CVEs published in December 2018
1,178 vulnerabilities, 184 critical, 11 exploited.
- k9mail k-9 mailK9Mail version <= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response...10.0 Critical
- xr3player project xr3playerXR3Player version <= V3.124 contains a XML External Entity (XXE) vulnerability in Playlist parser...10.0 Critical
- anyplace project anyplaceAnyplace version before commit 80359b4 contains a XML External Entity (XXE) vulnerability in Man...9.0 Critical
- frostwireFrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE)...9.0 Critical
- ubillingUbilling version <= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter...9.8 Critical
- microweberMicroweber XSS Vulnerability6.1 Medium
- freecolFreeCol version <= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in...10.0 Critical
- megamekMegaMek version < v0.45.1 contains a Other/Unknown vulnerability in Object Stream Connection that...9.8 Critical
- exist-db existexist-db:exist-core XML External Entity (XXE) vulnerability10.0 Critical
- codelibs fessXML External Entity (XXE) vulnerability in codelibs fess10.0 Critical
- micromathematics project micromathematicsMicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability...10.0 Critical
- neo4j awesome procedures on cyperXML External Entity (XXE) vulnerability in neo4j.procedure:apoc10.0 Critical
- asset pipeline project asset-pipelineAsset Pipeline Grails Plugin vulnerable to Path Traversal7.5 High
- grafanaGrafana XSS Vulnerability5.4 Medium
- braveBrave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown...4.3 Medium
- aio-libs aiohttp sessionaiohttp-session creates non-expiring sessions6.5 Medium
- backdropcms backdrop cmsBackdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in...4.8 Medium
- artica integria imsArtica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak...8.1 High
- bluditbludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in...8.8 High
- google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 moreIn all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the...7.8 High
- zte usmartview, zxcloud irai +1 moreAll versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted...5.1 Medium
- pandora kmplayerKMPlayer Heap Overflow Vulnerability8.0 High
- wizvera veraport, veraport g3 +1 moreWIZVERA Remote Code Execution Vulnerability8.0 High
- wizvera veraport, veraport g3 +1 moreWIZVERA Veraport Race Condition Vulnerability8.0 High
- ibm api connectIBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level...7.2 High
- ibm api connectIBM API Connect 5.0.0.0 and 5.0.8.4 is affected by a NoSQL Injection in MongoDB connector for the...7.1 High
- ibm api connectIBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to...7.7 High
- hcl software domino, ibm notes +1 moreIBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering...8.4 High
- ibm datapower gateways, datapower gateway +1 moreIBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are...5.1 Medium
- ibm datapower gateways, datapower gateway +1 moreIBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery...6.5 Medium
- mcafee application and change control, application change control +1 moreBypass Application Control through an ASP.NET form6.3 Medium
- microsoft internet explorer, internet explorer 10, internet explorer 11 +1 more +3 moreA remote code execution vulnerability exists in the way that the scripting engine handles objects...7.5 High
- orion project orionFlaw in streaming state in orion7.5 High
- pulsesecure virtual traffic managerPulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote...4.3 Medium
- pulsesecure virtual traffic managerA stored cross-site scripting (XSS) vulnerability in the web administration user interface of...5.4 Medium
- coherence project coherencePermissive parameters and privilege escalation6.5 Medium
- d-link dir-816 a2 firmwareD-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication...9.8 Critical
- libexcel project libexcelwbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a...6.5 Medium
- gogsGogs Directory Traversal7.5 High
- emetrotel xainCross-site Scripting in xain6.1 Medium
- phome empirecmsEmpire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in...9.8 Critical
- netatalk, debian linux, synology diskstation manager +3 more +5 moreNetatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to...9.8 Critical
- libarchive, canonical ubuntu linux, fedoraproject fedora +1 more +3 morelibarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0...6.5 Medium
- libarchive, canonical ubuntu linux, debian linux +5 more +7 morelibarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0...8.8 High
- libarchive, canonical ubuntu linux, debian linux +4 more +6 morelibarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0...8.8 High
- gnupg, canonical ubuntu linux +1 moreGnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in...8.8 High
- bosch 360-indoor camera firmware, eyes outdoor camera firmware +1 moreAn issue was discovered in several Bosch Smart Home cameras (360 degree indoor camera and Eyes...9.8 Critical
- spring security, vmware spring framework +1 moreAuthorization Bypass During JWT Issuer Validation with spring-security3.3 Low
- pivotal concoursePivotal Concourse allows malicious redirect urls on login7.6 High
- apache oozieModerate severity vulnerability that affects org.apache.oozie:oozie-core6.5 Medium
- Show moreLoading…