CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2018

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2003-1605 255 2018-08-23 2018-10-15
5.0
 None Remote Low Not required Partial None None
curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server.
2 CVE-2011-2765 59 2018-08-20 2018-10-16
5.0
 None Remote Low Not required None Partial None
pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks.
3 CVE-2011-2767 94 Exec Code 2018-08-26 2019-09-24
10.0
 None Remote Low Not required Complete Complete Complete
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
4 CVE-2013-7464 352 Bypass CSRF 2018-08-08 2018-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
In csrf-magic before 1.0.4, if $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used.
5 CVE-2014-4932 79 XSS 2018-08-28 2018-10-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.
6 CVE-2014-6045 89 Exec Code Sql 2018-08-28 2018-10-31
6.5
 None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via vectors involving the restore function.
7 CVE-2014-6046 352 CSRF 2018-08-28 2018-11-01
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that (1) delete active users by leveraging improper validation of CSRF tokens or that (2) delete open questions, (3) activate users, (4) publish FAQs, (5) add or delete Glossary, (6) add or delete FAQ news, or (7) add or delete comments or add votes by leveraging lack of a CSRF token.
8 CVE-2014-6047 275 2018-08-28 2018-10-23
5.0
 None Remote Low Not required Partial None None
phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment" permission checks.
9 CVE-2014-6048 200 +Info 2018-08-28 2018-10-23
5.0
 None Remote Low Not required Partial None None
phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request.
10 CVE-2014-6049 285 Bypass 2018-08-28 2018-10-23
5.5
 None Remote Low ??? None Partial Partial
phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter.
11 CVE-2014-6050 254 Bypass 2018-08-28 2018-10-23
5.0
 None Remote Low Not required None Partial None
phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request.
12 CVE-2014-10074 434 Exec Code 2018-08-27 2018-11-06
7.5
 None Remote Low Not required Partial Partial Partial
Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .php files.
13 CVE-2015-5160 200 +Info 2018-08-20 2020-10-15
2.1
 None Local Low Not required Partial None None
libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.
14 CVE-2015-5243 94 Exec Code 2018-08-20 2019-06-26
7.5
 None Remote Low Not required Partial Partial Partial
phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.
15 CVE-2015-9262 119 DoS Exec Code Overflow 2018-08-01 2019-04-16
7.5
 None Remote Low Not required Partial Partial Partial
_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.
16 CVE-2015-9263 434 Exec Code 2018-08-27 2018-11-05
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in post2file.php in Up.Time Monitoring Station 7.5.0 (build 16) and 7.4.0 (build 13). It allows an attacker to upload an arbitrary file, such as a .php file that can execute arbitrary OS commands.
17 CVE-2015-9264 20 Exec Code 2018-08-27 2018-11-07
7.5
 None Remote Low Not required Partial Partial Partial
Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windows service.
18 CVE-2016-0205 200 +Info 2018-08-30 2019-10-09
2.1
 None Local Low Not required Partial None None
A vulnerability has been identified in IBM Cloud Orchestrator 2.3, 2.3.0.1, 2.4, and 2.4.0.1 that could allow an attacker after authentication to enumerate valid users of the system. IBM X-Force ID: 109394.
19 CVE-2016-0234 613 +Info 2018-08-30 2019-10-09
2.1
 None Local Low Not required Partial None None
IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous user has logged out of the system but neglected to close their browser. IBM X-Force ID: 110303.
20 CVE-2016-0373 285 2018-08-30 2019-10-09
4.0
 None Remote Low ??? Partial None None
IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119.
21 CVE-2016-2922 295 2018-08-13 2019-10-09
4.3
 None Remote Medium Not required Partial None None
IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages, EmailRelay) fails to check the SSL certificate against the requested hostname. It is subject to a man-in-the-middle attack with an impersonating server observing all the data transmitted to the real server. IBM X-Force ID: 113353.
22 CVE-2016-4391 94 Exec Code 2018-08-06 2018-10-09
7.5
 None Remote Low Not required Partial Partial Partial
A remote code execution security vulnerability has been identified in all versions of the HP ArcSight WINC Connector prior to v7.3.0.
23 CVE-2016-4392 79 XSS 2018-08-06 2018-10-05
3.5
 None Remote Medium ??? None Partial None
A remote cross site scripting vulnerability has been identified in HP Business Service Management software v9.1x, v9.20 - v9.25IP1.
24 CVE-2016-4397 94 Exec Code 2018-08-06 2018-10-05
4.6
 None Local Low Not required Partial Partial Partial
A local code execution security vulnerability was identified in HP Network Node Manager i (NNMi) v10.00, v10.10 and v10.20 Software.
25 CVE-2016-4398 502 Exec Code 2018-08-06 2018-10-05
6.5
 None Remote Low ??? Partial Partial Partial
A remote arbitrary code execution vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10 using Java Deserialization.
26 CVE-2016-4399 79 XSS 2018-08-06 2018-10-04
3.5
 None Remote Medium ??? None Partial None
A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10. The vulnerability could result in cross-site scripting (XSS).
27 CVE-2016-4400 79 XSS 2018-08-06 2018-10-04
3.5
 None Remote Medium ??? None Partial None
A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10. The vulnerability could result in cross-site scripting (XSS).
28 CVE-2016-4402 119 Exec Code Overflow 2018-08-06 2018-10-05
7.5
 None Remote Low Not required Partial Partial Partial
A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via buffer overflow.
29 CVE-2016-4403 119 Exec Code Overflow Mem. Corr. 2018-08-06 2018-10-05
7.5
 None Remote Low Not required Partial Partial Partial
A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via memory corruption.
30 CVE-2016-4404 119 Exec Code Overflow 2018-08-06 2018-10-05
7.5
 None Remote Low Not required Partial Partial Partial
A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via a memory allocation issue.
31 CVE-2016-4405 502 Exec Code 2018-08-06 2018-10-05
6.5
 None Remote Low ??? Partial Partial Partial
A remote code execution vulnerability was identified in HP Business Service Management (BSM) using Apache Commons Collection Java Deserialization versions v9.20-v9.26
32 CVE-2016-4406 79 XSS 2018-08-06 2018-10-04
4.3
 None Remote Medium Not required None Partial None
A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44.
33 CVE-2016-4975 93 Http R.Spl. 2018-08-14 2021-06-06
4.3
 None Remote Medium Not required None Partial None
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
34 CVE-2016-7048 284 Exec Code 2018-08-20 2018-10-12
9.3
 None Remote Medium Not required Complete Complete Complete
The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute arbitrary code by leveraging use of HTTP to download software.
35 CVE-2016-8526 611 2018-08-06 2018-10-16
4.0
 None Remote Low ??? Partial None None
Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a way to permit XML parsers to access storage that exist on external systems. If an unprivileged user is permitted to control the contents of XML files, XXE can be used as an attack vector. Because the XML parser has access to the local filesystem and runs with the permissions of the web server, it can access any file that is readable by the web server and copy it to an external system of the attacker's choosing. This could include files that contain passwords, which could then lead to privilege escalation.
36 CVE-2016-8527 79 XSS +Info 2018-08-06 2018-10-09
4.3
 None Remote Medium Not required None Partial None
Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, an attacker who can trick a logged-in AirWave administrative user into clicking a link could obtain sensitive information, such as session cookies or passwords. The vulnerability requires that an administrative users click on the malicious link while currently logged into AirWave in the same browser.
37 CVE-2016-8608 79 XSS 2018-08-01 2019-10-09
3.5
 None Remote Medium ??? None Partial None
JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins.
38 CVE-2016-8609 287 2018-08-01 2019-10-09
5.8
 None Remote Medium Not required Partial Partial None
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.
39 CVE-2016-8615 99 2018-08-01 2021-06-29
5.0
 None Remote Low Not required None Partial None
A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.
40 CVE-2016-8616 255 2018-08-01 2019-10-09
4.3
 None Remote Medium Not required None Partial None
A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.
41 CVE-2016-8619 415 2018-08-01 2019-10-09
7.5
 None Remote Low Not required Partial Partial Partial
The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.
42 CVE-2016-8620 125 Overflow 2018-08-01 2019-10-09
7.5
 None Remote Low Not required Partial Partial Partial
The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input.
43 CVE-2016-8623 416 2018-08-01 2021-06-29
5.0
 None Remote Low Not required Partial None None
A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.
44 CVE-2016-8625 20 2018-08-01 2021-06-29
5.0
 None Remote Low Not required None Partial None
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.
45 CVE-2016-8634 79 XSS 2018-08-01 2019-10-09
3.5
 None Remote Medium ??? None Partial None
A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a user is linked directly to this URL.
46 CVE-2016-8635 320 2018-08-01 2019-10-09
4.3
 None Remote Medium Not required Partial None None
It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group.
47 CVE-2016-8637 200 +Info 2018-08-01 2019-10-09
2.1
 None Local Low Not required Partial None None
A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.
48 CVE-2016-8639 79 XSS 2018-08-01 2019-10-09
3.5
 None Remote Medium ??? None Partial None
It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.
49 CVE-2016-8640 89 Sql 2018-08-01 2019-10-09
7.5
 None Remote Low Not required Partial Partial Partial
A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to.
50 CVE-2016-8641 59 2018-08-01 2019-10-09
7.2
 None Local Low Not required Complete Complete Complete
A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.
Total number of vulnerabilities : 1019   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.