Archive
January 2019
Vulnerabilities first published in this month (UTC), newest first.
1,214 results · Feed
-
Unscored —CVE-2018-4185 Public exploit
In iOS before 11.3, tvOS before 11.3, watchOS before 4.3, and macOS before High Sierra 10.13.4, an information disclosu…
-
Unscored —
In macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validation.
-
High 8.8
In iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improv…
-
Unscored —
In Safari before 11.1, an information leakage issue existed in the handling of downloads in Safari Private Browsing. Th…
-
Unscored —
In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, a permis…
-
Unscored —
In iOS before 9.3.3, a memory corruption issue existed in the kernel. This issue was addressed through improved memory …
-
Unscored —
In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, proxy authent…
-
Unscored —
In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a validation …
-
Unscored —
In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a downgrade i…
-
Unscored —
In macOS High Sierra before 10.13.2, an access issue existed with privileged WiFi system configuration. This issue was …
-
Unscored —
In macOS High Sierra before 10.13.2, a logic issue existed in APFS when deleting keys during hibernation. This was addr…
-
Unscored —
In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, a logic …
-
Unscored —
In iOS before 11.2, an inconsistent user interface issue was addressed through improved state management.
-
Unscored —
In iOS before 11.2, a type confusion issue was addressed with improved memory handling.
-
Unscored —
In iOS before 11.2, exchange rates were retrieved from HTTP rather than HTTPS. This was addressed by enabling HTTPS for…
-
Unscored —
An issue has been found in libIEC61850 v1.3.1. Memory_malloc and Memory_calloc in hal/memory/lib_memory.c have memory l…
-
Unscored —
An issue has been found in libIEC61850 v1.3.1. Ethernet_setProtocolFilter in hal/ethernet/linux/ethernet_linux.c has a …
-
Unscored —
An issue has been found in libIEC61850 v1.3.1. Memory_malloc in hal/memory/lib_memory.c has a memory leak when called f…
-
Unscored —
An issue was discovered in lib60870 2.1.1. LinkLayer_setAddress in link_layer/link_layer.c has a NULL pointer dereferen…
-
Medium 5.3
Cisco Policy Suite Graphite Unauthenticated Read-Only Access Vulnerability
A vulnerability in the Graphite web interface of the Policy and Charging Rules Function (PCRF) of Cisco Policy Suite (CPS) could allow an unauthenticated, remote attacker to access the Graphite web interface. The attacker would need to have access to the inte…
-
Medium 5.8
Cisco ASR 900 Series Aggregation Services Router Software Denial of Service Vulnerability
A vulnerability in Cisco 900 Series Aggregation Services Router (ASR) software could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient handling of cer…
-
Medium 6.1
Cisco TelePresence Management Suite Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affect…
-
Unscored —
In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, an…
-
Unscored —
svg-run.c in Artifex MuPDF 1.14.0 has infinite recursion with stack consumption in svg_run_use_symbol, svg_run_element,…
-
Unscored —
An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table[] SQL injection. This can be us…
-
Unscored —
The Admin Panel of PHP Scripts Mall Advance Peer to Peer MLM Script v1.7.0 allows remote attackers to bypass intended a…
-
Unscored —
Artifex MuPDF 1.14.0 has a SEGV in the function fz_load_page of the fitz/document.c file, as demonstrated by mutool. Th…
-
Unscored —
The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.
-
Unscored —
An issue was discovered in Bento4 v1.5.1-627. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStre…
-
Medium 6.5
png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has s…
-
Medium 6.1
Cisco Webex Business Suite Cross-Site Scripting Vulnerability
A vulnerability in the MyWebex component of Cisco Webex Business Suite could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. The vulnerability is due to insufficient validation of user-supplied input. An attacker coul…
-
High 8.6
Cisco Email Security Appliance URL Filtering Denial of Service Vulnerability
A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service (Do…
-
Unscored —
Imperva SecureSphere running v12.0.0.50 is vulnerable to local arbitrary code execution, escaping sealed-mode.
-
Unscored —
Imperva SecureSphere gateway (GW) running v13, for both pre-First Time Login or post-First Time Login (FTL), if the att…
-
Unscored —
Imperva SecureSphere running v13.0, v12.0, or v11.5 allows low privileged users to add SSH login keys to the admin user…
-
Unscored —
In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the …
-
Critical 9.8
modulemd uses an unsafe function for processing externally provided data
modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution.
-
Medium 6.1
Bodhi Cross-site Scripting Vulnerability
Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles.
-
Unscored —
Improper file verification in install routine for Intel(R) SGX SDK and Platform Software for Windows before 2.2.100 may…
-
Unscored —
Firmware update routine in bootloader for Intel(R) Optane(TM) SSD DC P4800X before version E2010435 may allow a privile…