Skip to content
OpenAdvisories

Archive

January 2019

Vulnerabilities first published in this month (UTC), newest first.

← December 2018 2019 / January February 2019 →
  1. 14
  2. 229
  3. 358
  4. 410
  5. 5 
  6. 6 
  7. 78
  8. 871
  9. 9196
  10. 1048
  11. 1158
  12. 124
  13. 139
  14. 1414
  15. 1560
  16. 16212
  17. 1712
  18. 18123
  19. 193
  20. 20 
  21. 214
  22. 2227
  23. 2330
  24. 24107
  25. 2513
  26. 263
  27. 272
  28. 2828
  29. 2934
  30. 3018
  31. 3129
All Critical High Medium Low Exploited only Public exploit

139 results · Clear filters · Feed

  • Medium 5.4
    CVE-2019-0558

    A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…

    Microsoft Microsoft SharePoint Server Microsoft SharePoint Microsoft Business Productivity Servers
  • Medium 5.4
    CVE-2019-0557

    A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…

    Microsoft Microsoft SharePoint
  • Medium 4.0
    CVE-2018-1993

    IBM Spectrum Scale (GPFS) 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache (LROC) is…

    IBM Spectrum Scale
  • Medium 5.4
    CVE-2018-1918

    IBM Jazz Reporting Service (JRS) 6.0.3, 6.0.4, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerabili…

    IBM Jazz Reporting Service
  • Medium 4.9
    CVE-2018-1932 Public exploit

    IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the manageme…

    IBM API Connect
  • Medium 6.5
    CVE-2018-11798

    Apache Thrift Node.js static web server sandbox escape

    The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.

    Apache Software Foundation Apache Thrift druid trino Debian Wolfi Maven
  • Medium 5.4
    CVE-2018-1657

    IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to…

    IBM Rational Publishing Engine
  • Medium 4.3
    CVE-2018-1859

    IBM API Connect 5.0.0.0 through 5.0.8.4 could allow a user authenticated as an administrator with limited rights to esc…

    IBM API Connect
  • Medium 5.3
    CVE-2018-1888

    An untrusted search path vulnerability in IBM i Access for Windows versions 7.1 and earlier on Windows can allow arbitr…

    IBM i Access for Windows Windows
  • Medium 5.4
    CVE-2018-1951

    IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to…

    IBM Rational Publishing Engine
  • Medium 4.2
    CVE-2018-3986

    An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android …

  • Medium 4.3
    CVE-2018-15780

    DSA-2018-224: RSA Archer GRC Platform Improper Access Control Vulnerability

    RSA Archer versions prior to 6.5.0.1 contain an improper access control vulnerability. A remote malicious user could potentially exploit this vulnerability to bypass authorization checks and gain read access to restricted user information.

    Dell RSA Archer
  • Medium 6.1
    CVE-2018-19993

    Dolibarr reflected cross-site scripting (XSS) vulnerability

    A reflected cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web script or HTML via the transphrase parameter to public/notice.php.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 5.4
    CVE-2018-19995

    Dolibarr stored cross-site scripting (XSS) vulnerability

    A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" (POST) or "town" (POST) parameter to user/card.php.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 5.4
    CVE-2018-19992

    Dolibarr stored cross-site scripting (XSS) vulnerability

    A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" (POST) or "town" (POST) parameter to adherents/type.php.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 5.4
    CVE-2018-20663

    The Reporting Addon for CUBA Platform has Persistent XSS

    The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports > Reports" name field.

    com.haulmont.cuba:cuba-web-toolkit Maven
  • Medium 6.1
    CVE-2018-16882

    A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=…

    The Linux Foundation Kernel linux-raspi2 linux-hwe Debian Ubuntu
  • Medium 4.7
    CVE-2018-16885

    A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with…

    The Linux Foundation Kernel linux Debian
  • Medium 5.3
    CVE-2018-18893 Public exploit

    Jinjava calls getClass

    Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.

    com.hubspot.jinjava:jinjava Maven