscored —CVE-2018-19371 Public exploit
The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive…
-
Critical 9.8CVE-2018-14718 EPSS 13%
Arbitrary Code Execution in jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
-
Critical 9.8
XML External Entity Reference (XXE) in jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
-
Critical 9.8
Arbitrary Code Execution in jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
-
Critical 10.0CVE-2018-14721 EPSS 10%
Server-Side Request Forgery (SSRF) in jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
-
Unscored —
On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can…
-
Unscored —
ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with…
-
Unscored —CVE-2018-20166 Public exploit
A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload …
-
Unscored —CVE-2018-20326 Public exploit
ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have XSS via the cgi-bin/webproc?getpag…
-
Unscored —
An issue was discovered on August Connect devices. Insecure data transfer between the August app and August Connect dur…
-
Unscored —
An issue was discovered in Bento4 1.5.1-627. The AP4_StcoAtom class in Core/Ap4StcoAtom.cpp has an attempted excessive …
-
Unscored —
inxedu through 2018-12-24 has a SQL Injection vulnerability that can lead to information disclosure via the deleteFaveo…
-
Unscored —
An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/ProductAction.class.php allows blind SQL Injection…
-
Unscored —
There is an information leak vulnerability in some Huawei HG products. An attacker may obtain information about the HG …
-
Unscored —CVE-2018-20658 Public exploit
The server in Core FTP 2.0 build 653 on 32-bit platforms allows remote attackers to cause a denial of service (daemon c…
-
Unscored —
An issue was discovered in libming 0.4.8. There is a heap-based buffer over-read in the function writePNG in the file u…
-
Unscored —
In libsixel v1.8.2, there is an infinite loop in the function sixel_decode_raw_impl() in the file fromsixel.c, as demon…
-
Unscored —
In libsixel v1.8.2, there is a heap-based buffer over-read in the function load_jpeg() in the file loader.c, as demonst…
-
Unscored —
Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some ca…
-
Unscored —
A vulnerability in the ExtCommon.dll user extension module version 9.2, 9.2.1, 9.2.2 of Xplatform ActiveX could allow a…
-
Unscored —
The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory lea…
-
Unscored —CVE-2019-3501 Public exploit
The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards pa…
-
Unscored —
aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, whi…