CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 20:24 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2018-8370 | ME Microsoft Edge Microsoft | 3.1 | Aug 15 | A information disclosure vulnerability exists when WebAudio Library improperly handles audio requests, aka "Microsoft Edge Information Disclosure Vulnerability." This affects… |
| CVE-2018-6556 | LX LXC | 3.3 | Aug 10 | The lxc-user-nic component of LXC allows unprivileged users to open arbitrary files |
| CVE-2016-8651 | OE OpenShift Enterprise Red Hat | 3.5 | Aug 1 | An input validation flaw was found in the way OpenShift 3 handles requests for images |
| CVE-2018-7957 | VF Victoria-al00 Firmware Huawei | 3.3 | Jul 31 | Huawei smartphones with software Victoria-AL00 8.0.0.336a(C00) have an information leakage vulnerability |
| CVE-2018-7947 | EF Emily-al00a Firmware Huawei | 3.9 | Jul 31 | Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication bypass vulnerability |
| CVE-2017-2651 | MA Mailer Jenkins | 3.7 | Jul 27 | jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the… |
| CVE-2018-5538 | BD Big-ip Domain Name System F5 | 3.7 | Jul 25 | On F5 BIG-IP DNS 13.1.0-13.1.0.7, 12.1.3-12.1.3.5, DNS Express / DNS Zones accept NOTIFY messages on the management interface from source IP addresses not listed in the 'Allow… |
| CVE-2018-3084 | MY MySQL Oracle | 2.8 | Jul 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Shell: Core / Client) |
| CVE-2018-3082 | MY MySQL Oracle | 2.7 | Jul 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) |
| CVE-2018-3076 | PE Peoplesoft Enterprise CS Financial Aid Oracle | 2.7 | Jul 18 | Vulnerability in the PeopleSoft Enterprise CS Financial Aid component of Oracle PeopleSoft Products (subcomponent: ISIR Processing) |
| CVE-2018-3069 | AP Agile Product Lifecycle Management For Process Oracle | 2.7 | Jul 18 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process component of Oracle Supply Chain Products Suite (subcomponent: Installation) |
| CVE-2018-3066 | MY MySQL Oracle | 3.3 | Jul 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options) |
| CVE-2018-2952 | UL Ubuntu Linux Canonical | 3.7 | Jul 18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency) |
| CVE-2018-2923 | SZ Sun Zfs Storage Appliance Kit Oracle | 2.3 | Jul 18 | Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: Core Services) |
| CVE-2018-2916 | SZ Sun Zfs Storage Appliance Kit Oracle | 2.7 | Jul 18 | Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: API frameworks) |
| CVE-2018-2906 | HM Hardware Management Pack Oracle | 3.7 | Jul 18 | Vulnerability in the Hardware Management Pack component of Oracle Sun Systems Products Suite (subcomponent: Ipmitool) |
| CVE-2018-2901 | SO Solaris Oracle | 3.7 | Jul 18 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel) |
| CVE-2018-2767 | MY MySQL Oracle | 3.1 | Jul 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption) |
| CVE-2018-2598 | MW Mysql Workbench Oracle | 3.7 | Jul 18 | Vulnerability in the MySQL Workbench component of Oracle MySQL (subcomponent: Workbench: Security: Encryption) |
| CVE-2018-0361 | CL Clamav Clamav | 3.3 | Jul 16 | ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file |
| CVE-2016-6542 | IT Itrackeasy Ieasytec | 3.7 | Jul 13 | The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device |
| CVE-2016-6539 | TF Trackr Firmware Thetrackr | 3.5 | Jul 6 | The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse |
| CVE-2017-17317 | DF Dp300 Firmware Huawei | 3.7 | Jul 2 | Common Open Policy Service Protocol (COPS) module in Huawei USG6300 V100R001C10; V100R001C20; V100R001C30; V500R001C00; V500R001C20; V500R001C30; V500R001C50; Secospace USG6500… |
| CVE-2018-13053 | KE Kernel Linux | 3.3 | Jul 2 | The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not… |
| CVE-2018-12446 | DR Dropbox Dropbox | 3.6 | Jun 20 | An issue was discovered in the com.dropbox.android application 98.2.2 for Android |
| CVE-2018-12445 | DR Dropbox Dropbox | 3.1 | Jun 20 | An issue was discovered in the com.dropbox.android application 98.2.2 for Android |
| CVE-2018-3759 | PA Private Address Check Private Address Check Project | 3.7 | Jun 13 | private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked |
| CVE-2017-5387 | FI Firefox Mozilla | 3.3 | Jun 11 | The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "source" attribute on a "<track>" tag refers to a file that… |
| CVE-2016-9062 | FI Firefox Mozilla | 3.3 | Jun 11 | Private browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db" and "browser.db-wal" files within the Firefox profile after the mode is exited |
| CVE-2018-4238 | IO iOS Apple | 2.4 | Jun 8 | An issue was discovered in certain Apple products |
| CVE-2016-1000346 | BC Bc-java Bouncycastle | 3.7 | Jun 4 | In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated |
| CVE-2016-10538 | CL Cli Cli Project | 3.5 | May 31 | The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file |
| CVE-2018-11567 | ED Echo Dot Firmware Amazon | 3.3 | May 30 | Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill |
| CVE-2018-1369 | SG Security Guardium Big Data Intelligence Ibm | 3.7 | May 29 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores sensitive information in URL parameters |
| CVE-2018-8864 | AF Alert4000 Firmware Atisystem | 3.1 | May 25 | In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, a missing encryption of sensitive data vulnerability caused by specially crafted… |
| CVE-2018-8862 | AF Alert4000 Firmware Atisystem | 3.1 | May 25 | In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, an improper authentication vulnerability caused by specially crafted malicious… |
| CVE-2018-6674 | VE Virusscan Enterprise Mcafee | 3.9 | May 25 | Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 13 allows local users to spawn unrelated… |
| CVE-2017-9635 | AM Ampla Manufacturing Execution System Schneider-electric | 3.9 | May 18 | Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges |
| CVE-2017-2603 | JE Jenkins Jenkins | 3.5 | May 15 | Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API |
| CVE-2018-6254 | AN Android Google | 3.3 | May 10 | In Android before the 2018-05-05 security patch level, NVIDIA Media Server contains an out-of-bounds read (due to improper input validation) vulnerability which could lead to… |
| CVE-2013-4209 | AB Automatic Bug Reporting Tool Redhat | 3.3 | May 1 | Automatic Bug Reporting Tool (ABRT) before 2.1.6 allows local users to obtain sensitive information about arbitrary files via vectors related to sha1sums |
| CVE-2017-17314 | DF Dp300 Firmware Huawei | 3.7 | Apr 30 | Huawei DP300 V500R002C00, RP200 V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C10,… |
| CVE-2018-10521 | CM Cms Made Simple Cmsmadesimple | 2.7 | Apr 27 | In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an… |
| CVE-2018-10424 | MI Minicms 1234n | 2.7 | Apr 26 | mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field |
| CVE-2018-10423 | MI Minicms 1234n | 2.7 | Apr 26 | mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes available after posting… |
| CVE-2018-2831 | VV VM Virtualbox Oracle | 3.8 | Apr 19 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core) |
| CVE-2018-2792 | HM Hardware Management Pack Oracle | 3.8 | Apr 19 | Vulnerability in the Hardware Management Pack component of Oracle Sun Systems Products Suite (subcomponent: Ipmitool) |
| CVE-2018-2790 | UL Ubuntu Linux Canonical | 3.1 | Apr 19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security) |
| CVE-2018-2763 | SO Solaris Oracle | 3.3 | Apr 19 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: NTPD) |
| CVE-2018-0532 | GA Garoon Cybozu | 2.7 | Apr 16 | Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard database via unspecified vectors |