Archive
January 2019
Vulnerabilities first published in this month (UTC), newest first.
139 results · Clear filters · Feed
-
Medium 6.5
Access bypass in Drupal 8 views
In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated …
-
Medium 6.8
An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change config…
-
Medium 6.5
Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than al…
-
Medium 4.3
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 a…
KEV Sep 8, 2022 -
Medium 6.5
TIBCO Spotfire Fails To Prevent Write Access to Spotfire Library
The Spotfire Library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability that might theoretically fail to restrict users with read-only access from modifying files stored…
-
Medium 5.9CVE-2018-5737 EPSS 11%
BIND 9.12's serve-stale implementation can cause an assertion failure in rbtdb.c or other undesirable behavior, even if serve-stale is not enabled.
A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between the serve-stale feature and NSEC aggressive negative…
-
Medium 6.5
Failure to release memory may exhaust system resources
An extension to hooks capabilities which debuted in Kea 1.4.0 introduced a memory leak for operators who are using certain hooks library facilities. In order to support multiple requests simultaneously, Kea 1.4 added a callout handle store but unfortunately t…
-
Medium 6.5
Update policies krb5-subdomain and ms-subdomain do not enforce controls promised in their documentation
To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending…
-
Medium 5.3CVE-2018-5738 EPSS 11%
Some versions of BIND can improperly permit recursive query service to unauthorized clients
Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended (and documented) behavior is that if an …
-
Medium 5.9CVE-2018-5733 EPSS 20%
A malicious client can overflow a reference counter in ISC dhcpd
A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash. Affects ISC DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3…
-
Medium 6.5
named exits with a REQUIRE assertion failure if it receives a null command string on its control channel
named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A regression introduced in a recent feature change has created a situa…
-
Medium 5.9CVE-2017-3136 EPSS 11%
An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;"
A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS6…
-
Medium 5.3CVE-2017-3144 EPSS 73%
Failure to properly clean up closed OMAPI connections can exhaust available sockets
A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions ma…
-
Medium 5.3
An error in TSIG authentication can permit unauthorized zone transfers
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies …
-
Medium 5.9
File REST resource does not properly validate
In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PAT…
-
Medium 5.4
Juniper ATP: Persistent Cross-Site Scripting vulnerability in Snort Rules configuration
A persistent cross-site scripting (XSS) vulnerability in the Snort Rules configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follo…
-
Medium 5.4
Juniper ATP: Persistent Cross-Site Scripting (XSS) vulnerability in file upload menu
A persistent cross-site scripting (XSS) vulnerability in the file upload menu of Juniper ATP may allow an authenticated user to inject arbitrary scripts and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on …
-
Medium 6.7
Juniper ATP: Password hashing uses DES and a hardcoded salt
Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
-
Medium 5.4
Juniper ATP: Persistent Cross-Site Scripting vulnerability in the Golden VM menu
A persistent cross-site scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on admini…
-
Medium 6.5
Junos OS: Kernel crash after processing specific incoming packet to the out of band management interface (CVE-2019-0011)
The Junos OS kernel crashes after processing a specific incoming packet to the out of band management interface (such as fxp0, me0, em0, vme0) destined for another address. By continuously sending this type of packet, an attacker can repeatedly crash the kern…
-
Medium 5.5
Junos OS: EX2300 and EX3400: High disk I/O operations may disrupt the communication between RE and PFE
On EX2300 and EX3400 series, high disk I/O operations may disrupt the communication between the routing engine (RE) and the packet forwarding engine (PFE). In a virtual chassis (VC) deployment, this issue disrupts communication between the VC members. This is…
-
Medium 6.5
Junos Space: Unrestricted file upload vulnerability
The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior…
-
Medium 6.5
Junos OS: RPD crash upon receipt of malformed PIM packet
The routing protocol daemon (RPD) process will crash and restart when a specific invalid IPv4 PIM Join packet is received. While RPD restarts after a crash, repeated crashes can result in an extended Denial of Service (DoS) condition. This issue only affects …
-
Medium 5.8
Junos OS: EX2300 and EX3400 series: Certain stateless firewall filter rules might not take effect
On EX2300 and EX3400 series, stateless firewall filter configuration that uses the action 'policer' in combination with other actions might not take effect. When this issue occurs, the output of the command: show pfe filter hw summary will not show the entry …
-
Medium 5.4
Juniper ATP: Persistent Cross-Site Scripting vulnerability in Zone configuration
A persistent cross-site scripting (XSS) vulnerability in the Zone configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on ad…
-
Medium 5.4
Junos OS: SRX Series: Deleted dynamic VPN users are allowed to establish VPN connections until reboot
A vulnerability in the SRX Series Service Gateway allows deleted dynamic VPN users to establish dynamic VPN connections until the device is rebooted. A deleted dynamic VPN connection should be immediately disallowed from establishing new VPN connections. Due …
-
Medium 5.4
Juniper ATP: Persistent Cross-Site Scripting vulnerability in the Email Collectors menu
A persistent cross-site scripting (XSS) vulnerability in the Email Collectors menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on…
-
Medium 5.4
Juniper ATP: Persistent Cross-Site Scripting vulnerability in RADIUS configuration menu
A persistent cross-site scripting (XSS) vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on…
-
Medium 6.5
Junos Space: Authenticated user able to delete devices without delete device privileges
A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected re…
-
Medium 6.1
Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of an affected system. The …
-
Medium 6.1
Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability…
-
Medium 6.5
It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMA…
-
Medium 6.5
Shopware XXE Vulnerability
Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.
-
Medium 4.1
A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root…
-
Medium 4.4
It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When…
-
Medium 6.8
go.etcd.io/etcd Authentication Bypass
etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) wh…
-
Medium 5.9
IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it…
-
Medium 6.1
IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arb…
-
Medium 5.4
katello Cross-site Scripting vulnerability
A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories…
-
Medium 4.5
Concourse includes token in CLI authentication callback
Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user.