CVEs published in December 2018
1,178 vulnerabilities, 184 critical, 11 exploited.
- sap netweaver application server java, netweaver application server (java library) +1 moreSAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents...7.1 High
- sap marketing sapscore, marketing uicuan, marketing (sapscore) +1 more +3 moreSAP Marketing (UICUAN (1.20, 1.30, 1.40), SAPSCORE (1.13, 1.14)) does not sufficiently encode...5.4 Medium
- doorgetsdoorGets 7.0 allows remote attackers to write to arbitrary files via directory traversal, as...7.5 High
- tibco managed file transfer command center, managed file transfer internet server +1 moreTIBCO Managed File Transfer Credentials Disclosure6.8 Medium
- 5none nonecmsAn issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers...9.8 Critical
- frappe erpnextA SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack...7.5 High
- phpmyadmin, debian linux +1 morephpMyAdmin Cross-site Scripting (XSS) vulnerability6.1 Medium
- phpmyadminphpMyAdmin CSRF Vulnerability8.8 High
- phpmyadmin, debian linux +1 morephpMyAdmin Local file inclusion through transformation feature6.5 Medium
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute...8.1 High
- ibm curam social program managementIBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross...5.4 Medium
- ibm curam social program managementIBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote...6.8 Medium
- ibm datapower gateway, mq appliance, datapower gateways +2 moreIBM DataPower Gateway 7.1.0.0 through 7.1.0.19, 7.2.0.0 through 7.2.0.16, 7.5.0.0 through 7.5.0...6.2 Medium
- pippoImproper Restriction of XML External Entity Reference in pippo-core9.8 Critical
- evernoteIn Evernote before 7.6 on macOS, there is a local file path traversal issue in attachment...7.5 High
- d-link dir-605l firmware, dir-619l firmware +1 moreAn issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1...8.8 High
- d-link dir-605l firmware, dir-619l firmware +1 moreAn issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1...9.8 Critical
- python urllib3, fedoraproject fedora +1 moreExposure of Sensitive Information to an Unauthorized Actor in urllib39.8 Critical
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA potential vulnerability leading to an integer overflow can occur during buffer size...9.8 Critical
- mozilla firefox, canonical ubuntu linux +1 moreLimitations on the URIs allowed to WebExtensions by the browser.windows.create API can be...6.5 Medium
- mozilla firefox, canonical ubuntu linux +1 moreWebExtension content scripts can be loaded into about: pages in some circumstances, in violation...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA same-origin policy violation allowing the theft of cross-origin URL entries when using the...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA buffer overflow can occur in the Skia library during buffer offset calculations with hardware...9.8 Critical
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA use-after-free vulnerability can occur after deleting a selection element due to a weak...9.8 Critical
- mozilla firefox, canonical ubuntu linux +1 moreA buffer overflow occurs when drawing and validating elements with the ANGLE graphics library,...9.8 Critical
- mozilla firefox, canonical ubuntu linux +1 moreMozilla developers and community members reported memory safety bugs present in Firefox 63. Some...8.8 High
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreMozilla developers and community members reported memory safety bugs present in Firefox 63 and...9.8 Critical
- qacctv jooan ja-q1h wi-fi camera firmwareMishandling of '>' on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote...7.5 High
- qacctv jooan ja-q1h wi-fi camera firmwareMishandling of an empty string on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows...7.5 High
- nomachine, dokan-dev dokany +1 moreThe nxfs.sys driver in the DokanFS library 0.6.0 in NoMachine before 6.4.6 on Windows 10 allows...5.5 Medium
- cloud foundry bits service, bits service release +1 moreTiming attack allows extraction of signing key in Bits Service8.1 High
- pivotal rabbitmq for pcf, pivotal software rabbitmq +1 moreRabbitMQ cluster compromise due to deterministically generated cookie8.5 High
- nucleuscms nucleus cmsNucleus CMS 3.70 allows HTML Injection via the index.php body parameter.6.5 Medium
- blackcat-cms blackcat cmsBlackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php.5.4 Medium
- accusoft prizmdocAccusoft PrizmDoc HTML5 Document Viewer before 13.5 contains an XML external entity (XXE)...9.1 Critical
- signal private messengerSignal Messenger for Android 4.24.8 may expose private information when using "disappearing...3.3 Low
- qualcomm mdm9206 firmware, mdm9607 firmware, mdm9650 firmware +6 more +8 moreWhile generating trusted application id, An integer overflow can occur giving the trusted...9.8 Critical
- ibm websphere application serverIBM WebSphere Application Server 9 could allow sensitive information to be available caused by...4.0 Medium
- ibm curam social program managementIBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection. A remote attacker...6.1 Medium
- jenkins pipeline\, redhat openshift container platform +1 moreJenkins Script Security and Pipeline Groovy Plugins Sandbox Bypass8.8 High
- jenkins script security, redhat openshift container platform +1 moreImproper Privilege Management in Jenkins8.8 High
- jenkins, redhat openshift container platform +1 moreLoop with Unreachable Exit Condition in Jenkins6.5 Medium
- jenkins, redhat openshift container platform +1 moreImproper Limitation of a Pathname to a Restricted Directory in Jenkins8.2 High
- jenkins, redhat openshift container platform +1 moreExposure of Sensitive Information to an Unauthorized Actor in Jenkins4.3 Medium
- jenkins, jenkins stapler web framework, redhat openshift container platform +2 moreDeserialization of Untrusted Data in Jenkins9.8 Critical
- s-cmsS-CMS V3.0 has SQL injection via the S_id parameter, as demonstrated by the /1/?type=productinfo...7.5 High
- sem-cms semcmsSEMCMS 3.5 has XSS via the first text box to the SEMCMS_Main.php URI.4.8 Medium
- yzmcmsYzmCMS v5.2 has admin/role/add.html CSRF.8.8 High
- phpcmfPHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI.4.8 Medium
- domainmodDomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.4.8 Medium
- Show moreLoading…