Skip to content
OpenAdvisories

Archive

16 January 2019

Vulnerabilities first published on this day (UTC), newest first.

← December 2018 2019 / January /16 February 2019 →
  1. 14
  2. 229
  3. 358
  4. 410
  5. 5 
  6. 6 
  7. 78
  8. 871
  9. 9196
  10. 1048
  11. 1158
  12. 124
  13. 139
  14. 1414
  15. 1560
  16. 16212
  17. 1712
  18. 18123
  19. 193
  20. 20 
  21. 214
  22. 2227
  23. 2330
  24. 24107
  25. 2513
  26. 263
  27. 272
  28. 2828
  29. 2934
  30. 3018
  31. 3129
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 8.8
    CVE-2018-18814

    TIBCO Spotfire Authentication Vulnerability

    The TIBCO Spotfire authentication component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability in the handling of the authentication that theoretically may allow an attacker to ga…

    TIBCO Software TIBCO Spotfire Analytics Platform for AWS Marketplace TIBCO Spotfire Server
  • High 8.8
    CVE-2018-18813

    TIBCO Spotfire Reflected and Persistent Cross-Site Scripting Vulnerabilities

    The Spotfire web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains multiple vulnerabilities that may allow persistent and reflected cross-site scripting attacks. Affected releas…

    TIBCO Software TIBCO Spotfire Analytics Platform for AWS Marketplace TIBCO Spotfire Server
  • High 7.7
    CVE-2018-15782

    DSA-2018-226: RSA® Authentication Manager Relative Path Traversal Vulnerability

    The Quick Setup component of RSA Authentication Manager versions prior to 8.4 is vulnerable to a relative path traversal vulnerability. A local attacker could potentially provide an administrator with a crafted license that if used during the quick setup depl…

    Dell RSA Authentication Manager
  • High 7.5
    CVE-2018-5734

    A malformed request can trigger an assertion failure in badcache.c

    While handling a particular type of malformed packet BIND erroneously selects a SERVFAIL rcode instead of a FORMERR rcode. If the receiving view has the SERVFAIL cache feature enabled, this can trigger an assertion failure in badcache.c when the request doesn…

    ISC BIND 9
  • High 7.5
    CVE-2018-5740 Public exploit EPSS 60%

    A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named

    "deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Alpine
  • High 7.5
    CVE-2016-9778

    An error handling certain queries using the nxdomain-redirect feature could cause a REQUIRE assertion failure in db.c

    An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A vulnerable server could be intentionally stopped by an attacker if…

    ISC BIND 9
  • High 7.5
    CVE-2017-3145 EPSS 28%

    Improper fetch cleanup sequencing in the resolver can cause named to crash

    BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Alpine
  • High 7.5
    CVE-2017-3143 Public exploit EPSS 18%

    An error in TSIG authentication can permit unauthorized dynamic updates

    An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BI…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Alpine
  • High 7.5
    CVE-2017-3137

    A response packet can cause a resolver to terminate when processing an answer containing a CNAME or DNAME

    Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurre…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Alpine
  • High 7.5
    CVE-2017-3135 EPSS 17%

    Combination of DNS64 and RPZ Can Lead to Crash

    Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Alpine
  • High 7.2
    CVE-2017-3141 Public exploit

    Windows service and uninstall paths are not quoted when BIND is installed

    The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.…

    ISC BIND 9 bind Alpine
  • High 8.1
    CVE-2019-2435

    Improper Access Control in MySQL Connector Python

    Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network acce…

    Oracle MySQL Connectors mysql-connector-python mysql-connector-python Ubuntu PyPI