CVEs published in September 2018
1,223 vulnerabilities, 177 critical, 3 exploited.
- debian linux, linux kernel, canonical ubuntu linux +2 moreMemory leak in the irda_bind function in net/irda/af_irda.c and later in drivers/staging/irda/net...5.5 Medium
- gluster glusterfs, debian linux, opensuse leap +4 more +6 moreA flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink...8.8 High
- gluster glusterfs, debian linux, opensuse leap +2 more +4 moreA flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated...7.1 High
- gluster glusterfs, debian linux, opensuse leap +3 more +5 moreA flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An...8.1 High
- gluster glusterfsIt was discovered that fsync(2) system call in glusterfs client code leaks memory. An...5.3 Medium
- gluster glusterfs, debian linux, opensuse leap +2 more +4 moreIt was found that the "mknod" call derived from mknod(2) can create files pointing to devices on...7.6 High
- gluster glusterfs, debian linux, opensuse leap +2 more +4 moreIt was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster...5.5 Medium
- gluster glusterfs, debian linux, opensuse leap +2 more +4 moreAn information disclosure vulnerability was discovered in glusterfs server. An attacker could...3.5 Low
- gluster glusterfs, debian linux, opensuse leap +5 more +7 moreA flaw was found in the way dic_unserialize function of glusterfs does not handle negative key...6.5 Medium
- gluster glusterfs, debian linux, opensuse leap +2 more +4 moreIt was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to...8.8 High
- gluster glusterfs, debian linux, opensuse leap +2 more +4 moreIt was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats...8.8 High
- hibara attachecaseAttacheCase ver.3.3.0.0 and earlier allows an arbitrary script execution via unspecified vectors.7.8 High
- hibara attachecaseAttacheCase ver.2.8.4.0 and earlier allows an arbitrary script execution via unspecified vectors.7.8 High
- six apart ltd. movable typeCross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote...6.1 Medium
- nomachine, nomachine s.a r.l. app for android +1 moreA vulnerability in NoMachine App for Android 5.0.63 and earlier allows attackers to alter...9.8 Critical
- sony digital paper app, sony corporation the installer of digital paper app +1 moreUntrusted search path vulnerability in The installer of Digital Paper App version 1.4.0.16050 and...7.8 High
- pon software explzhDirectory traversal vulnerability in Explzh v.7.58 and earlier allows an attacker to read...7.8 High
- redhat wildfly, [unknown] jboss/wildfly +1 moreThe IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when...5.3 Medium
- baigo cmsAn issue was discovered in baigo CMS v2.1.1. There is an index.php?m=article&c=request CSRF that...6.5 Medium
- craftedweb project craftedwebCraftedWeb through 2013-09-24 has reflected XSS via the p parameter.6.1 Medium
- onethinkOneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a...6.5 Medium
- chshcms cscmsCscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip...8.8 High
- frogcms project frogcmsFrog CMS 0.9.5 has admin/?/user/edit/1 CSRF.8.8 High
- seamcms seacmsAn issue was discovered in SeaCMS through 6.61. adm1n/admin_database.php allows remote attackers...7.5 High
- seacmsAn issue was discovered in SeaCMS through 6.61. SQL injection exists via the tid parameter in an...9.8 Critical
- seacmsAn issue was discovered in SeaCMS 6.61. adm1n/admin_reslib.php has SSRF via the url parameter.9.1 Critical
- hdfgroup hdf5An issue was discovered in the HDF HDF5 1.8.20 library. There is an out of bounds read in...8.8 High
- bluecms project bluecmsBlueCMS 1.6 allows SQL Injection via the user_name parameter to uploads/user.php?act=index_login.9.8 Critical
- yfcmfadmin/admin/adminsave.html in YFCMF v3.0 allows CSRF to add an administrator account.8.8 High
- gnu libextractor, debian linux +1 moreGNU Libextractor through 1.7 has an out-of-bounds read vulnerability in...8.8 High
- opensc project openscVarious out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by...4.3 Medium
- opensc project openscEndless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc...4.3 Medium
- opensc project openscA double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc...6.6 Medium
- opensc project openscA double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in...6.6 Medium
- opensc project openscA double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c...6.6 Medium
- opensc project openscA single byte buffer overflow when handling responses from an esteid Card in...6.6 Medium
- opensc project openscSeveral buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID...6.6 Medium
- opensc project openscSeveral buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in...6.6 Medium
- opensc project openscSeveral buffer overflows when handling responses from a Cryptoflex card in read_public_key in...6.6 Medium
- opensc project openscA buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC...6.6 Medium
- mozilla network security services (nss), network security services +1 moreWhen handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random...5.9 Medium
- thedaylightstudio fuel cmsCross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows...8.8 High
- vanillaforums vanillaVanilla before 2.6.1 allows SQL injection via an invitationID array to /profile/deleteInvitation,...6.5 Medium
- gogsIn Gogs 0.11.53, an attacker can use migrate to send arbitrary HTTP GET requests, leading to SSRF.8.6 High
- d-link dir-846 firmwareD-Link DIR-846 devices with firmware 100.26 allow remote attackers to execute arbitrary code as...7.2 High
- mayan-edms mayan edmsModerate severity vulnerability that affects mayan-edms6.1 Medium
- mayan-edms mayan edmsModerate severity vulnerability that affects mayan-edms6.1 Medium
- mayan-edms mayan edmsmayan-edms Cross-site Scripting vulnerability6.1 Medium
- twistlock authz brokerIn Twistlock AuthZ Broker 0.1, regular expressions are mishandled, as demonstrated by containers...7.5 High
- limesurveyIn LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an...4.9 Medium
- Show moreLoading…