CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2018

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
951 CVE-2017-1411 522 2018-08-06 2019-10-09
5.0
None Remote Low Not required Partial None None
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 127399.
952 CVE-2017-1409 200 +Info 2018-08-06 2019-10-09
5.0
None Remote Low Not required Partial None None
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 127396.
953 CVE-2017-1396 275 2018-08-06 2019-10-09
5.5
None Remote Low ??? Partial Partial None
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 127342.
954 CVE-2017-1368 384 2018-08-06 2019-10-09
4.3
None Remote Medium Not required Partial None None
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 126861.
955 CVE-2017-1366 326 2018-08-06 2019-10-09
5.0
None Remote Low Not required Partial None None
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 126859.
956 CVE-2017-1286 200 +Info 2018-08-13 2018-10-10
4.0
None Remote Low ??? Partial None None
Sensitive information about the configuration of the IBM UrbanCode Deploy 6.1 through 6.9.6.0 server and database can be obtained by a user who has been given elevated permissions in the UI, even after those elevated permissions have been revoked. IBM X-Force ID: 125147.
957 CVE-2016-9605 79 XSS 2018-08-22 2019-10-09
4.3
None Remote Medium Not required None Partial None
A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation.
958 CVE-2016-9598 125 DoS 2018-08-16 2020-11-16
4.3
None Remote Medium Not required None None Partial
libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483.
959 CVE-2016-9596 400 DoS 2018-08-16 2020-11-16
4.3
None Remote Medium Not required None None Partial
libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption) via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627.
960 CVE-2016-9583 125 2018-08-01 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.
961 CVE-2016-9581 119 Overflow 2018-08-01 2020-09-09
6.8
None Remote Medium Not required Partial Partial Partial
An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.
962 CVE-2016-9580 190 Overflow 2018-08-01 2020-09-09
6.8
None Remote Medium Not required Partial Partial Partial
An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.
963 CVE-2016-9579 20 DoS 2018-08-01 2019-10-09
5.0
None Remote Low Not required None None Partial
A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request. Ceph branches 1.3.x and 2.x are affected.
964 CVE-2016-9573 125 2018-08-01 2020-09-09
5.8
None Remote Medium Not required Partial None Partial
An out-of-bounds read vulnerability was found in OpenJPEG 2.1.2, in the j2k_to_image tool. Converting a specially crafted JPEG2000 file to another format could cause the application to crash or, potentially, disclose some data from the heap.
965 CVE-2016-9572 476 2018-08-01 2020-09-09
4.3
None Remote Medium Not required None None Partial
A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images. Due to a logic error in the code responsible for decoding the input image, an application using openjpeg to process image data could crash when processing a crafted image.
966 CVE-2016-8654 119 Overflow 2018-08-01 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.
967 CVE-2016-8653 502 DoS 2018-08-01 2019-10-09
5.0
None Remote Low Not required None None Partial
It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could use this flaw to launch a denial of service attack.
968 CVE-2016-8651 20 2018-08-01 2019-10-09
2.7
None Local Network Low ??? Partial None None
An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image.
969 CVE-2016-8648 502 Exec Code 2018-08-01 2019-10-09
6.5
None Remote Low ??? Partial Partial Partial
It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.
970 CVE-2016-8641 59 2018-08-01 2019-10-09
7.2
None Local Low Not required Complete Complete Complete
A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.
971 CVE-2016-8640 89 Sql 2018-08-01 2019-10-09
7.5
None Remote Low Not required Partial Partial Partial
A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to.
972 CVE-2016-8639 79 XSS 2018-08-01 2019-10-09
3.5
None Remote Medium ??? None Partial None
It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.
973 CVE-2016-8637 200 +Info 2018-08-01 2019-10-09
2.1
None Local Low Not required Partial None None
A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.
974 CVE-2016-8635 320 2018-08-01 2019-10-09
4.3
None Remote Medium Not required Partial None None
It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group.
975 CVE-2016-8634 79 XSS 2018-08-01 2019-10-09
3.5
None Remote Medium ??? None Partial None
A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a user is linked directly to this URL.
976 CVE-2016-8625 20 2018-08-01 2021-06-29
5.0
None Remote Low Not required None Partial None
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.
977 CVE-2016-8623 416 2018-08-01 2021-06-29
5.0
None Remote Low Not required Partial None None
A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.
978 CVE-2016-8620 125 Overflow 2018-08-01 2019-10-09
7.5
None Remote Low Not required Partial Partial Partial
The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input.
979 CVE-2016-8619 415 2018-08-01 2019-10-09
7.5
None Remote Low Not required Partial Partial Partial
The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.
980 CVE-2016-8616 255 2018-08-01 2019-10-09
4.3
None Remote Medium Not required None Partial None
A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.
981 CVE-2016-8615 99 2018-08-01 2021-06-29
5.0
None Remote Low Not required None Partial None
A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.
982 CVE-2016-8609 287 2018-08-01 2019-10-09
5.8
None Remote Medium Not required Partial Partial None
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.
983 CVE-2016-8608 79 XSS 2018-08-01 2019-10-09
3.5
None Remote Medium ??? None Partial None
JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins.
984 CVE-2016-8527 79 XSS +Info 2018-08-06 2018-10-09
4.3
None Remote Medium Not required None Partial None
Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, an attacker who can trick a logged-in AirWave administrative user into clicking a link could obtain sensitive information, such as session cookies or passwords. The vulnerability requires that an administrative users click on the malicious link while currently logged into AirWave in the same browser.
985 CVE-2016-8526 611 2018-08-06 2018-10-16
4.0
None Remote Low ??? Partial None None
Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a way to permit XML parsers to access storage that exist on external systems. If an unprivileged user is permitted to control the contents of XML files, XXE can be used as an attack vector. Because the XML parser has access to the local filesystem and runs with the permissions of the web server, it can access any file that is readable by the web server and copy it to an external system of the attacker's choosing. This could include files that contain passwords, which could then lead to privilege escalation.
986 CVE-2016-7048 284 Exec Code 2018-08-20 2018-10-12
9.3
None Remote Medium Not required Complete Complete Complete
The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute arbitrary code by leveraging use of HTTP to download software.
987 CVE-2016-4975 93 Http R.Spl. 2018-08-14 2021-06-06
4.3
None Remote Medium Not required None Partial None
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
988 CVE-2016-4406 79 XSS 2018-08-06 2018-10-04
4.3
None Remote Medium Not required None Partial None
A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44.
989 CVE-2016-4405 502 Exec Code 2018-08-06 2018-10-05
6.5
None Remote Low ??? Partial Partial Partial
A remote code execution vulnerability was identified in HP Business Service Management (BSM) using Apache Commons Collection Java Deserialization versions v9.20-v9.26
990 CVE-2016-4404 119 Exec Code Overflow 2018-08-06 2018-10-05
7.5
None Remote Low Not required Partial Partial Partial
A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via a memory allocation issue.
991 CVE-2016-4403 119 Exec Code Overflow Mem. Corr. 2018-08-06 2018-10-05
7.5
None Remote Low Not required Partial Partial Partial
A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via memory corruption.
992 CVE-2016-4402 119 Exec Code Overflow 2018-08-06 2018-10-05
7.5
None Remote Low Not required Partial Partial Partial
A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via buffer overflow.
993 CVE-2016-4400 79 XSS 2018-08-06 2018-10-04
3.5
None Remote Medium ??? None Partial None
A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10. The vulnerability could result in cross-site scripting (XSS).
994 CVE-2016-4399 79 XSS 2018-08-06 2018-10-04
3.5
None Remote Medium ??? None Partial None
A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10. The vulnerability could result in cross-site scripting (XSS).
995 CVE-2016-4398 502 Exec Code 2018-08-06 2018-10-05
6.5
None Remote Low ??? Partial Partial Partial
A remote arbitrary code execution vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10 using Java Deserialization.
996 CVE-2016-4397 94 Exec Code 2018-08-06 2018-10-05
4.6
None Local Low Not required Partial Partial Partial
A local code execution security vulnerability was identified in HP Network Node Manager i (NNMi) v10.00, v10.10 and v10.20 Software.
997 CVE-2016-4392 79 XSS 2018-08-06 2018-10-05
3.5
None Remote Medium ??? None Partial None
A remote cross site scripting vulnerability has been identified in HP Business Service Management software v9.1x, v9.20 - v9.25IP1.
998 CVE-2016-4391 94 Exec Code 2018-08-06 2018-10-09
7.5
None Remote Low Not required Partial Partial Partial
A remote code execution security vulnerability has been identified in all versions of the HP ArcSight WINC Connector prior to v7.3.0.
999 CVE-2016-2922 295 2018-08-13 2019-10-09
4.3
None Remote Medium Not required Partial None None
IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages, EmailRelay) fails to check the SSL certificate against the requested hostname. It is subject to a man-in-the-middle attack with an impersonating server observing all the data transmitted to the real server. IBM X-Force ID: 113353.
1000 CVE-2016-0373 285 2018-08-30 2019-10-09
4.0
None Remote Low ??? Partial None None
IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119.
Total number of vulnerabilities : 1019   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 (This Page)21
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.