Browse CVEs

HIGH 7.5 CVE-2016-8625 curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowing… Curl 7.51.0+ Fix from $1,9502018-08-01 MEDIUM 5.5 CVE-2018-14775 tss_alloc in sys/arch/i386/i386/gdt.c in OpenBSD 6.2 and 6.3 has a Local Denial of Service (system crash) due to incorrect I/O port access control on… OpenBSD Patch available Fix from $1,6002018-08-01 HIGH 7.5 CVE-2016-8624EPSS 6% curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could in… Curl 7.51.0+ Fix from $1,9502018-07-31 HIGH 8.8 CVE-2018-14280 This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is requ… Foxit Reader after 9.1.0.5096 Fix from $1,9502018-07-31 HIGH 8.8 CVE-2018-14281 This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is requ… Foxit Reader after 9.1.0.5096 Fix from $1,9502018-07-31 MEDIUM 6.5 CVE-2016-8611 A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method fo… Glance Mitigation only Fix from $1,6002018-07-31 HIGH 7.7 CVE-2016-8631 The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can pote… Openshift Mitigation only Fix from $1,9502018-07-31 MEDIUM 6.5 CVE-2016-8626 A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launc… Ceph 0.94.3.9-8+ Fix from $1,6002018-07-31 MEDIUM 6.5 CVE-2017-13652 NetApp OnCommand Insight version 7.3.0 and versions prior to 7.2.0 are susceptible to clickjacking attacks which could cause a user to perform an uni… Oncommand Insight 7.2.0+ Fix from $1,6002018-07-31 HIGH 8.8 CVE-2018-12941 This vulnerability allows remote attackers to execute arbitrary code in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 by adding a system command … Seeddms 5.1.8+ Fix from $1,9502018-07-31 HIGH 7.8 CVE-2018-14581 Redgate .NET Reflector before 10.0.7.774 and SmartAssembly before 6.12.5 allow attackers to execute code by decompiling a compiled .NET object (such … .net Reflector 6.12.5 / 10.0.7.774+ Fix from $1,9502018-07-31 MEDIUM 5.5 CVE-2018-7934 Some Huawei mobile phone with the versions before BLA-L29 8.0.0.145(C432) have a denial of service (DoS) vulnerability because they do not adapt to s… Mate 10 Pro Firmware Mitigation only Fix from $1,6002018-07-31 CRITICAL 9.8 CVE-2018-14767EPSS 29% In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag causes a segmentation fault an… Debian Linux 5.0.7 / 5.1.4+ Fix from $2,3002018-07-31 CRITICAL 9.8 CVE-2018-3772 Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` module is d… Whereis 0.4.1+ Fix from $2,3002018-07-30 HIGH 7.5 CVE-2018-10903 A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user … Openstack 2.3+ Fix from $1,9502018-07-30 HIGH 8.8 CVE-2018-9066 In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional paramet… Xclarity Administrator 2.1.0+ Fix from $1,9502018-07-30 MEDIUM 6.5 CVE-2018-14680 An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames. Ubuntu Linux after 1.5 Fix from $1,6002018-07-28 HIGH 7.5 CVE-2016-9578 A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send … Debian Linux 0.13.90+ Fix from $1,9502018-07-27 HIGH 8.8 CVE-2016-9577 A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to th… Debian Linux 0.13.90+ Fix from $1,9502018-07-27 MEDIUM 6.5 CVE-2017-2653 A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This … Cloudforms Management Engine 5.7.2.1+ Fix from $1,6002018-07-27 MEDIUM 6.5 CVE-2017-2658 It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services be… Jboss Bpm Suite 6.4.2 / 6.4.3+ Fix from $1,6002018-07-27 MEDIUM 5.4 CVE-2017-2674 JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sanitation… Jboss Bpm Suite 6.4.3+ Fix from $1,6002018-07-27 MEDIUM 6.3 CVE-2017-2614 When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is ex… Enterprise Virtualization Mitigation only Fix from $1,6002018-07-27 HIGH 7.2 CVE-2017-12148 A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project (SCM repository) definition does not h… Ansible Tower 3.1.5 / 3.2.0+ Fix from $1,9502018-07-27 HIGH 8.8 CVE-2017-12173 It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulner… Enterprise Linux Desktop 1.16.0+ Fix from $1,9502018-07-27 MEDIUM 6.5 CVE-2017-12171EPSS 8% A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines… Enterprise Linux Mitigation only Fix from $1,6002018-07-26 MEDIUM 6.5 CVE-2017-7509 An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1. If the certreq field is… Certificate System 8.1.20-1+ Fix from $1,6002018-07-26 HIGH 7.5 CVE-2017-7539EPSS 6% An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where the I/O c… Openstack 2.10.1+ Fix from $1,9502018-07-26 HIGH 7.4 CVE-2018-5531 Through undisclosed methods, on F5 BIG-IP 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6, adjacent network attackers can cause a… Big Ip Local Traffic Manager after 13.1.0.7 Fix from $1,9502018-07-25 MEDIUM 5.3 CVE-2018-5537 A remote attacker may be able to disrupt services on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 if the TMM virtual… Big Ip Local Traffic Manager after 13.1.0.5 Fix from $1,6002018-07-25