SB18-218: Vulnerability Summary for the Week of July 30, 2018

Original release date: August 06, 2018

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

  • High – Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 – 10.0

  • Medium – Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 – 6.9

  • Low – Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 – 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.

The NCCIC Weekly Vulnerability Summary Bulletin is created using information from the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD). In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

 

High Vulnerabilities

Primary
Vendor — Product
DescriptionPublishedCVSS ScoreSource & Patch Info
There were no high vulnerabilities recorded this week.

Back to top

 

Medium Vulnerabilities

Primary
Vendor — Product
DescriptionPublishedCVSS ScoreSource & Patch Info
There were no medium vulnerabilities recorded this week.

Back to top

 

Low Vulnerabilities

Primary
Vendor — Product
DescriptionPublishedCVSS ScoreSource & Patch Info
There were no low vulnerabilities recorded this week.

Back to top

 

Severity Not Yet Assigned

Primary
Vendor — Product
DescriptionPublishedCVSS ScoreSource & Patch Info
3cx — 3cxThe Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on all stack traces’ propertyPath parameters.2018-08-03not yet calculatedCVE-2018-14906
MISC
3cx — 3cxThe Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of improper error handling in Stack traces, as demonstrated by discovering a full pathname.2018-08-03not yet calculatedCVE-2018-14907
MISC
3cx — 3cx
 
The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter.2018-08-03not yet calculatedCVE-2018-14905
MISC
ansible — ansibleAnsible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.2018-07-31not yet calculatedCVE-2016-8628
BID
REDHAT
CONFIRM
ansible — ansible
 
A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.2018-07-31not yet calculatedCVE-2016-8614
BID
CONFIRM
CONFIRM
CONFIRM
CONFIRM
apache — axisApache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.2018-08-02not yet calculatedCVE-2018-8032
MLIST
CONFIRM
apache — camelApache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.2018-07-31not yet calculatedCVE-2018-8027
CONFIRM
BID
MLIST
apache — karafIt was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.2018-08-01not yet calculatedCVE-2016-8648
BID
CONFIRM
apache — tomcatWhen using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.2018-07-31not yet calculatedCVE-2018-8019
MLIST
BID
apache — tomcatApache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses. Subsequently, revoked client certificates may not be properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS. Users not using OCSP checks are not affected by this vulnerability.2018-07-31not yet calculatedCVE-2018-8020
MLIST
BID
apache — tomcatThe host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.2018-08-01not yet calculatedCVE-2018-8034
MLIST
BID
SECTRACK
MLIST
UBUNTU
apache — tomcat
 
A bug in the tracking of connection closures can lead to reuse of user sessions in a new connection. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.2018-08-02not yet calculatedCVE-2018-8037
MLIST
BID
SECTRACK
apache — tomcat
 
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.2018-08-02not yet calculatedCVE-2018-1336
MLIST
BID
SECTRACK
UBUNTU

ca_technologies — api_developer_portal

CA API Developer Portal 4.x, prior to v4.2.5.3 and v4.2.7.1, has an unspecified reflected cross-site scripting vulnerability.2018-08-03not yet calculatedCVE-2018-6590
SECTRACK
CONFIRM
cfitsio — cfitsio
 
Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Specially crafted images parsed via the library, can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.2018-08-01not yet calculatedCVE-2018-3847
MISC
cgit — cgit
 
cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.2018-08-03not yet calculatedCVE-2018-14912
MISC
MISC
DEBIAN
cisco — amp_for_endpoints_mac_connector_softwareA vulnerability in Cisco AMP for Endpoints Mac Connector Software installed on Apple macOS 10.12 could allow an unauthenticated, remote attacker to cause a kernel panic on an affected system, resulting in a denial of service (DoS) condition. The vulnerability exists if the affected software is running in Block network conviction mode. Exploitation could occur if the system that is running the affected software starts a server process and an address in the IP blacklist cache of the affected software attempts to connect to the affected system. A successful exploit could allow the attacker to cause a kernel panic on the system that is running the affected software, resulting in a DoS condition. Cisco Bug IDs: CSCvk08192.2018-08-01not yet calculatedCVE-2018-0397
BID
CONFIRM
cisco — identity_services_engineA vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvi85159.2018-08-01not yet calculatedCVE-2018-0413
BID
SECTRACK
CONFIRM

cisco — prime_collaboration_provisioning

A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to become inoperable. The vulnerability is due to insufficient validation of a password change request. An attacker could exploit this vulnerability by changing a specific administrator account password. A successful exploit could allow the attacker to cause the affected device to become inoperable, resulting in a denial of service (DoS) condition. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 12.2 and prior. Cisco Bug IDs: CSCvd86586.2018-08-01not yet calculatedCVE-2018-0391
BID
SECTRACK
CONFIRM
cisco — small_business_managed_switchesA vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvi87330.2018-08-01not yet calculatedCVE-2018-0408
BID
CONFIRM
cisco — small_business_managed_switchesA vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticated, remote attacker to conduct a persistent cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvi87326.2018-08-01not yet calculatedCVE-2018-0407
BID
CONFIRM
cisco — unified_communications_managerA vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvk15343.2018-08-01not yet calculatedCVE-2018-0411
BID
SECTRACK
CONFIRM
cisco — web_security_applianceA vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct a reflected or Document Object Model based (DOM-based) cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve84006.2018-08-01not yet calculatedCVE-2018-0406
BID
SECTRACK
CONFIRM

click_studios — passwordstate

Click Studios Passwordstate before 8.3 Build 8397 allows XSS by authenticated users via an uploaded HTML document.2018-08-01not yet calculatedCVE-2018-14776
MISC
MISC
cloud-init — cloud-init
 
The default cloud-init configuration, in cloud-init 0.6.2 and newer, included “ssh_deletekeys: 0”, disabling cloud-init’s deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.2018-08-01not yet calculatedCVE-2018-10896
CONFIRM
CONFIRM
CONFIRM
cloudwu — pbcAn issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in set_field_one in bootstrap.c while making a query.2018-07-29not yet calculatedCVE-2018-14740
MISC
cloudwu — pbcAn issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A NULL pointer dereference can occur in pbc_wmessage_string in wmessage.c.2018-07-29not yet calculatedCVE-2018-14737
MISC
cloudwu — pbcAn issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in set_field_one in bootstrap.c during a memcpy.2018-07-29not yet calculatedCVE-2018-14742
MISC
cloudwu — pbcAn issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in pbc_rmessage_message in rmessage.c.2018-07-29not yet calculatedCVE-2018-14738
MISC
cloudwu — pbcAn issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in pbc_pattern_set_default in pattern.c.2018-07-29not yet calculatedCVE-2018-14739
MISC
cloudwu — pbcAn issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in pbc_pattern_pack in pattern.c.2018-07-29not yet calculatedCVE-2018-14741
MISC
cloudwu — pbcAn issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in wiretype_decode in context.c.2018-07-29not yet calculatedCVE-2018-14743
MISC
cloudwu — pbcAn issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A buffer over-read can occur in pbc_wmessage_string in wmessage.c for PTYPE_ENUM.2018-07-29not yet calculatedCVE-2018-14736
MISC
cloudwu — pbcAn issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A use-after-free can occur in _pbcM_sp_query in map.c.2018-07-29not yet calculatedCVE-2018-14744
MISC
clustered_data — ontapRead-Only export policy rules are not correctly enforced in Clustered Data ONTAP 8.3 Release Candidate versions and therefore may allow more than “read-only” access from authenticated SMBv2 and SMBv3 clients. This behavior has been resolved in the GA release. Customers running prior release candidates (RCs) are requested to update their systems to the NetApp Data ONTAP 8.3 GA release.2018-08-03not yet calculatedCVE-2018-5490
CONFIRM
computerinsel — photolineA memory corruption vulnerability exists in the PCX-parsing functionality of Computerinsel Photoline 20.54. A specially crafted PCX image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. An attacker can deliver a PCX image to trigger this vulnerability and gain code execution.2018-08-01not yet calculatedCVE-2018-3923
MISC
computerinsel — photolineA memory corruption vulnerability exists in the PSD-parsing functionality of Computerinsel Photoline 20.54. A specially crafted PSD image processed via the application can lead to a stack overflow, overwriting arbitrary data. An attacker can deliver a PSD image to trigger this vulnerability and gain code execution.2018-08-01not yet calculatedCVE-2018-3921
MISC
computerinsel — photolineA memory corruption vulnerability exists in the ANI-parsing functionality of Computerinsel Photoline 20.54. A specially crafted ANI image processed via the application can lead to a stack overflow, overwriting arbitrary data. An attacker can deliver an ANI image to trigger this vulnerability and gain code execution.2018-08-01not yet calculatedCVE-2018-3922
MISC
curl — curlThe function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.2018-08-01not yet calculatedCVE-2016-8619
BID
SECTRACK
CONFIRM
CONFIRM
CONFIRM
GENTOO
CONFIRM
curl — curlA flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.2018-08-01not yet calculatedCVE-2016-8616
BID
SECTRACK
CONFIRM
CONFIRM
CONFIRM
GENTOO
CONFIRM
curl — curlcurl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.2018-08-01not yet calculatedCVE-2016-8625
BID
SECTRACK
CONFIRM
CONFIRM
CONFIRM
GENTOO
CONFIRM
curl — curlA flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.2018-08-01not yet calculatedCVE-2016-8623
BID
SECTRACK
CONFIRM
CONFIRM
CONFIRM
GENTOO
CONFIRM
curl — curlThe `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short.2018-07-31not yet calculatedCVE-2016-8621
BID
SECTRACK
CONFIRM
CONFIRM
CONFIRM
GENTOO
CONFIRM
curl — curlThe base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`.2018-07-31not yet calculatedCVE-2016-8617
BID
SECTRACK
CONFIRM
CONFIRM
CONFIRM
GENTOO
CONFIRM
curl — curlThe libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables.2018-07-31not yet calculatedCVE-2016-8618
BID
SECTRACK
CONFIRM
CONFIRM
GENTOO
CONFIRM
curl — curlThe ‘globbing’ feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input.2018-08-01not yet calculatedCVE-2016-8620
BID
SECTRACK
CONFIRM
CONFIRM
GENTOO
CONFIRM
curl — curlcurl before version 7.51.0 doesn’t parse the authority component of the URL correctly when the host name part ends with a ‘#’ character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.2018-07-31not yet calculatedCVE-2016-8624
BID
SECTRACK
CONFIRM
MISC
GENTOO
CONFIRM
curl — curl
 
A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.2018-08-01not yet calculatedCVE-2016-8615
BID
SECTRACK
CONFIRM
CONFIRM
CONFIRM
GENTOO
CONFIRM

datalife_engine — datalife_engine

An issue was discovered in DataLife Engine (DLE) through 13.0. An attacker can use XSS (related to the /addnews.html and /index.php?do=addnews URIs) to send a malicious script to unsuspecting Admins or users.2018-08-01not yet calculatedCVE-2018-14777
MISC
davolink — dvw-3200nDavolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain the password for the device.2018-08-01not yet calculatedCVE-2018-10618
BID
MISC
EXPLOIT-DB

dell_emc — networker

Dell EMC NetWorker versions between 9.0 and 9.1.1.8 through 9.2.1.3, and the version 18.1.0.1 contain a Clear-Text authentication over network vulnerability in the Rabbit MQ Advanced Message Queuing Protocol (AMQP) component. User credentials are sent unencrypted to the remote AMQP service. An unauthenticated attacker in the same network collision domain, could potentially sniff the password from the network and use it to access the component using the privileges of the compromised user.2018-08-01not yet calculatedCVE-2018-11050
FULLDISC
SECTRACK
django — django
 
django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.2018-08-03not yet calculatedCVE-2018-14574
SECTRACK
UBUNTU
CONFIRM
dracut — dracut
 
A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when ‘early cpio’ is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.2018-08-01not yet calculatedCVE-2016-8637
MLIST
BID
CONFIRM
CONFIRM
ethereum — cryptogs
 
The endCoinFlip function and throwSlammer function of the smart contract implementations for Cryptogs, an Ethereum game, generate random numbers with an old block’s hash. Therefore, attackers can predict the random number and always win the game.2018-08-03not yet calculatedCVE-2018-14715
MISC

ethereum — suncontract_token

The mintToken function of a smart contract implementation for SunContract, an Ethereum token, has an integer overflow via the _amount variable.2018-08-03not yet calculatedCVE-2018-14576
FULLDISC
MISC
ezplayer — ezplayer
 
A vulnerability in uniview EZPlayer 1.0.6 could allow an attacker to execute arbitrary code on a targeted system via video playback.2018-08-03not yet calculatedCVE-2018-14923
MISC
f5 — big-ipWhen the F5 BIG-IP APM 13.0.0-13.1.1 or 12.1.0-12.1.3 renders certain pages (pages with a logon agent or a confirm box), the BIG-IP APM may disclose configuration information such as partition and agent names via URI parameters.2018-07-31not yet calculatedCVE-2018-5544
BID
SECTRACK
CONFIRM
f5 — big-ip
 
The F5 BIG-IP Controller for Kubernetes 1.0.0-1.5.0 (k8s-bigip-crtl) passes BIG-IP username and password as command line parameters, which may lead to disclosure of the credentials used by the container.2018-07-31not yet calculatedCVE-2018-5543
BID
CONFIRM

flif — flif

An issue was discovered in image_save_png in image/image-png.cpp in Free Lossless Image Format (FLIF) 0.3. Attackers can trigger a longjmp that leads to an uninitialized stack frame after a libpng error concerning the IHDR image width.2018-08-02not yet calculatedCVE-2018-14876
MISC

focalscope — focalscope

An exploitable unauthenticated XML external injection vulnerability was identified in FocalScope v2416. A unauthenticated attacker could submit a specially crafted web request to FocalScope’s server that could cause an XXE, and potentially result in data compromise.2018-08-01not yet calculatedCVE-2018-3881
MISC
foreman — foremanIt was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.2018-08-01not yet calculatedCVE-2016-8639
BID
REDHAT
CONFIRM
CONFIRM
CONFIRM
foreman — foreman
 
A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user’s browser. The output of the job is stored, making this a stored XSS vulnerability.2018-07-31not yet calculatedCVE-2016-8613
BID
CONFIRM
CONFIRM
CONFIRM
foreman — foreman
 
A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a user is linked directly to this URL.2018-08-01not yet calculatedCVE-2016-8634
BID
CONFIRM
CONFIRM
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the importTextData method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6030.2018-07-31not yet calculatedCVE-2018-14267
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the mailForm method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6031.2018-07-31not yet calculatedCVE-2018-14268
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeDataObject method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6033.2018-07-31not yet calculatedCVE-2018-14270
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6034.2018-07-31not yet calculatedCVE-2018-14271
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeIcon method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6035.2018-07-31not yet calculatedCVE-2018-14272
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getOCGs method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6019.2018-07-31not yet calculatedCVE-2018-14256
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getPageRotation method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6023.2018-07-31not yet calculatedCVE-2018-14260
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getPageNthWordQuads method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6022.2018-07-31not yet calculatedCVE-2018-14259
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the importDataObject method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6029.2018-07-31not yet calculatedCVE-2018-14266
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the scroll method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6037.2018-07-31not yet calculatedCVE-2018-14274
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of Line annotations. By manipulating a document’s elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6215.2018-07-31not yet calculatedCVE-2018-14299
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the spawnPageFromTemplate method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6038.2018-07-31not yet calculatedCVE-2018-14275
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of Polygon annotations. By manipulating a document’s elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6216.2018-07-31not yet calculatedCVE-2018-14300
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the mailDoc method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6059.2018-07-31not yet calculatedCVE-2018-14277
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the newDoc function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5773.2018-07-31not yet calculatedCVE-2018-14284
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getPageBox method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6020.2018-07-31not yet calculatedCVE-2018-14257
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of FreeText annotations. By manipulating a document’s elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6213.2018-07-31not yet calculatedCVE-2018-14297
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getField method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6015.2018-07-31not yet calculatedCVE-2018-14252
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getIcon method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6016.2018-07-31not yet calculatedCVE-2018-14253
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of Circle annotations. By manipulating a document’s elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6212.2018-07-31not yet calculatedCVE-2018-14296
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF documents. By manipulating a document’s elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6231.2018-07-31not yet calculatedCVE-2018-14291
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getAnnot method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6013.2018-07-31not yet calculatedCVE-2018-14250
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-5873.2018-07-31not yet calculatedCVE-2018-11622
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the importAnXFDX method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6028.2018-07-31not yet calculatedCVE-2018-14265
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addAdLayer method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. The attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6003.2018-07-31not yet calculatedCVE-2018-11623
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getLinks method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6017.2018-07-31not yet calculatedCVE-2018-14254
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-5896.2018-07-31not yet calculatedCVE-2018-11621
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the importAnFDF method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6027.2018-07-31not yet calculatedCVE-2018-14264
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addField method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6005.2018-07-31not yet calculatedCVE-2018-14242
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.1.0.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF documents. By manipulating a document’s elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6233.2018-07-31not yet calculatedCVE-2018-14293
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of Link objects. By manipulating a document’s elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6267.2018-07-31not yet calculatedCVE-2018-14307
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-5756.2018-07-31not yet calculatedCVE-2018-11620
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Format events for ComboBox fields. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5415.2018-07-31not yet calculatedCVE-2018-11617
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getNthFieldName method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6018.2018-07-31not yet calculatedCVE-2018-14255
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the print method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6032.2018-07-31not yet calculatedCVE-2018-14269
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getPageNthWord method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6021.2018-07-31not yet calculatedCVE-2018-14258
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the setFocus method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5417.2018-07-31not yet calculatedCVE-2018-11619
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of Sound annotations. By manipulating a document’s elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6217.2018-07-31not yet calculatedCVE-2018-14301
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addAnnot method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6004.2018-07-31not yet calculatedCVE-2018-14241
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getDataObject method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6014.2018-07-31not yet calculatedCVE-2018-14251
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the calculateNow method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6007.2018-07-31not yet calculatedCVE-2018-14244
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the resetForm method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5416.2018-07-31not yet calculatedCVE-2018-11618
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of Ink annotations. By manipulating a document’s elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6214.2018-07-31not yet calculatedCVE-2018-14298
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getPageNumWords method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6058.2018-07-31not yet calculatedCVE-2018-14278
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of PDF documents. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6351.2018-07-31not yet calculatedCVE-2018-14316
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of PolyLine annotations. By manipulating a document’s elements an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6265.2018-07-31not yet calculatedCVE-2018-14305
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the valueAsString function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6326.2018-07-31not yet calculatedCVE-2018-14308
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the exportAsFDF function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6332.2018-07-31not yet calculatedCVE-2018-14312
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of button objects. By manipulating a document’s elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6266.2018-07-31not yet calculatedCVE-2018-14306
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.1.0.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of events. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6330.2018-07-31not yet calculatedCVE-2018-14310
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of Square annotations. By manipulating a document’s elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6218.2018-07-31not yet calculatedCVE-2018-14302
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of annotations. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6327.2018-07-31not yet calculatedCVE-2018-14314
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportData XFA function. The issue results from the lack of proper validation of user-supplied data, which can lead to writing arbitrary files into attacker controlled locations. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5757.2018-07-31not yet calculatedCVE-2018-14281
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6362.2018-07-31not yet calculatedCVE-2018-14313
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF Phantom PDF 9.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PDF documents. When parsing shading patterns, the process does not properly validate user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6223.2018-07-31not yet calculatedCVE-2018-14295
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getVersionID method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6026.2018-07-31not yet calculatedCVE-2018-14263
CONFIRM
MISC
foxit — pdf_readerAn exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader version 9.1.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.2018-08-01not yet calculatedCVE-2018-3924
SECTRACK
MISC
foxit — pdf_readerAn exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.2018-08-01not yet calculatedCVE-2018-3939
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of arguments passed to the mailDoc function. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5770.2018-07-31not yet calculatedCVE-2018-14286
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getTemplate method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6024.2018-07-31not yet calculatedCVE-2018-14261
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeTemplate method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6036.2018-07-31not yet calculatedCVE-2018-14273
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.1.0.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the SeedValue Generic Object parameter provided to the signatureSetSeedValue function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6329.2018-07-31not yet calculatedCVE-2018-14309
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of StrikeOut annotations. By manipulating a document’s elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6219.2018-07-31not yet calculatedCVE-2018-14303
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of annotations. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6328.2018-07-31not yet calculatedCVE-2018-14315
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of Text annotations. By manipulating a document’s elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6220.2018-07-31not yet calculatedCVE-2018-14304
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getURL method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6025.2018-07-31not yet calculatedCVE-2018-14262
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of FileAttachment annotations. By manipulating a document’s elements an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6211.2018-07-31not yet calculatedCVE-2018-14294
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportAsFDF method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6010.2018-07-31not yet calculatedCVE-2018-14247
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the submitForm method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6039.2018-07-31not yet calculatedCVE-2018-14276
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the highlightMode attribute. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5771.2018-07-31not yet calculatedCVE-2018-14283
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF documents. By manipulating a document’s elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6232.2018-07-31not yet calculatedCVE-2018-14292
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportAsFDF XFA function. The issue results from the lack of proper validation of user-supplied data, which can lead to writing arbitrary files into attacker controlled locations. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5619.2018-07-31not yet calculatedCVE-2018-14280
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the resetForm method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6060.2018-07-31not yet calculatedCVE-2018-14279
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the convertTocPDF method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. The attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6009.2018-07-31not yet calculatedCVE-2018-14246
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the closeDoc method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. The attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6008.2018-07-31not yet calculatedCVE-2018-14245
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of arguments passed to the setFocus function. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5642.2018-07-31not yet calculatedCVE-2018-14288
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of FlateDecode streams. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5763.2018-07-31not yet calculatedCVE-2018-14282
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of arguments passed to the instanceManager.nodes.append function. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5641.2018-07-31not yet calculatedCVE-2018-14287
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the oneOfChild attribute. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5774.2018-07-31not yet calculatedCVE-2018-14285
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF documents. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-6221.2018-07-31not yet calculatedCVE-2018-14289
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportDataObject method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6012.2018-07-31not yet calculatedCVE-2018-14249
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addPageOpenJSMessage method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. The attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6006.2018-07-31not yet calculatedCVE-2018-14243
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA events. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6331.2018-07-31not yet calculatedCVE-2018-14311
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF documents. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6222.2018-07-31not yet calculatedCVE-2018-14290
CONFIRM
MISC
foxit — pdf_readerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportAsXFDF method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6011.2018-07-31not yet calculatedCVE-2018-14248
CONFIRM
MISC
geopython — pycsw
 
A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to.2018-08-01not yet calculatedCVE-2016-8640
MLIST
BID
CONFIRM
CONFIRM
gitlab — community_edition_and_enterprise_editionAn issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6. The usage of ‘url_for’ contained a XSS issue due to it allowing arbitrary protocols as a parameter.2018-08-03not yet calculatedCVE-2018-12605
CONFIRM
CONFIRM
gitlab — community_edition_and_enterprise_editionAn issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The charts feature contained a persistent XSS issue due to a lack of output encoding.2018-08-03not yet calculatedCVE-2018-12607
CONFIRM
CONFIRM
gitlab — community_edition_and_enterprise_editionAn issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature.2018-08-03not yet calculatedCVE-2018-12606
CONFIRM
CONFIRM
huawei — mate_10_smart_phonesHUAWEI Mate 10 smartphones with versions earlier than ALP-AL00 8.1.0.311 have a use after free vulnerability on mediaserver component. An attacker tricks the user install a malicious application, which make the software to reference memory after it has been freed. Successful exploit could cause execution of arbitrary code.2018-07-31not yet calculatedCVE-2018-7993
CONFIRM
huawei — multiple_productsMdapt Driver of Huawei MediaPad M3 BTV-W09C128B353CUSTC128D001; Mate 9 Pro versions earlier than 8.0.0.356(C00); P10 Plus versions earlier than 8.0.0.357(C00) has a buffer overflow vulnerability. The driver does not sufficiently validate the input, an attacker could trick the user to install a malicious application which would send crafted parameters to the driver. Successful exploit could cause a denial of service condition.2018-07-31not yet calculatedCVE-2018-7992
CONFIRM
huawei — multiple_productsSome Huawei products IPS Module V500R001C50; NGFW Module V500R001C50; V500R002C10; NIP6300 V500R001C50; NIP6600 V500R001C50; NIP6800 V500R001C50; Secospace USG6600 V500R001C50; USG9500 V500R001C50 have a memory leak vulnerability. The software does not release allocated memory properly when processing Protal questionnaire. A remote attacker could send a lot questionnaires to the device, successful exploit could cause the device to reboot since running out of memory.2018-07-31not yet calculatedCVE-2018-7994
CONFIRM
huawei — multiple_products
 
Some Huawei products RSE6500 V500R002C00; SoftCo V200R003C20SPCb00; VP9660 V600R006C10; eSpace U1981 V100R001C20; V200R003C20; V200R003C30; V200R003C50 have a weak algorithm vulnerability. To exploit the vulnerability, a remote, unauthenticated attacker has to capture TLS traffic between clients and the affected products. The attacker may launch the Bleichenbacher attack on RSA key exchange to decrypt the session key and the previously captured sessions by some cryptanalytic operations. Successful exploit may cause information leak.2018-07-31not yet calculatedCVE-2017-17174
CONFIRM
huawei — multiple_smart_phonesHuawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication bypass vulnerability. An attacker could trick the user to connect to a malicious device. In the debug mode, the malicious software in the device may exploit the vulnerability to bypass some specific function. Successful exploit may cause some malicious applications to be installed in the mobile phones.2018-07-31not yet calculatedCVE-2018-7947
CONFIRM
huawei — multiple_smart_phonesHuawei smartphones with software Victoria-AL00 8.0.0.336a(C00) have an information leakage vulnerability. Because an interface does not verify authorization correctly, attackers can exploit an application with the authorization of phone state to obtain user location additionally.2018-07-31not yet calculatedCVE-2018-7957
CONFIRM
huawei — multiple_smart_phones
 
Some Huawei mobile phone with the versions before BLA-L29 8.0.0.145(C432) have a denial of service (DoS) vulnerability because they do not adapt to specific screen gestures. An attacker may trick users into installing a malicious app. As a result, apps running on the frontend crash after the users make specific screen gestures.2018-07-31not yet calculatedCVE-2018-7934
CONFIRM

ibm — api_connect_developer_portal

IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication (TFA) while resetting a user password but enforces it for all other login scenarios. IBM X-Force ID: 144483.2018-07-31not yet calculatedCVE-2018-1638
XF
CONFIRM
ibm — maximo_asset_managementIBM Maximo Asset Management 7.6 through 7.6.3 installs with a default administator account that a remote intruder could use to gain administrator access to the system. This vulnerability is due to an incomplete fix for CVE-2015-4966. IBM X-Force ID: 142116.2018-08-03not yet calculatedCVE-2018-1524
XF
CONFIRM
ibm — maximo_asset_managementIBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 142891.2018-08-02not yet calculatedCVE-2018-1554
XF
CONFIRM
ibm — spectrum_symphony_and_platform_symphonyIBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user supplied input. IBM X-Force ID: 143622.2018-08-01not yet calculatedCVE-2018-1595
BID
XF
CONFIRM
ibm — sterling_b2b_integratorIBM Sterling B2B Integrator Standard Edition 5.2.0.1 – 5.2.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 147166.2018-07-31not yet calculatedCVE-2018-1718
BID
XF
CONFIRM
idreamsoft — icmsAn SSRF vulnerability was discovered in idreamsoft iCMS before V7.0.11 because the remote function in app/spider/spider_tools.class.php does not block private and reserved IP addresses such as 10.0.0.0/8. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-14514.2018-08-02not yet calculatedCVE-2018-14858
MISC
insteon — hubAn attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c224 the value for the s_vol_play key is copied using strcpy to the buffer at 0xa0000418. This buffer is maximum 8 bytes large (this is the maximum size it could be, it is possible other global variables are stored between this variable and the next one that we could identify), sending anything longer will cause a buffer overflow.2018-08-02not yet calculatedCVE-2017-16341
MISC
insteon — hubAn attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01e7d4 the value for the s_vol key is copied using strcpy to the buffer at 0xa0001700. This buffer is maximum 12 bytes large (this is the maximum size it could be, it is possible other global variables are stored between this variable and the next one that we could identify), sending anything longer will cause a buffer overflow.2018-08-02not yet calculatedCVE-2017-16347
MISC
insteon — hubAn attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c2c8 the value for the s_url key is copied using strcpy to the buffer at 0xa0001a0c. This buffer is 16 bytes large, sending anything longer will cause a buffer overflow. The destination can also be shifted by using an sn_speaker parameter between “0” and “3”.2018-08-02not yet calculatedCVE-2017-16344
MISC
insteon — hubAn exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation unsafely extracts parameters from the query string, leading to a buffer overflow on the stack. An attacker can send an HTTP GET request to trigger this vulnerability.2018-08-02not yet calculatedCVE-2017-14446
MISC
insteon — hubAn attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c284 the value for the s_vol_brt_delta key is copied using strcpy to the buffer at 0xa0000510. This buffer is 4 bytes large, sending anything longer will cause a buffer overflow.2018-08-02not yet calculatedCVE-2017-16343
MISC
insteon — hubAn exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the host parameter during a firmware update request, leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to trigger this vulnerability.2018-08-02not yet calculatedCVE-2017-14445
MISC
insteon — hubAn exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the URL parameter during a firmware update request, leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to trigger this vulnerability.2018-08-02not yet calculatedCVE-2017-14444
MISC
insteon — hubAn attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c368 the value for the s_mac key is copied using strcpy to the buffer at 0xa000170c. This buffer is 25 bytes large, sending anything longer will cause a buffer overflow. The destination can also be shifted by using an sn_speaker parameter between “0” and “3”.2018-08-02not yet calculatedCVE-2017-16346
MISC
insteon — hubAn attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c318 the value for the s_port key is copied using strcpy to the buffer at 0xa00017f4. This buffer is 6 bytes large, sending anything longer will cause a buffer overflow. The destination can also be shifted by using an sn_speaker parameter between “0” and “3”.2018-08-02not yet calculatedCVE-2017-16345
MISC
insteon — hubAn attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01bb1c the value for the uri key is copied using strcpy to the buffer at 0xa00016a0. This buffer is 64 bytes large, sending anything longer will cause a buffer overflow.2018-08-02not yet calculatedCVE-2017-16339
MISC
insteon — hubAn attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c254 the value for the s_vol_dim_delta key is copied using strcpy to the buffer at 0xa0000514. This buffer is 4 bytes large, sending anything longer will cause a buffer overflow.2018-08-02not yet calculatedCVE-2017-16342
MISC
insteon — hubAn exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn’t check the kind of firmware image that is going to be installed and thus allows for flashing any signed firmware into any MCU. Since the device contains different and incompatible MCUs, flashing one firmware to the wrong MCU will result in a permanent brick condition. To trigger this vulnerability, an attacker needs to impersonate the remote server “cache.insteon.com” and serve a signed firmware image.2018-08-02not yet calculatedCVE-2018-3834
MISC
insteon — hubAn attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c0e8 the value for the s_dport key is copied using strcpy to the buffer at 0xa000180c. This buffer is 6 bytes large, sending anything longer will cause a buffer overflow.2018-08-02not yet calculatedCVE-2017-16340
MISC
insteon — hubAn attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01bad0 the value for the host key is copied using strcpy to the buffer at 0xa00016e0. This buffer is 32 bytes large, sending anything longer will cause a buffer overflow.2018-08-02not yet calculatedCVE-2017-16338
MISC
intel — distribution_for_pythonInsufficient Input Validation in Bleach module in INTEL Distribution for Python versions prior to IDP 2018 Update 2 allows unprivileged user to bypass URI sanitization via local vector.2018-08-01not yet calculatedCVE-2018-3650
CONFIRM

intel — graphics_driver_for_windows

Out-of-bounds read condition in older versions of some Intel Graphics Driver for Windows code branches allows local users to perform a denial of service attack.2018-08-01not yet calculatedCVE-2017-5692
BID
CONFIRM
intel — pumaFirmware in the Intel Puma 5, 6, and 7 Series might experience resource depletion or timeout, which allows a network attacker to create a denial of service via crafted network traffic.2018-07-31not yet calculatedCVE-2017-5693
BID
CONFIRM

intel — saffron

Escalation of privilege in Intel Saffron admin application before 11.4 allows an authenticated user to access unauthorized information.2018-08-01not yet calculatedCVE-2018-3671
CONFIRM
intel — saffron_memorybaseEscalation of privilege in Intel Saffron MemoryBase before 11.4 allows an authenticated user access to privileged information.2018-08-01not yet calculatedCVE-2018-3663
CONFIRM
intel — saffron_memorybaseEscalation of privilege in Intel Saffron MemoryBase before version 11.4 potentially allows an authorized user of the Saffron application to execute arbitrary code as root.2018-08-01not yet calculatedCVE-2018-3662
CONFIRM

intel — smart_sound_technology

Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as administrator via a buffer overflow.2018-08-01not yet calculatedCVE-2018-3670
CONFIRM

intel — smart_sound_technology

Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as administrator via a non-paged pool overflow.2018-08-01not yet calculatedCVE-2018-3666
CONFIRM

intel — smart_sound_technology

Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as administrator via a system calls.2018-08-01not yet calculatedCVE-2018-3672
CONFIRM

inteno — iopsys

read_tmp and write_tmp in Inteno IOPSYS allow attackers to gain privileges after writing to /tmp/etc/smb.conf because /var is a symlink to /tmp.2018-07-31not yet calculatedCVE-2018-14533
MISC
EXPLOIT-DB

intuit — lacerte_2017_for_windows

Intuit Lacerte 2017 for Windows in a client/server environment transfers the entire customer list in cleartext over SMB, which allows attackers to (1) obtain sensitive information by sniffing the network or (2) conduct man-in-the-middle (MITM) attacks via unspecified vectors. The customer list contains each customer’s full name, social security number (SSN), address, job title, phone number, Email address, spouse’s phone/Email address, and other sensitive information. After the client software authenticates to the server database, the server sends the customer list. There is no need for further exploitation as all sensitive data is exposed. This vulnerability was validated on Intuit Lacerte 2017, however older versions of Lacerte may be vulnerable.2018-07-31not yet calculatedCVE-2018-11338
MISC
jasper — jasper
 
A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.2018-08-01not yet calculatedCVE-2016-8654
BID
REDHAT
CONFIRM
CONFIRM
CONFIRM
CONFIRM
DEBIAN
jasper — jasper
 
An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.2018-08-01not yet calculatedCVE-2016-9583
BID
REDHAT
CONFIRM
CONFIRM
CONFIRM
jenkins — jenkinsAn exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.2018-08-01not yet calculatedCVE-2018-1999040
CONFIRM
jenkins — jenkinsAn exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH private key password to users with permission to read the build log.2018-08-01not yet calculatedCVE-2018-1999036
CONFIRM
jenkins — jenkinsAn exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.2018-08-01not yet calculatedCVE-2018-1999027
CONFIRM
jenkins — jenkinsAn exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.2018-08-01not yet calculatedCVE-2018-1999028
CONFIRM
jenkins — jenkinsAn exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attackers with file system access to the Jenkins master to obtain the API secret key stored in this plugin’s configuration.2018-08-01not yet calculatedCVE-2018-1999041
CONFIRM
jenkins — jenkinsA data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop tracking a resource.2018-08-01not yet calculatedCVE-2018-1999037
CONFIRM
jenkins — jenkinsA server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows attackers to have Jenkins send HTTP requests to an attacker-specified host.2018-08-01not yet calculatedCVE-2018-1999026
CONFIRM
jenkins — jenkinsA man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfiguration.java that allows attackers to impersonate any service that Jenkins connects to.2018-08-01not yet calculatedCVE-2018-1999034
CONFIRM
jenkins — jenkinsAn exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilder.java that allows attackers with Item/ExtendedRead permission or file system access to the Jenkins master to obtain the password stored in this plugin’s configuration.2018-08-01not yet calculatedCVE-2018-1999033
CONFIRM
jenkins — jenkinsAn exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that allows attackers with file system access to the Jenkins master to obtain the API key stored in this plugin’s configuration.2018-08-01not yet calculatedCVE-2018-1999031
CONFIRM
jenkins — jenkinsA data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin’s configuration by sending crafted HTTP requests to an unprotected endpoint.2018-08-01not yet calculatedCVE-2018-1999032
CONFIRM
jenkins — jenkinsA man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMasterApi.java that allows attackers to impersonate any service that Jenkins connects to.2018-08-01not yet calculatedCVE-2018-1999035
CONFIRM
jenkins — jenkinsA server-side request forgery vulnerability exists in Jenkins Confluence Publisher Plugin 2.0.1 and earlier in ConfluenceSite.java that allows attackers to have Jenkins submit login requests to an attacker-specified Confluence server URL with attacker specified credentials.2018-08-01not yet calculatedCVE-2018-1999039
CONFIRM
jenkins — jenkins
 
A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjectsAction/index.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user’s browser when that other user performs some UI actions.2018-08-01not yet calculatedCVE-2018-1999029
CONFIRM
jenkins — jenkins
 
A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java that allows attackers to impersonate any service that Jenkins connects to.2018-08-01not yet calculatedCVE-2018-1999025
CONFIRM
jenkins — jenkins
 
A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials.2018-08-01not yet calculatedCVE-2018-1999038
CONFIRM
jenkins — jenkins
 
An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in ArtifactoryChoiceListProvider.java, NexusChoiceListProvider.java, Nexus3ChoiceListProvider.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.2018-08-01not yet calculatedCVE-2018-1999030
CONFIRM
jetbrains — intellij_ideaIntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit the vulnerability by implementing malicious code on both Androidmanifest.xml.2018-08-03not yet calculatedCVE-2017-8316
CONFIRM
MISC
MISC
johnson_controls — metasys_and_bcproIn Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information.2018-08-01not yet calculatedCVE-2018-10624
BID
MISC
kamailio — kamailio
 
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double “To” header and an empty “To” tag causes a segmentation fault and crash. The reason is missing input validation in the “build_res_buf_from_sip_req” core function. This could result in denial of service and potentially the execution of arbitrary code.2018-07-31not yet calculatedCVE-2018-14767
MISC
keycloak — keycloak
 
It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.2018-08-01not yet calculatedCVE-2018-10894
CONFIRM
keycloak — keycloak
 
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user’s session. This could lead to information disclosure, or permit further possible attacks.2018-08-01not yet calculatedCVE-2016-8609
REDHAT
BID
SECTRACK
CONFIRM
knot_resolver — knot_resolver
 
Improper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison cache.2018-08-02not yet calculatedCVE-2018-10920
CONFIRM
CONFIRM
lenovo — xclarity_administratorIn Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and potentially decrypt those credentials more easily than intended.2018-07-30not yet calculatedCVE-2018-9065
CONFIRM
lenovo — xclarity_administratorIn Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credentials for the System Manager user.2018-07-30not yet calculatedCVE-2018-9064
CONFIRM
lenovo — xclarity_administratorIn Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional parameters into a specific web API call which can result in privileged command execution within LXCA’s underlying operating system.2018-07-30not yet calculatedCVE-2018-9066
CONFIRM
lftp — lftp
 
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim’s system.2018-08-01not yet calculatedCVE-2018-10916
CONFIRM
CONFIRM
CONFIRM
libcurl — libcurlThe URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.2018-07-31not yet calculatedCVE-2016-8622
BID
SECTRACK
CONFIRM
CONFIRM
GENTOO
CONFIRM
libmspack — libmspackAn issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash).2018-07-28not yet calculatedCVE-2018-14679
MISC
SECTRACK
MISC
MISC
UBUNTU
UBUNTU
DEBIAN
libmspack — libmspackAn issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression.2018-07-28not yet calculatedCVE-2018-14682
MISC
SECTRACK
MISC
MISC
UBUNTU
UBUNTU
DEBIAN
libmspack — libmspackAn issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.2018-07-28not yet calculatedCVE-2018-14681
MISC
SECTRACK
MISC
MISC
UBUNTU
UBUNTU
DEBIAN
libmspack — libmspack
 
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.2018-07-28not yet calculatedCVE-2018-14680
MISC
SECTRACK
MISC
MISC
UBUNTU
UBUNTU
DEBIAN
libxcursor — libxcursor
 
_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.2018-08-01not yet calculatedCVE-2015-9262
MISC
MISC
libxdmcp — libxdmcp
 
It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users’ sessions.2018-07-27not yet calculatedCVE-2017-2625
BID
SECTRACK
REDHAT
CONFIRM
CONFIRM
GENTOO
MISC
linux — linux_kernelAn issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference in fscrypt_do_page_crypto() in fs/crypto/crypto.c when operating on a file in a corrupted f2fs image.2018-07-27not yet calculatedCVE-2018-14616
BID
MISC
linux — linux_kernelA flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB) being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate their privileges inside the guest. Linux guests are not affected by this.2018-07-30not yet calculatedCVE-2017-7518
MLIST
BID
SECTRACK
CONFIRM
REDHAT
REDHAT
CONFIRM
UBUNTU
UBUNTU
DEBIAN
MLIST
linux — linus_kernelA flaw was found in the Linux kernel’s ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.2018-07-30not yet calculatedCVE-2018-10883
CONFIRM
CONFIRM
CONFIRM
MLIST
linux — linus_kernelAn issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in btrfs_root_node() when mounting a crafted btrfs image, because of a lack of chunk block group mapping validation in btrfs_read_block_groups in fs/btrfs/extent-tree.c, and a lack of empty-tree checks in check_leaf in fs/btrfs/tree-checker.c.2018-07-27not yet calculatedCVE-2018-14612
BID
MISC
MISC
MISC
linux — linus_kernelAn issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in io_ctl_map_page() when mounting and operating a crafted btrfs image, because of a lack of block group item validation in check_leaf_item in fs/btrfs/tree-checker.c.2018-07-27not yet calculatedCVE-2018-14613
BID
MISC
MISC
linux — linus_kernelAn issue was discovered in the Linux kernel through 4.17.10. There is a buffer overflow in truncate_inline_inode() in fs/f2fs/inline.c when umounting an f2fs image, because a length value may be negative.2018-07-27not yet calculatedCVE-2018-14615
BID
MISC
linux — linus_kerneldrivers/infiniband/core/ucma.c in the Linux kernel through 4.17.11 allows ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allows attackers to cause a denial of service (use-after-free).2018-07-29not yet calculatedCVE-2018-14734
MISC
MISC
linux — linus_kernelAn issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges.2018-07-28not yet calculatedCVE-2018-14678
BID
SECTRACK
MISC
linux — linus_kernelIn the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation.2018-07-30not yet calculatedCVE-2017-7482
MLIST
BID
SECTRACK
CONFIRM
CONFIRM
DEBIAN
DEBIAN
linux — linus_kernelAn issue was discovered in the Linux kernel through 4.17.10. There is an out-of-bounds access in __remove_dirty_segment() in fs/f2fs/segment.c when mounting an f2fs image.2018-07-27not yet calculatedCVE-2018-14614
BID
MISC
linux — linus_kernelAn issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in __del_reloc_root() in fs/btrfs/relocation.c when mounting a crafted btrfs image, related to removing reloc rb_trees when reloc control has not been initialized.2018-07-27not yet calculatedCVE-2018-14609
BID
MISC
MISC
linux — linus_kernelAn issue was discovered in the Linux kernel through 4.17.10. There is a use-after-free in try_merge_free_space() when mounting a crafted btrfs image, because of a lack of chunk type flag checks in btrfs_check_chunk_valid in fs/btrfs/volumes.c.2018-07-27not yet calculatedCVE-2018-14611
BID
MISC
MISC
linux — linus_kernelAn issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory.2018-07-27not yet calculatedCVE-2018-14617
BID
MISC
MISC
linux — linus_kernelAn issue was discovered in the Linux kernel through 4.17.10. There is out-of-bounds access in write_extent_buffer() when mounting and operating a crafted btrfs image, because of a lack of verification that each block group has a corresponding chunk at mount time, within btrfs_read_block_groups in fs/btrfs/extent-tree.c.2018-07-27not yet calculatedCVE-2018-14610
BID
MISC
MISC
mantisbt — mantisbt
 
An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted name (e.g., ‘foobar” onclick=”alert(1)’).2018-08-03not yet calculatedCVE-2018-14504
CONFIRM
CONFIRM
CONFIRM
mantisbt — mantisbt
 
A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO.2018-08-03not yet calculatedCVE-2018-13055
CONFIRM
CONFIRM
CONFIRM
martem — telem-gw6_and_gwm_devicesMartem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior do not perform authentication of IEC-104 control commands, which may allow a rogue node a remote control of the industrial process.2018-07-31not yet calculatedCVE-2018-10603
BID
MISC
martem — telem-gw6_and_gwm_devicesMartem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow the creation of new connections to one or more IOAs, without closing them properly, which may cause a denial of service within the industrial process control channel.2018-07-31not yet calculatedCVE-2018-10607
CONFIRM
BID
MISC
martem — telem-gw6_and_gwm_devicesMartem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow improper sanitization of data over a Websocket which may allow cross-site scripting and client-side code execution with target user privileges.2018-07-31not yet calculatedCVE-2018-10609
CONFIRM
BID
MISC
matera_systems — bancoMatera Banco 1.0.0 is vulnerable to path traversal (allowing access to system files outside the default application folder) via the /contingency/servlet/ServletFileDownload file parameter, related to /contingency/web/receiptQuery/receiptDisplay.jsp.2018-08-03not yet calculatedCVE-2018-14927
MISC
matera_systems — bancoMatera Banco 1.0.0 is vulnerable to multiple reflected XSS, as demonstrated by the /contingency/web/index.jsp (aka home page) url parameter.2018-08-03not yet calculatedCVE-2018-14929
MISC
matera_systems — bancoMatera Banco 1.0.0 allows CSRF, as demonstrated by a /contingency/web/messageSend/messageSendHandler.jsp request.2018-08-03not yet calculatedCVE-2018-14926
MISC
matera_systems — bancoMatera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf “Nome Completo” (aka user fullname) field.2018-08-03not yet calculatedCVE-2018-14924
MISC
matera_systems — bancoMatera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of net.sf.acegisecurity components.2018-08-03not yet calculatedCVE-2018-14925
MISC
matera_systems — banco/contingency/servlet/ServletFileDownload executes as root and provides unauthenticated access to files via the file parameter.2018-08-03not yet calculatedCVE-2018-14928
MISC

metascrapper — metascrapper

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the `metascrape` npm module <= 3.9.2.2018-07-30not yet calculatedCVE-2018-3773
MISC
micro_focus — groupwiseA vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attacker authenticated as an administrator to upload files to an arbitrary path on the server. In certain circumstances this could result in remote code execution.2018-08-01not yet calculatedCVE-2018-12468
CONFIRM
mikrotik — routerosWinbox for MikroTik RouterOS through 6.42 allows remote attackers to bypass authentication and read arbitrary files by modifying a request to change one byte related to a Session ID.2018-08-02not yet calculatedCVE-2018-14847
MISC
MISC
MISC
monitorix — monitorix
 
Monitorix before 3.10.1 allows XSS via CGI variables.2018-08-02not yet calculatedCVE-2018-7649
CONFIRM
mozilla — network_security_servicesIt was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group.2018-08-01not yet calculatedCVE-2016-8635
REDHAT
BID
CONFIRM
GENTOO
my_little_forum — my_little_forumThe Add page option in my little forum 2.4.12 allows XSS via the Title field.2018-08-04not yet calculatedCVE-2018-14936
MISC
my_little_forum — my_little_forumThe Add page option in my little forum 2.4.12 allows XSS via the Menu Link field.2018-08-04not yet calculatedCVE-2018-14937
MISC
nagios — nagios
 
A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It’s possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.2018-08-01not yet calculatedCVE-2016-8641
BID
CONFIRM
CONFIRM
GENTOO
EXPLOIT-DB

naver — whale_browser

Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser’s address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name.2018-08-02not yet calculatedCVE-2018-12448
MISC

netapp — 7-mode_transition_tool

NetApp 7-Mode Transition Tool allows users with valid credentials to access functions and information which may have been intended to be restricted to administrators or privileged users. 7MTT versions below 2.0 do not enforce user authorization rules on file information and status that it has previously collected. The released version of 7MTT has been updated to maintain and verify authorization rules for file information, status and utilities.2018-08-03not yet calculatedCVE-2018-5489
CONFIRM
netapp — oncommand_insightNetApp OnCommand Insight version 7.3.0 and versions prior to 7.2.0 are susceptible to clickjacking attacks which could cause a user to perform an unintended action in the user interface.2018-07-31not yet calculatedCVE-2017-13652
CONFIRM
nuuo — nvrmini_devicesupgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.2018-08-04not yet calculatedCVE-2018-14933
EXPLOIT-DB

ocs — inventory

OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be exploited by an attacker sending a crafted HTTP request in order to exfiltrate information or cause a Denial of Service.2018-08-03not yet calculatedCVE-2018-14473
MISC
ocs — inventoryOCS Inventory 2.4.1 contains multiple SQL injections in the search engine. Authentication is needed in order to exploit the issues.2018-08-03not yet calculatedCVE-2018-12482
MISC
ocs — inventoryOCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. Specifically, this issue occurs because the content of the ipdiscover_analyser rzo GET parameter is concatenated to a string used in an exec() call in the PHP code. Authentication is needed in order to exploit this vulnerability.2018-08-03not yet calculatedCVE-2018-12483
MISC
open_ticket_request_system — open_ticket_request_systemAn issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x through 4.0.30. An attacker who is logged into OTRS as an agent may escalate their privileges by accessing a specially crafted URL.2018-08-03not yet calculatedCVE-2018-14593
CONFIRM
openbsd — openbsd
 
tss_alloc in sys/arch/i386/i386/gdt.c in OpenBSD 6.2 and 6.3 has a Local Denial of Service (system crash) due to incorrect I/O port access control on the i386 architecture.2018-08-01not yet calculatedCVE-2018-14775
MISC
MISC
MISC
MISC
openbuildservice — openbuildservice
 
Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.2018-08-01not yet calculatedCVE-2018-12467
CONFIRM
CONFIRM
openjpeg — openjpegAn infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.2018-08-01not yet calculatedCVE-2016-9581
BID
CONFIRM
CONFIRM
CONFIRM
GENTOO
openjpeg — openjpeg
 
A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images. Due to a logic error in the code responsible for decoding the input image, an application using openjpeg to process image data could crash when processing a crafted image.2018-08-01not yet calculatedCVE-2016-9572
CONFIRM
CONFIRM
CONFIRM
GENTOO
DEBIAN
openjpeg — openjpeg
 
An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.2018-08-01not yet calculatedCVE-2016-9580
BID
CONFIRM
CONFIRM
CONFIRM
GENTOO
openshift — enterprise
 
The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site.2018-07-31not yet calculatedCVE-2016-8631
BID
REDHAT
CONFIRM
openstack — glance
 
A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method for authenticated users, resulting in possible denial of service attacks through database table saturation.2018-07-31not yet calculatedCVE-2016-8611
MLIST
BID
SECTRACK
CONFIRM
CONFIRM
openstack — keystoneIn the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated “GET /v3/OS-FEDERATION/projects” request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.2018-07-31not yet calculatedCVE-2018-14432
MLIST
BID
opensuse — open-build-serviceopenSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.2018-08-01not yet calculatedCVE-2018-12466
BID
CONFIRM
CONFIRM
oracle — fusion_middlewareVulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builder). Supported versions that are affected are 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Fusion Middleware MapViewer. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Fusion Middleware MapViewer accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).2018-08-02not yet calculatedCVE-2018-3109
CONFIRM
BID
SECTRACK

oracle — fusion_middleware

Vulnerability in the Oracle Fusion Middleware component of Oracle Fusion Middleware (subcomponent: Oracle Nofication Service). Supported versions that are affected are 12.2.1.2 and 12.2.1.3. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Fusion Middleware. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Fusion Middleware accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).2018-08-02not yet calculatedCVE-2018-3108
CONFIRM
BID
SECTRACK

oracle — weblogic_server

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. Note: Please refer to MOS document2018-08-02not yet calculatedCVE-2018-2933
CONFIRM
BID
SECTRACK
paypal — invoice-sdk-phppaypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter, resulting in code execution.2018-08-02not yet calculatedCVE-2017-6213
CONFIRM
paypal — permissions-sdk-phppaypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification_code parameter, resulting in code execution.2018-08-02not yet calculatedCVE-2017-6215
CONFIRM
pearson — vue_certiport_console_and_iqsystemThe report-viewing feature in Pearson VUE Certiport Console 8 and IQSystem 7 before 2018-06-26 mishandles child processes and consequently launches Internet Explorer or Microsoft Edge as Administrator, which allows local users to gain privileges.2018-08-03not yet calculatedCVE-2018-12989
MISC
php — phpAn issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.2018-08-03not yet calculatedCVE-2018-14883
CONFIRM
CONFIRM
CONFIRM
php — phpPHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.2018-08-02not yet calculatedCVE-2017-9120
MISC
php — php
 
exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.2018-08-02not yet calculatedCVE-2018-14851
MISC
MISC
MISC
php — php
 
An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsing an HTTP response leads to a segmentation fault because http_header_value in ext/standard/http_fopen_wrapper.c can be a NULL value that is mishandled in an atoi call.2018-08-03not yet calculatedCVE-2018-14884
CONFIRM
CONFIRM
php — php
 
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.2018-08-02not yet calculatedCVE-2017-9118
MISC

phpscriptsmall.com — basic_b2b_script

PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, State, and Company name fields.2018-08-03not yet calculatedCVE-2018-14541
MISC
EXPLOIT-DB
pleasant_solutions — pleasant_password_serverBecause of insufficient authorization checks it is possible for any authenticated user to change profile data of other users in Pleasant Password Server before 7.8.3.2018-07-31not yet calculatedCVE-2017-17708
MISC
pleasant_solutions — pleasant_password_serverDue to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in Pleasant Password Server before 7.8.3. To perform those actions on an entry, the user needs to know the corresponding “CredentialId” value, which uniquely identifies a password safe entry. Since “CredentialId” values are implemented as GUIDs, they are hard to guess. However, if for example an entry’s owner grants read-only access to a malicious user, the value gets exposed to the malicious user. The same holds true for temporary grants.2018-07-31not yet calculatedCVE-2017-17707
MISC
prosody — prosody
 
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same across stream restarts. A user may authenticate to XMPP host A and migrate their authenticated session to XMPP host B of the same Prosody instance.2018-07-30not yet calculatedCVE-2018-10847
CONFIRM
CONFIRM
CONFIRM
CONFIRM
DEBIAN

python-cryptography — cryptography_python_library

A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.2018-07-30not yet calculatedCVE-2018-10903
CONFIRM
CONFIRM
UBUNTU
red_hat — cephA flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request. Ceph branches 1.3.x and 2.x are affected.2018-08-01not yet calculatedCVE-2016-9579
REDHAT
REDHAT
REDHAT
REDHAT
CONFIRM
BID
CONFIRM
red_hat — cephA flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or specially crafted POST object requests.2018-07-31not yet calculatedCVE-2016-8626
REDHAT
REDHAT
REDHAT
REDHAT
CONFIRM
BID
CONFIRM
red_hat — enterprise_linux
 
It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas configuration files. The file is writable to jboss group (root:jboss, 664). On systems using classic /etc/init.d init scripts (i.e. on Red Hat Enterprise Linux 6 and earlier), the file is sourced by the jboss init script and its content executed with root privileges when jboss service is started, stopped, or restarted.2018-07-31not yet calculatedCVE-2016-8657
REDHAT
REDHAT
REDHAT
REDHAT
BID
REDHAT
CONFIRM
red_hat — jboss_brms_and_brms_suite_6
 
JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins.2018-08-01not yet calculatedCVE-2016-8608
REDHAT
REDHAT
BID
CONFIRM
red_hat — jboss_enterprise_application_platformAn out-of-bounds read vulnerability was found in OpenJPEG 2.1.2, in the j2k_to_image tool. Converting a specially crafted JPEG2000 file to another format could cause the application to crash or, potentially, disclose some data from the heap.2018-08-01not yet calculatedCVE-2016-9573
REDHAT
BID
CONFIRM
CONFIRM
CONFIRM
GENTOO
DEBIAN
red_hat — jboss_fuse_and_a-mqIt was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could use this flaw to launch a denial of service attack.2018-08-01not yet calculatedCVE-2016-8653
BID
CONFIRM
red_hat — openshift
 
An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image.2018-08-01not yet calculatedCVE-2016-8651
BID
REDHAT
CONFIRM
red_hat — openstack
 
A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials.2018-07-30not yet calculatedCVE-2018-10898
REDHAT
CONFIRM
red_hat — satellite
 
A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before version 5.8.0. A user able to specify a failed action could exploit this flaw to perform XSS attacks against other Satellite users.2018-07-30not yet calculatedCVE-2017-7514
REDHAT
CONFIRM
red_hat — jboss_core_servicesIt was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found in libxml2, making it vulnerable to a Denial of Service attack due to a Stack Overflow. This is a regression CVE for the same issue as CVE-2016-3705.2018-07-30not yet calculatedCVE-2016-9597
BID
CONFIRM
redgate — .net_reflector_and_smartassemblyRedgate .NET Reflector before 10.0.7.774 and SmartAssembly before 6.12.5 allow attackers to execute code by decompiling a compiled .NET object (such as a DLL or EXE file) with a specific embedded resource file.2018-07-31not yet calculatedCVE-2018-14581
CONFIRM
CONFIRM
rejucms — rejucms
 
rejucms 2.1 has stored XSS via the admin/book.php content parameter.2018-08-01not yet calculatedCVE-2018-14838
MISC

responsive_filemanager — responsive_filemanager

upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.2018-08-03not yet calculatedCVE-2018-14728
MISC
restforce — restforce
 
Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests.2018-08-03not yet calculatedCVE-2018-3777
CONFIRM
rincewind — rincewindAn issue was discovered in Rincewind 0.1. A reinstall vulnerability exists because the parameter p of index.php and another file named commonPages.php allows an attacker to reinstall the product, with all data reset.2018-08-02not yet calculatedCVE-2018-14872
MISC
rincewind — rincewind
 
An issue was discovered in Rincewind 0.1. There is a cross-site scripting (XSS) vulnerability involving a p=account request to index.php and another file named commonPages.php.2018-08-02not yet calculatedCVE-2018-14873
MISC
samba — samba
 
A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack.2018-07-27not yet calculatedCVE-2017-12151
BID
SECTRACK
REDHAT
REDHAT
CONFIRM
CONFIRM
CONFIRM
DEBIAN
CONFIRM
samsung — syncthru_web_serviceSamsung Syncthru Web Service V4.05.61 is vulnerable to Multiple unauthenticated XSS attacks on several parameters, as demonstrated by ruiFw_pid.2018-08-03not yet calculatedCVE-2018-14904
MISC
samsung — syncthru_web_serviceSamsung Syncthru Web Service V4.05.61 is vulnerable to CSRF on every request, as demonstrated by sws.application/printinformation/printReportSetupView.sws for a “Print emails sent” action.2018-08-03not yet calculatedCVE-2018-14908
MISC
sap — business_planning_and_consolidation_softwareAn exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HTTP requests to trigger this vulnerability.2018-08-02not yet calculatedCVE-2017-16349
MISC
seacms — seacms
 
SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address (aka ip) to /admin/admin_ip.php (aka /adm1n/admin_ip.php). The code is executed by visiting adm1n/admin_ip.php or data/admin/ip.php. This can also be exploited through CSRF.2018-08-03not yet calculatedCVE-2018-14910
MISC

seeddms — seeddms

Unrestricted file upload vulnerability in “op/op.UploadChunks.php” in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the “qqfile” parameter. This allows an authenticated attacker to upload a malicious file containing PHP code to execute operating system commands to the web root of the application.2018-07-31not yet calculatedCVE-2018-12940
CONFIRM
MISC
seeddms — seeddmsCross-Site Scripting (XSS) vulnerability in every page that includes the “action” URL parameter in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter.2018-07-31not yet calculatedCVE-2018-12943
CONFIRM
MISC

seeddms — seeddms

A directory traversal flaw in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows an authenticated attacker to write to (or potentially delete) arbitrary files via a .. (dot dot) in the “op/op.UploadChunks.php” “qquuid” parameter. NOTE: this can be leveraged to execute arbitrary code by using CVE-2018-12940.2018-07-31not yet calculatedCVE-2018-12939
CONFIRM
MISC
seeddms — seeddmsSQL injection vulnerability in the “Users management” functionality in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows authenticated attackers to manipulate an SQL query within the application by sending additional SQL commands to the application server. An attacker can use this vulnerability to perform malicious tasks such as to extract, change, or delete sensitive information within the database supporting the application, and potentially run system commands on the underlying operating system.2018-07-31not yet calculatedCVE-2018-12942
CONFIRM
MISC
seeddms — seeddmsPersistent Cross-Site Scripting (XSS) vulnerability in the “Categories” feature in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the name field.2018-07-31not yet calculatedCVE-2018-12944
CONFIRM
MISC

seeddms — seeddms

This vulnerability allows remote attackers to execute arbitrary code in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 by adding a system command at the end of the “cacheDir” path and following usage of the “Clear Cache” functionality. This allows an authenticated attacker, with permission to the Settings functionality, to inject arbitrary system commands within the application by manipulating the “Cache directory” path. An attacker can use it to perform malicious tasks such as to extract, change, or delete sensitive information or run system commands on the underlying operating system.2018-07-31not yet calculatedCVE-2018-12941
CONFIRM
MISC
servicenow — servicenowreport_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via ‘${xyz}’ Glide Scripting Injection in the sysparm_media parameter.2018-08-03not yet calculatedCVE-2018-7748
MISC
MISC

simsong — tcpflow

An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha. There is an integer overflow in the function handle_prism during caplen processing. If the caplen is less than 144, one can cause an integer overflow in the function handle_80211, which will result in an out-of-bounds read and may allow access to sensitive memory (or a denial of service).2018-08-04not yet calculatedCVE-2018-14938
MISC
MISC

softnas — cloud

A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv script did not sanitize the ‘recentVersion’ parameter from the snserv endpoint, allowing an unauthenticated attacker to execute arbitrary commands with root permissions.2018-08-03not yet calculatedCVE-2018-14417
FULLDISC
BID
CONFIRM
MISC
EXPLOIT-DB

sonicwall — global_management_system

A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management System (GMS) virtual appliance’s, allow remote user to execute arbitrary code. This vulnerability affected GMS version 8.1 and earlier.2018-08-03not yet calculatedCVE-2018-9866
MISC
CONFIRM
MISC
subrion — cmsuploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).2018-08-01not yet calculatedCVE-2018-14840
MISC
MISC
subrion — subrion_cmsSubrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas.2018-08-01not yet calculatedCVE-2018-14835
MISC
MISC
subrion — subrion
 
Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are able to access it (but not perform actions) if the Guests user group has access to the Admin panel.2018-08-01not yet calculatedCVE-2018-14836
MISC
symfony — symfonyAn issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it’s not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects SymfonyComponentHttpFoundationRequest::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.2018-08-03not yet calculatedCVE-2018-14773
BID
SECTRACK
CONFIRM
CONFIRM
CONFIRM
symfony — symfonyAn issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. When using HttpCache, the values of the X-Forwarded-Host headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.2018-08-03not yet calculatedCVE-2018-14774
CONFIRM
CONFIRM
synology — diskstation_manager
 
Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager (DSM) before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors.2018-07-30not yet calculatedCVE-2018-13280
CONFIRM

tenable — securitycenter

In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of username aliases via brute force, ultimately facilitating unauthorized access. Server response output has been unified to correct this issue.2018-08-02not yet calculatedCVE-2018-1154
CONFIRM

tenable — securitycenter

In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue.2018-08-02not yet calculatedCVE-2018-1155
CONFIRM

tenda — d152_adsl_routers

Tenda D152 ADSL routers allow XSS via a crafted SSID.2018-08-03not yet calculatedCVE-2018-14497
MISC
ttembed — ttembedAn input validation flaw exists in ttembed. With a crafted input file, an attacker may be able to trigger a denial of service condition due to ttembed trusting attacker controlled values.2018-08-02not yet calculatedCVE-2018-10922
CONFIRM
CONFIRM
ttembed — ttembed
 
Certain input files may trigger an integer overflow in ttembed input file processing. This overflow could potentially lead to corruption of the input file due to a lack of checking return codes of fgetc/fputc function calls.2018-08-02not yet calculatedCVE-2018-10921
CONFIRM
CONFIRM
ukcms — ukcms
 
A file upload vulnerability exists in ukcms v1.1.7 and earlier. The vulnerability is due to the system not strictly filtering the file upload type. An attacker can exploit the vulnerability to upload a script Trojan to admin.php/admin/configset/index/group/upload.html to gain server control by composing a request for a .txt upload and then changing it to a .php upload. The attacker must have admin access to change the upload_file_ext (aka “Allow upload file suffix”) setting, and must use “php,php” in this setting to bypass the “php” restriction.2018-08-03not yet calculatedCVE-2018-14911
MISC

universal_media_server — universal_media_server

In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running UMS, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.2018-08-03not yet calculatedCVE-2018-13416
FULLDISC
EXPLOIT-DB
vvo — node-whereisConcatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` module is deprecated and it is recommended to use the `which` npm module instead.2018-07-30not yet calculatedCVE-2018-3772
MISC
weaselcms — weaselcms
 
An issue was discovered in WeaselCMS v0.3.5. XSS exists via Site Language, Site Title, Site Description, and Site Keywords on the SETTINGS page.2018-08-02not yet calculatedCVE-2018-14877
MISC
xk72 — charles
 
Race condition in the Charles Proxy Settings suid binary in Charles Proxy before 4.2.1 allows local users to gain privileges via vectors involving the –self-repair option.2018-08-03not yet calculatedCVE-2017-15358
MISC
EXPLOIT-DB
xorg-x11-server — xorg-x11-server
 
It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.2018-07-27not yet calculatedCVE-2017-2624
BID
SECTRACK
CONFIRM
CONFIRM
MLIST
GENTOO
GENTOO
MISC
yokogawa — stardom_controllersYokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device, which could result in remote code execution.2018-07-31not yet calculatedCVE-2018-10592
BID
MISC
CONFIRM
yum-utils — yum-utils
 
A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.2018-08-01not yet calculatedCVE-2018-10897
REDHAT
REDHAT
CONFIRM
CONFIRM
CONFIRM
CONFIRM

Back to top


This product is provided subject to this Notification and this Privacy & Use policy.

This entry was posted in Alerts. Bookmark the permalink.