Total
3302 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-14628 | 2 Fedoraproject, Samba | 2 Fedora, Samba | 2024-08-05 | 4.3 Medium |
| An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store. | ||||
| CVE-2018-13063 | 1 Easyappointments | 1 Easy\!appointments | 2024-08-05 | 7.5 High |
| Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts. | ||||
| CVE-2018-12397 | 4 Canonical, Debian, Mozilla and 1 more | 9 Ubuntu Linux, Debian Linux, Firefox and 6 more | 2024-08-05 | N/A |
| A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63. | ||||
| CVE-2018-11888 | 1 Qualcomm | 58 Mdm9607, Mdm9607 Firmware, Mdm9650 and 55 more | 2024-08-05 | N/A |
| Unauthorized access may be allowed by the SCP11 Crypto Services TA will processing commands from other TA in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile and Snapdragon Voice & Music in versions MDM9607, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 650/52, SD 820, SD 820A, SD 835, SD 8CX, SDM439, Snapdragon_High_Med_2016. | ||||
| CVE-2018-11751 | 2 Puppet, Redhat | 3 Puppet Server, Satellite, Satellite Capsule | 2024-08-05 | 5.4 Medium |
| Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0. | ||||
| CVE-2018-11541 | 1 Ribboncommunications | 5 Sbc Swe Lite Web, Sonus Sbc 1000, Sonus Sbc 1000 Firmware and 2 more | 2024-08-05 | N/A |
| A root privilege escalation vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows unauthorised access to privileged content via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It affects the SWe Lite devices 6.1.x up to Build 111 and 7.0.x up to Build 140. | ||||
| CVE-2018-10866 | 1 Redhat | 1 Certification | 2024-08-05 | 9.1 Critical |
| It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to remove a "system" file, that is an xml file with host related information, not belonging to him. | ||||
| CVE-2018-10865 | 1 Redhat | 1 Certification | 2024-08-05 | 7.5 High |
| It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to call a "restart" RPC method on any host accessible by the system, even if not belonging to him. | ||||
| CVE-2018-10207 | 1 Vaultize | 1 Enterprise File Sharing | 2024-08-05 | N/A |
| An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. An attacker can exploit Missing Authorization on the FlexPaperViewer SWF reader, and export files that should have been restricted, via vectors involving page-by-page access to a document in SWF format. | ||||
| CVE-2018-10251 | 1 Sierrawireless | 11 Aleos, Es440, Es450 and 8 more | 2024-08-05 | N/A |
| A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9.3 could allow an unauthenticated remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges. | ||||
| CVE-2018-10092 | 1 Dolibarr | 1 Dolibarr | 2024-08-05 | N/A |
| The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads. | ||||
| CVE-2018-10093 | 1 Audiocodes | 2 420hd Ip Phone, 420hd Ip Phone Firmware | 2024-08-05 | N/A |
| AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution. | ||||
| CVE-2018-9548 | 1 Google | 1 Android | 2024-08-05 | 5.5 Medium |
| In multiple functions of ContentProvider.java, there is a possible permission bypass due to a missing URI validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112555574. | ||||
| CVE-2018-9457 | 1 Google | 1 Android | 2024-08-05 | N/A |
| In onCheckedChanged of BluetoothPairingController.java, there is a possible way to retrieve contact information due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-72872376 | ||||
| CVE-2018-9039 | 1 Octopus | 1 Octopus Deploy | 2024-08-05 | N/A |
| In Octopus Deploy 2.0 and later before 2018.3.7, an authenticated user, with variable edit permissions, can scope some variables to targets greater than their permissions should allow. In other words, they can see machines beyond their team's scoped environments. | ||||
| CVE-2018-8718 | 1 Jenkins | 1 Mailer | 2024-08-05 | N/A |
| Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request. | ||||
| CVE-2018-8755 | 1 Nucom | 2 Wr644gacv, Wr644gacv Firmware | 2024-08-05 | N/A |
| NuCom WR644GACV devices before STA006 allow an attacker to download the configuration file without credentials. By downloading this file, an attacker can access the admin password, WPA key, and any config information of the device. | ||||
| CVE-2018-8028 | 1 Apache | 1 Sentry | 2024-08-05 | N/A |
| An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker unauthorized access to the partitioned data of a Sentry protected table and can allow an attacker to remove data from a Sentry protected table. | ||||
| CVE-2018-7702 | 1 Securenvoy | 1 Securmail | 2024-08-05 | N/A |
| SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to arbitrary recipients, or modify arbitrary message bodies and attachments by leveraging missing authentication and authorization. | ||||
| CVE-2018-6000 | 1 Asus | 1 Asuswrt | 2024-08-05 | N/A |
| An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999. | ||||