CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 22:42 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2019-2493 | PE PeopleSoft Enterprise CS Campus Community Oracle Corporation | 3.1 | Jan 16 | Vulnerability in the PeopleSoft Enterprise CS Campus Community component of Oracle PeopleSoft Products (subcomponent: Frameworks) |
| CVE-2019-2449 | JA Java Oracle Corporation | 3.1 | Jan 16 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment) |
| CVE-2019-2513 | MY MySQL Oracle | 2.5 | Jan 16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Shell) |
| CVE-2018-16866 | SY systemd The systemd Project | 3.3 | Jan 11 | An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':' |
| CVE-2018-15466 | PS Policy Suite For Mobile Cisco | 3.7 | Jan 11 | A vulnerability in the Graphite web interface of the Policy and Charging Rules Function (PCRF) of Cisco Policy Suite (CPS) could allow an unauthenticated, remote attacker to… |
| CVE-2018-1993 | SS Spectrum Scale Ibm | 3.3 | Jan 8 | IBM Spectrum Scale (GPFS) 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache (LROC) is enabled may caused read operation on a file to return data… |
| CVE-2018-20405 | BI Bigtree Bigtreecms | 2.7 | Dec 23 | BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error |
| CVE-2018-1804 | SA Security Access Manager Ibm | 3.7 | Dec 13 | IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tokens or session cookies |
| CVE-2018-1484 | BP Bigfix Platform Ibm | 3.7 | Dec 12 | IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies |
| CVE-2018-11464 | S8 Sinumerik 828d Firmware Siemens | 3.7 | Dec 12 | A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All… |
| CVE-2018-2497 | HA Hana Sap | 2.7 | Dec 11 | The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE <table_name> AS SELECT |
| CVE-2018-1505 | IE I2 Enterprise Insight Analysis Ibm | 3.3 | Dec 6 | IBM i2 Enterprise Insight Analysis 2.1.7 allows web pages to be stored locally which can be read by another user on the system |
| CVE-2018-1568 | QI Qradar Incident Forensics Ibm | 3.3 | Dec 5 | IBM QRadar SIEM 7.2 and 7.3 allows web pages to be stored locally which can be read by another user on the system |
| CVE-2018-19421 | GC Getsimple Cms Get-simple | 3.8 | Nov 21 | In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file, because of admin/upload-uploadify.php, and… |
| CVE-2018-19420 | GC Getsimple Cms Get-simple | 3.8 | Nov 21 | In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such as a file with no extension or an… |
| CVE-2018-19148 | CA Caddy Caddyserver | 3.7 | Nov 10 | Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames |
| CVE-2018-1842 | CA Cognos Analytics Ibm | 3.6 | Nov 9 | IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verification on its id_token |
| CVE-2016-9749 | CA Campaign Ibm | 3.3 | Nov 9 | IBM Campaign 9.1.0, 9.1.2, 10.0, and 10.1 could allow an authenticated user with access to the local network to bypass security due to lack of input validation |
| CVE-2018-17907 | CX Cx-supervisor Omron | 3.3 | Nov 5 | When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with the value of an offset, an attacker can force the application to read a value… |
| CVE-2018-16463 | NS Nextcloud Server Nextcloud | 3.1 | Oct 30 | A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protected shares |
| CVE-2018-6559 | KE Kernel Linux | 3.3 | Oct 26 | The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10, allows local users to obtain names of files in which they would not normally be able to access via an overlayfs… |
| CVE-2018-18386 | KE Kernel Linux | 3.3 | Oct 17 | drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices… |
| CVE-2018-7924 | AF Anne-al00 Firmware Huawei | 2.4 | Oct 17 | Anne-AL00 Huawei phones with versions earlier than 8.0.0.151(C00) have an information leak vulnerability |
| CVE-2018-3270 | SO Solaris Oracle | 1.8 | Oct 17 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel) |
| CVE-2018-3266 | SO Solaris Oracle | 3.9 | Oct 17 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Verified Boot) |
| CVE-2018-3184 | HB Hyperion Bi+ Oracle | 2.4 | Oct 17 | Vulnerability in the Hyperion BI+ component of Oracle Hyperion (subcomponent: IQR - Foundation Services) |
| CVE-2018-3157 | JD Jdk Oracle | 3.7 | Oct 17 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Sound) |
| CVE-2018-3150 | JD Jdk Oracle | 3.7 | Oct 17 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Utility) |
| CVE-2018-3139 | UL Ubuntu Linux Canonical | 3.1 | Oct 17 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking) |
| CVE-2018-3136 | UL Ubuntu Linux Canonical | 3.4 | Oct 17 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security) |
| CVE-2018-2922 | SO Solaris Oracle | 2.5 | Oct 17 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel) |
| CVE-2018-16738 | DL Debian Linux Debian | 3.7 | Oct 10 | tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation |
| CVE-2018-8482 | WI Windows Microsoft | 3.1 | Oct 10 | An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player Information Disclosure Vulnerability."… |
| CVE-2018-8481 | WI Windows Microsoft | 3.1 | Oct 10 | An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player Information Disclosure Vulnerability."… |
| CVE-2018-18020 | QP Qpdf Qpdf Project | 3.3 | Oct 6 | In QPDF 8.2.1, in libqpdf/QPDFWriter.cc, QPDFWriter::unparseObject and QPDFWriter::unparseChild have recursive calls for a long time, which allows remote attackers to cause a… |
| CVE-2018-17891 | CV Carestream Vue Ris Carestream | 3.7 | Oct 4 | Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5 |
| CVE-2018-6262 | GE Geforce Experience Nvidia | 2.5 | Oct 2 | NVIDIA GeForce Experience prior to 3.15 contains a vulnerability when GameStream is enabled where limited sensitive user information may be available to users with system access,… |
| CVE-2018-16968 | SS Sharefile Storagezones Controller Citrix | 3.1 | Sep 26 | Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal |
| CVE-2018-6053 | CH Chrome Google | 3.3 | Sep 25 | Inappropriate implementation in New Tab Page in Google Chrome prior to 64.0.3282.119 allowed a local attacker to view website thumbnail images after clearing browser data via a… |
| CVE-2018-17177 | B8 Botvac 85 Firmware Neatorobotics | 2.4 | Sep 18 | An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices |
| CVE-2018-8449 | WI Windows Microsoft | 3.3 | Sep 13 | A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affects Windows Server… |
| CVE-2018-8366 | ED Edge Microsoft | 3.1 | Sep 13 | An information disclosure vulnerability exists when the Microsoft Edge Fetch API incorrectly handles a filtered response type, aka "Microsoft Edge Information Disclosure… |
| CVE-2018-0660 | AT Attachecase Hibara | 3.3 | Sep 7 | Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create arbitrary files via specially crafted ATC file |
| CVE-2018-16252 | EL Event Log Explorer Fspro | 3.3 | Sep 5 | FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection |
| CVE-2018-7938 | PF P10 Firmware Huawei | 3.3 | Sep 4 | P10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak vulnerability due to the lack of permission validation |
| CVE-2018-6259 | GE Geforce Experience Nvidia | 2.5 | Aug 31 | NVIDIA GeForce Experience all versions prior to 3.14.1 contains a potential vulnerability when GameStream is enabled, an attacker has system access, and certain system features… |
| CVE-2018-16237 | DA Damicms Damicms | 2.7 | Aug 30 | An issue was discovered in damiCMS V6.0.1 |
| CVE-2016-0234 | OG Openpages Grc Platform Ibm | 3.3 | Aug 30 | IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous user has logged out of the system but neglected to close… |
| CVE-2016-0205 | CO Cloud Orchestrator Ibm | 3.3 | Aug 30 | A vulnerability has been identified in IBM Cloud Orchestrator 2.3, 2.3.0.1, 2.4, and 2.4.0.1 that could allow an attacker after authentication to enumerate valid users of the… |
| CVE-2014-6049 | PH Phpmyfaq Phpmyfaq | 2.7 | Aug 28 | phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter |