CVEs published in October 2018
1,469 vulnerabilities, 177 critical, 2 exploited.
- advantech webaccess Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp... 5.4 Medium
- advantech webaccess WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to... 6.5 Medium
- advantech webaccess WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to... 6.5 Medium
- [unknown] glusterfs, debian linux, redhat enterprise linux +2 more It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and... 8.8 High
- gluster glusterfs, debian linux, redhat enterprise linux server +3 more +5 more It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8... 6.5 Medium
- apache tomcat jk connector, apache software foundation tomcat connectors, debian linux +1 more +3 more The Apache Web Server (httpd) specific code that normalised the requested path before matching it... 7.5 High
- redhat gluster file system, debian linux, redhat enterprise linux server +3 more +5 more The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service... 6.5 Medium
- debian linux, redhat enterprise linux server, enterprise linux virtualization +4 more +6 more The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index'... 5.4 Medium
- debian linux, redhat enterprise linux server, enterprise linux virtualization +2 more +4 more The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer... 6.5 Medium
- debian linux, redhat enterprise linux server, enterprise linux virtualization +3 more +5 more The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the... 6.5 Medium
-
drupal/paragraphsPackagist The Paragraphs module allows Drupal Site Builders to make content organization cleaner so that you can give more editing power to end-users. The module doesn't sufficiently check access to create new… No score - nconsulting nc-cms nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload... 9.8 Critical
- jasper project jasper, canonical ubuntu linux, debian linux +2 more +4 more An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function... 5.5 Medium
- qnap systems inc. photo station Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7... 5.6 Medium
- synology diskstation manager (dsm), diskstation manager, skynas +1 more +3 more Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before... 4.3 Medium
-
drupal/decoupled_routerPackagist This module enables you to resolve the provided Drupal path in order to find the canonical path and information about the resolved entity. This information includes entity type ID, entity ID, entity U… No score - f5 enterprise manager, big-ip access policy manager, big-ip advanced firewall manager +12 more +14 more In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1 or Enterprise Manager 3.1.1, when authenticated... 7.2 High
- f5 big-ip access policy manager, f5 networks, inc. big-ip (apm) +1 more In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11... 7.5 High
- f5 big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, fps, gtm, link controller, pem, webaccelerator), big-ip access policy manager, big-ip advanced firewall manager +11 more +13 more In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, iControl and TMSH usage by authenticated users may... 4.3 Medium
- f5 big-ip access policy manager, f5 networks, inc. big-ip (apm) +1 more On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially... 5.9 Medium
- f5 big-ip access policy manager, big-ip advanced firewall manager, big-ip analytics +11 more +13 more On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic... 5.9 Medium
- f5 big-iq centralized management, big-iq cloud and orchestration, enterprise manager +15 more +17 more On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6,... 6.5 Medium
- f5 big-iq centralized management, big-iq cloud and orchestration, enterprise manager +15 more +17 more When BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6,... 4.9 Medium
- f5 big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, fps, gtm, link controller, pem, webaccelerator), big-ip access policy manager, big-ip advanced firewall manager +11 more +13 more On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, undisclosed traffic patterns may lead to denial of... 7.5 High
- f5 big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, fps, gtm, link controller, pem, webaccelerator), big-ip access policy manager, big-ip advanced firewall manager +11 more +13 more On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.6, malicious requests made to... 7.5 High
- f5 big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, fps, gtm, link controller, pem, webaccelerator), big-ip access policy manager, big-ip advanced firewall manager +11 more +13 more In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection... 7.5 High
- f5 big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, fps, gtm, link controller, pem, webaccelerator), big-ip access policy manager, big-ip advanced firewall manager +11 more +13 more In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.2.1-11.6.3.2, an attacker... 7.5 High
- ibm websphere application server IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute... 7.3 High
- [unknown] dashbuilder, redhat jboss bpm suite +1 more JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice... 6.1 Medium
- [unknown] cfme, redhat cloudforms, cloudforms management engine +2 more A code injection flaw was found in the way capacity and utilization imported control files are... 8.8 High
- [unknown] redis, redhat openstack +1 more A permissions flaw was found in redis, which sets weak permissions on certain files and... 4.0 Medium
- phome empirecms EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory... 9.8 Critical
- no-cms project no-cms No-CMS 1.1.3 is prone to Persistent XSS via a contact_us name parameter, as demonstrated by the... 6.1 Medium
- tecrail responsive filemanager An SSRF issue was discovered in tecrail Responsive FileManager 9.13.4 via the upload.php url... 8.6 High
- lightbend spray-json Uncontrolled Resource Consumption in spray-json 7.5 High
- lightbend spray-json Uncontrolled Resource Consumption in spray-json when parsing decimal digit fields 7.5 High
- octopus server In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with... 8.8 High
- haxx curl, canonical ubuntu linux, debian linux +1 more +3 more Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the... 4.4 Medium
- curl, canonical ubuntu linux +1 more A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code... 4.3 Medium
- haxx curl, canonical ubuntu linux, debian linux +1 more +3 more Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication... 4.3 Medium
- ics-cert vgo robot, vecna vgo firmware +1 more If an attacker has access to the firmware from the VGo Robot (Versions 3.0.3.52164 and 3.0.3... 9.8 Critical
- ics-cert vgo robot, vecna vgo firmware +1 more VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) connected... 8.8 High
- ics-cert vgo robot, vecna vgo firmware +1 more If an attacker has physical access to the VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior... 6.8 Medium
- brikcss merge Prototype Pollution in merge 7.5 High
- loofah project loofah, debian linux +1 more Loofah Cross-site Scripting vulnerability 5.4 Medium
- hackerone nextcloud server, nextcloud server +1 more A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the... 5.3 Medium
- hackerone nextcloud server, nextcloud server +1 more Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead... 8.1 High
- hackerone nextcloud server, nextcloud server +1 more Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at... 5.3 Medium
- hackerone nextcloud server, nextcloud server +1 more A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to... 5.7 Medium
- hackerone nextcloud server, nextcloud server +1 more A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could... 3.1 Low
- Show olderLoading…