2 vulnerabilidades en Forcepoint Email Security
2 CVEs del mismo lote.
forcepoint/email_security
CVE · página 35 de 45
CVE-2018-16367
In OnlineJudge 2.0, the sandbox has an incorrect access control vulnerability that can write a file anywhere. A user can write a directory listing to /tmp, and can leak file data with a #include.
CVE-2018-16158
Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installations and do not properly restrict access to this key, which…
CVE-2018-15474
CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate sensitive data and to…
CVE-2018-14786
Becton, Dickinson and Company (BD) Alaris Plus medical syringe pumps (models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA) versions 2.3.6 and prior are affected by an improper authentication…
CVE-2018-14599
An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly…
6 vulnerabilidades en Canonical, Imagemagick
6 CVEs del mismo lote.
canonical/ubuntu_linuximagemagick/imagemagick
2 vulnerabilidades en Canonical, Debian, Mutt y otros
2 CVEs del mismo lote.
canonical/ubuntu_linuxdebian/debian_linuxmutt/muttneomutt/neomuttredhat/enterprise_linux_desktopredhat/enterprise_linux_server+2
CVE-2018-1426: IBM GSKit duplica estado PRNG en DB2 tras fork()
IBM GSKit en DB2 9.7-11.1 duplica el estado del generador aleatorio tras fork(), arriesgando IDs de sesión y claves duplicadas.
4 vulnerabilidades en Hdfgroup hdf5
4 CVEs del mismo lote.
hdfgroup/hdf5
CVE-2018-12889
An issue was discovered in CCN-lite 2.0.1. There is a heap-based buffer overflow in mkAddToRelayCacheRequest and in ccnl_populate_cache for an array lacking '\0' termination when reading a binary…
CVE-2018-13114
Missing authentication and improper input validation in KERUI Wifi Endoscope Camera (YPC99) allow an attacker to execute arbitrary commands (with a length limit of 19 characters) via the "ssid"…
CVE-2018-12932
PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by triggering a large…
3 vulnerabilidades en Adobe Digital Editions
3 CVEs del mismo lote.
adobe/digital_editions
CVE-2018-12578
There is a heap-based buffer overflow in bmp_compress1_row in appliers.cpp in sam2p 0.49.4 that leads to a denial of service or possibly unspecified other impact.
2 vulnerabilidades en Redhat Richfaces
2 CVEs del mismo lote · 1 con PoC público.
redhat/richfaces
CVE-2018-12327
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or…
CVE-2018-1207
Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code.
CVE-2018-11945
Improper input validation in wireless service messaging module for data received from broadcast messages can lead to heap overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer…
CVE-2018-11635
Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows…
CVE-2018-11652
CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV…
2 vulnerabilidades en md4c Project md4c
2 CVEs del mismo lote.
md4c_project/md4c
CVE-2018-11531
Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.
CVE-2018-11575
ngiflib.c in MiniUPnP ngiflib 0.4 has a stack-based buffer overflow in DecodeGifImg.
CVE-2018-11240
An issue was discovered on SoftCase T-Router build 20112017 devices. There are no restrictions on the 'exec command' feature of the T-Router protocol.
CVE-2018-11236
stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit…
CVE-2018-10992: Inyección de argumentos en LilyPond
Una vulnerabilidad crítica en LilyPond permite a atacantes remotos ejecutar ataques de inyección de argumentos mediante URLs manipuladas.
CVE-2018-10718
Stack-based buffer overflow in Activision Infinity Ward Call of Duty Modern Warfare 2 before 2018-04-26 allows remote attackers to execute arbitrary code via crafted packets.
2 vulnerabilidades en Cmsmadesimple CMS Made Simple
2 CVEs del mismo lote.
cmsmadesimple/cms_made_simple
CVE-2018-1000884
Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information Exposure Through Timing Discrepancy vulnerability in…
CVE-2018-1000641
YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.php that can result in execution of code, disclosure of…
CVE-2018-1000851
Copay Bitcoin Wallet version 5.01 to 5.1.0 included. contains a Other/Unknown vulnerability in wallet private key storage that can result in Users' private key can be compromised. .
CVE-2018-1000618
EOSIO/eos eos version after commit f1545dd0ae2b77580c2236fdb70ae7138d2c7168 contains a stack overflow vulnerability in abi_serializer that can result in attack eos network node.
CVE-2018-1000525: Inyección de Objetos PHP en openpsa
Una vulnerabilidad crítica de inyección de objetos PHP en openpsa permite la ejecución remota de código y la filtración de información mediante solicitudes GET manipuladas.
CVE-2018-1000140
rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution.
CVE-2018-1000116
NET-SNMP version 5.7.2 contains a heap corruption vulnerability in the UDP protocol handler that can result in command execution.
2 vulnerabilidades en Canonical, Haxx
2 CVEs del mismo lote.
canonical/ubuntu_linuxhaxx/curl
CVE-2018-1000059
ValidFormBuilder version 4.5.4 contains a PHP Object Injection vulnerability in Valid Form unserialize method that can result in Possible to execute unauthorised system commands remotely and disclose…
CVE-2018-0488
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap…
3 vulnerabilidades en Juniper Junos
3 CVEs del mismo lote.
juniper/junos
CVE-2017-2235
Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier. Toshiba Home gateway HEM-GW26A firmware HEM-GW26A-FW-V1.2.0 and earlier allows an attacker to bypass access restriction to…
CVE-2017-2277
WG-C10 v3.0.79 and earlier allows an attacker to bypass access restrictions to obtain or alter information stored in the external storage connected to the product via unspecified vectors.
CVE-2016-7951
Multiple integer overflows in X.org libXtst before 1.2.3 allow remote X servers to trigger out-of-bounds memory access operations by leveraging the lack of range checks.
CVE-2016-4837
SQL injection vulnerability in the Seed Coupon plugin before 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
2 vulnerabilidades en Redislabs Redis
2 CVEs del mismo lote.
redislabs/redis
CVE-2018-15439
A vulnerability in the Cisco Small Business Switches software could allow an unauthenticated, remote attacker to bypass the user authentication mechanism of an affected device.
3 vulnerabilidades en Advantech Webaccess
3 CVEs del mismo lote.
advantech/webaccess
CVE-2018-14667: Inyección de EL en RichFaces Framework
Vulnerabilidad crítica de ejecución remota de código en RichFaces Framework que permite a atacantes no autenticados tomar control del servidor.
2 vulnerabilidades en Fujielectric: V Server, V Server Firmware
2 CVEs del mismo lote.
fujielectric/v-serverfujielectric/v-server_firmware
CVE-2018-14818
WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior have a stack-based buffer overflow vulnerability which may allow remote code execution.