Search
Total
49350 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-13174 | 1 Cryptoabs Project | 1 Cryptoabs | 2018-08-17 | 5.0 MEDIUM | 7.5 HIGH |
| The mintToken function of a smart contract implementation for CryptoABS (ABS), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value. | |||||
| CVE-2018-13175 | 1 Aichain Project | 1 Aichain | 2018-08-17 | 5.0 MEDIUM | 7.5 HIGH |
| The mintToken function of a smart contract implementation for AIChain, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value. | |||||
| CVE-2018-0599 | 1 Microsoft | 1 Windows | 2018-08-17 | 9.3 HIGH | 7.8 HIGH |
| Untrusted search path vulnerability in the installer of Visual C++ Redistributable allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | |||||
| CVE-2018-0609 | 1 Linecorp | 1 Line | 2018-08-17 | 6.8 MEDIUM | 7.8 HIGH |
| Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | |||||
| CVE-2018-0606 | 1 Pixelpost | 1 Pixelpost | 2018-08-17 | 6.5 MEDIUM | 7.2 HIGH |
| SQL injection vulnerability in the Pixelpost v1.7.3 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors. | |||||
| CVE-2018-0598 | 1 Microsoft | 1 Windows | 2018-08-17 | 9.3 HIGH | 7.8 HIGH |
| Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | |||||
| CVE-2018-0600 | 2 Microsoft, Sony | 2 Windows, Playmemories Home | 2018-08-17 | 6.8 MEDIUM | 7.8 HIGH |
| Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | |||||
| CVE-2018-0601 | 1 Axpdfium Project | 1 Axpdfium | 2018-08-17 | 9.3 HIGH | 7.8 HIGH |
| Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | |||||
| CVE-2018-0596 | 1 Microsoft | 1 Visual Studio Community | 2018-08-17 | 6.8 MEDIUM | 7.8 HIGH |
| Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | |||||
| CVE-2018-0595 | 1 Microsoft | 2 Skype, Windows | 2018-08-17 | 6.8 MEDIUM | 7.8 HIGH |
| Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | |||||
| CVE-2018-0594 | 1 Microsoft | 2 Skype, Windows | 2018-08-17 | 6.8 MEDIUM | 7.8 HIGH |
| Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | |||||
| CVE-2018-0593 | 1 Microsoft | 1 Onedrive | 2018-08-17 | 6.8 MEDIUM | 7.8 HIGH |
| Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | |||||
| CVE-2018-0592 | 1 Microsoft | 1 Onedrive | 2018-08-17 | 6.8 MEDIUM | 7.8 HIGH |
| Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | |||||
| CVE-2018-1000553 | 1 Trovebox | 1 Trovebox | 2018-08-17 | 6.5 MEDIUM | 8.8 HIGH |
| Trovebox version <= 4.0.0-rc6 contains a Server-Side request forgery vulnerability in webhook component that can result in read or update internal resources. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed. | |||||
| CVE-2018-1000552 | 1 Trovebox | 1 Trovebox | 2018-08-17 | 6.5 MEDIUM | 8.8 HIGH |
| Trovebox version <= 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code injection. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed. | |||||
| CVE-2017-7186 | 1 Pcre | 2 Pcre, Pcre2 | 2018-08-17 | 5.0 MEDIUM | 7.5 HIGH |
| libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup. | |||||
| CVE-2017-7245 | 1 Pcre | 1 Pcre | 2018-08-17 | 6.8 MEDIUM | 7.8 HIGH |
| Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file. | |||||
| CVE-2017-7246 | 1 Pcre | 1 Pcre | 2018-08-17 | 6.8 MEDIUM | 7.8 HIGH |
| Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file. | |||||
| CVE-2018-13189 | 1 Unolabo Project | 1 Unolabo | 2018-08-15 | 5.0 MEDIUM | 7.5 HIGH |
| The mint function of a smart contract implementation for Unolabo (UNLB), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value. | |||||
| CVE-2018-13185 | 1 Appcoins Project | 1 Appcoins | 2018-08-15 | 5.0 MEDIUM | 7.5 HIGH |
| The mintToken function of a smart contract implementation for appcoins (APPC), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value. | |||||
| CVE-2018-13186 | 1 Mmtcoin Project | 1 Mmtcoin | 2018-08-15 | 5.0 MEDIUM | 7.5 HIGH |
| The mintToken function of a smart contract implementation for MMTCoin (MMT), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value. | |||||
| CVE-2018-13188 | 1 Mybo Project | 1 Mybo | 2018-08-15 | 5.0 MEDIUM | 7.5 HIGH |
| The mintToken function of a smart contract implementation for MyBO, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value. | |||||
| CVE-2018-13182 | 1 Loncoin Project | 1 Loncoin | 2018-08-15 | 5.0 MEDIUM | 7.5 HIGH |
| The mintToken function of a smart contract implementation for loncoin (LON), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value. | |||||
| CVE-2018-13192 | 1 Jobscoin Project | 1 Jobscoin | 2018-08-15 | 5.0 MEDIUM | 7.5 HIGH |
| The mintToken function of a smart contract implementation for Jobscoin (JOB), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value. | |||||
| CVE-2018-13193 | 1 Hentaisolo Project | 1 Hentaisolo | 2018-08-15 | 5.0 MEDIUM | 7.5 HIGH |
| The mintToken function of a smart contract implementation for hentaisolo (HAO), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value. | |||||
| CVE-2018-13190 | 1 Dvchain Project | 1 Dvchain | 2018-08-15 | 5.0 MEDIUM | 7.5 HIGH |
| The mintToken function of a smart contract implementation for DVChain, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value. | |||||
| CVE-2018-12454 | 1 1000guess | 1 1000 Guess | 2018-08-14 | 5.0 MEDIUM | 7.5 HIGH |
| The _addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readable variables such as the current block information and a private variable (which can be read with a getStorageAt call). Therefore, it allows attackers to always win and get rewards. | |||||
| CVE-2018-12453 | 1 Redislabs | 1 Redis | 2018-08-14 | 5.0 MEDIUM | 7.5 HIGH |
| Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which the key is not a stream. | |||||
| CVE-2018-5718 | 1 Safensoft | 3 Softcontrol Enterprise Suite, Softcontrol Syswatch, Softcontrol Tpsecure | 2018-08-14 | 5.6 MEDIUM | 7.1 HIGH |
| Improper restriction of write operations within the bounds of a memory buffer in snscore.sys in SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, SoftControl/SafenSoft Enterprise Suite before version 4.4.1 allows local users to cause a denial of service (BSOD) or modify kernel-mode memory via loading of a forged DLL into an user-mode process. | |||||
| CVE-2018-5153 | 2 Canonical, Mozilla | 2 Ubuntu Linux, Firefox | 2018-08-14 | 5.0 MEDIUM | 7.5 HIGH |
| If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted. This can result in an out-of-bounds read with the read memory sent to the originating server in response. This vulnerability affects Firefox < 60. | |||||
| CVE-2018-5136 | 2 Canonical, Mozilla | 2 Ubuntu Linux, Firefox | 2018-08-14 | 5.0 MEDIUM | 7.5 HIGH |
| A shared worker created from a "data:" URL in one tab can be shared by another tab with a different origin, bypassing the same-origin policy. This vulnerability affects Firefox < 59. | |||||
| CVE-2018-11222 | 1 Artica | 1 Pandora Fms | 2018-08-14 | 5.0 MEDIUM | 7.5 HIGH |
| Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint. | |||||
| CVE-2018-1153 | 1 Portswigger | 1 Burp Suite | 2018-08-14 | 5.8 MEDIUM | 7.4 HIGH |
| Burp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a couple of HTTPS requests which allows a man in the middle to modify or view traffic. | |||||
| CVE-2017-7760 | 2 Microsoft, Mozilla | 3 Windows, Firefox, Firefox Esr | 2018-08-14 | 4.6 MEDIUM | 7.8 HIGH |
| The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. The location of the original file can be altered by a malicious user by passing a special path to the callback parameter through the Mozilla Maintenance Service, allowing the manipulation of files in the installation directory and privilege escalation by manipulating the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54. | |||||
| CVE-2018-14002 | 1 Mp3 Coin Project | 1 Mp3 Coin | 2018-08-13 | 5.0 MEDIUM | 7.5 HIGH |
| An integer overflow vulnerability exists in the function distribute of MP3 Coin (MP3), an Ethereum token smart contract. An attacker could use it to set any user's balance. | |||||
| CVE-2018-14004 | 1 Globecoin Project | 1 Globecoin | 2018-08-13 | 5.0 MEDIUM | 7.5 HIGH |
| An integer overflow vulnerability exists in the function transfer_tokens_after_ICO of GlobeCoin (GLB), an Ethereum token smart contract. An attacker could use it to set any user's balance. | |||||
| CVE-2018-13836 | 1 Rocket Coin Project | 1 Rocket Coin | 2018-08-13 | 5.0 MEDIUM | 7.5 HIGH |
| An integer overflow vulnerability exists in the function multiTransfer of Rocket Coin (XRC), an Ethereum token smart contract. An attacker could use it to set any user's balance. | |||||
| CVE-2017-11185 | 1 Strongswan | 1 Strongswan | 2018-08-13 | 5.0 MEDIUM | 7.5 HIGH |
| The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted RSA signature. | |||||
| CVE-2015-4017 | 1 Saltstack | 1 Salt | 2018-08-13 | 5.0 MEDIUM | 7.5 HIGH |
| Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules. | |||||
| CVE-2017-1000098 | 1 Golang | 1 Go | 2018-08-13 | 5.0 MEDIUM | 7.5 HIGH |
| The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors. | |||||
| CVE-2016-3958 | 1 Golang | 1 Go | 2018-08-13 | 7.2 HIGH | 7.8 HIGH |
| Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, related to use of the LoadLibrary function. | |||||
| CVE-2017-1000097 | 1 Golang | 1 Go | 2018-08-13 | 5.0 MEDIUM | 7.5 HIGH |
| On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate. | |||||
| CVE-2015-3220 | 1 Tlslite Project | 1 Tlslite | 2018-08-13 | 5.0 MEDIUM | 7.5 HIGH |
| The tlslite library before 0.4.9 for Python allows remote attackers to trigger a denial of service (runtime exception and process crash). | |||||
| CVE-2016-9755 | 1 Linux | 1 Linux Kernel | 2018-08-13 | 4.6 MEDIUM | 7.8 HIGH |
| The netfilter subsystem in the Linux kernel before 4.9 mishandles IPv6 reassembly, which allows local users to cause a denial of service (integer overflow, out-of-bounds write, and GPF) or possibly have unspecified other impact via a crafted application that makes socket, connect, and writev system calls, related to net/ipv6/netfilter/nf_conntrack_reasm.c and net/ipv6/netfilter/nf_defrag_ipv6_hooks.c. | |||||
| CVE-2017-17482 | 1 Hp | 1 Openvms | 2018-08-13 | 4.6 MEDIUM | 7.8 HIGH |
| An issue was discovered in OpenVMS through V8.4-2L2 on Alpha and through V8.4-2L1 on IA64, and VAX/VMS 4.0 and later. A malformed DCL command table may result in a buffer overflow allowing a local privilege escalation when a non-privileged account enters a crafted command line. This bug is exploitable on VAX and Alpha and may cause a process crash on IA64. Software was affected regardless of whether it was directly shipped by VMS Software, Inc. (VSI), HPE, HP, Compaq, or Digital Equipment Corporation. | |||||
| CVE-2017-12969 | 1 Avaya | 1 Ip Office Contact Center | 2018-08-13 | 6.8 MEDIUM | 8.8 HIGH |
| Buffer overflow in the ViewerCtrlLib.ViewerCtrl ActiveX control in Avaya IP Office Contact Center before 10.1.1 allows remote attackers to cause a denial of service (heap corruption and crash) or execute arbitrary code via a long string to the open method. | |||||
| CVE-2015-7263 | 1 Proxygen Project | 1 Proxygen | 2018-08-13 | 5.0 MEDIUM | 7.5 HIGH |
| The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value. | |||||
| CVE-2015-7265 | 1 Proxygen Project | 1 Proxygen | 2018-08-13 | 5.0 MEDIUM | 7.5 HIGH |
| Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks. | |||||
| CVE-2017-15328 | 1 Huawei | 2 Hg8245h, Hg8245h Firmware | 2018-08-13 | 5.0 MEDIUM | 7.5 HIGH |
| Huawei HG8245H version earlier than V300R018C00SPC110 has an authentication bypass vulnerability. An attacker can access a specific URL of the affect product. Due to improper verification of the privilege, successful exploitation may cause information leak. | |||||
| CVE-2018-1000201 | 2 Microsoft, Ruby-ffi Project | 2 Windows, Ruby-ffi | 2018-08-13 | 6.8 MEDIUM | 7.8 HIGH |
| ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later. | |||||