Vendor
[UNKNOWN]
239 known vulnerabilities.
Products
145 results · Clear filters · Feed
-
Medium 4.3
Moodle XSS Vulnerability
A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note tha…
-
Medium 6.4
A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function…
-
Medium 4.3
Moodle XSS Vulnerability
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is …
-
Medium 5.3
It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an…
-
Medium 6.8
An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change config…
-
Medium 6.5
It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMA…
-
Medium 6.5
A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the s…
-
Medium 5.9CVE-2018-16875 Public exploit
Denial of service in chain verification in crypto/x509
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting…
-
Medium 6.8
Directory traversal via "go get" command in cmd/go
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable…
-
Medium 5.0
A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_pa…
-
Medium 4.7
A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of…
-
Medium 4.7
A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA …
-
Medium 6.1
Improper Authentication in Keycloak
The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack.
-
Medium 5.7
Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When config…
-
Medium 6.5
Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the proc…
-
Medium 6.5
Samba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference. During the processing o…
-
Medium 6.5
A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNA…
-
Medium 5.9
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing …
-
Medium 5.3
A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final fi…
-
Medium 5.5
The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capab…
-
Medium 6.5CVE-2018-16854 Public exploit
Moodle Login CSRF vulnerability in login form
A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.
-
Medium 5.3
An issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote attacker sending a DNS quer…
-
Medium 5.3
nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessiv…
-
Medium 5.3CVE-2018-16844 EPSS 13%
nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessiv…
-
Medium 6.5
A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY …
-
Medium 6.1CVE-2016-6328 Public exploit
A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input file. This can…
-
Medium 6.4
It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos a…
-
Medium 6.1
JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users tha…
-
Medium 4.0
A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potentia…
-
Medium 5.4
A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly…
-
Medium 5.9
It was discovered that sos-collector does not properly set the default permissions of newly created files, making all f…
-
Medium 5.3
A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from w…
-
Medium 5.3
The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is require…
-
Medium 5.3
A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xpr…
-
Medium 5.3
An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than …
-
Medium 6.2
A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was be…
-
Medium 5.3
A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was fo…
-
Medium 5.9
It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote att…
-
Medium 5.9
It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote att…
-
Medium 6.8
pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repo…