CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 16:18 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2018-18020 | QP Qpdf Qpdf Project | 3.3 | Oct 6 | In QPDF 8.2.1, in libqpdf/QPDFWriter.cc, QPDFWriter::unparseObject and QPDFWriter::unparseChild have recursive calls for a long time, which allows remote attackers to cause a… |
| CVE-2018-17891 | CV Carestream Vue Ris Carestream | 3.7 | Oct 4 | Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5 |
| CVE-2018-6262 | GE Geforce Experience Nvidia | 2.5 | Oct 2 | NVIDIA GeForce Experience prior to 3.15 contains a vulnerability when GameStream is enabled where limited sensitive user information may be available to users with system access,… |
| CVE-2018-16968 | SS Sharefile Storagezones Controller Citrix | 3.1 | Sep 26 | Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal |
| CVE-2018-6053 | CH Chrome Google | 3.3 | Sep 25 | Inappropriate implementation in New Tab Page in Google Chrome prior to 64.0.3282.119 allowed a local attacker to view website thumbnail images after clearing browser data via a… |
| CVE-2018-17177 | B8 Botvac 85 Firmware Neatorobotics | 2.4 | Sep 18 | An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices |
| CVE-2018-8449 | WI Windows Microsoft | 3.3 | Sep 13 | A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affects Windows Server… |
| CVE-2018-8366 | ED Edge Microsoft | 3.1 | Sep 13 | An information disclosure vulnerability exists when the Microsoft Edge Fetch API incorrectly handles a filtered response type, aka "Microsoft Edge Information Disclosure… |
| CVE-2018-0660 | AT Attachecase Hibara | 3.3 | Sep 7 | Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create arbitrary files via specially crafted ATC file |
| CVE-2018-16252 | EL Event Log Explorer Fspro | 3.3 | Sep 5 | FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection |
| CVE-2018-7938 | PF P10 Firmware Huawei | 3.3 | Sep 4 | P10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak vulnerability due to the lack of permission validation |
| CVE-2018-6259 | GE Geforce Experience Nvidia | 2.5 | Aug 31 | NVIDIA GeForce Experience all versions prior to 3.14.1 contains a potential vulnerability when GameStream is enabled, an attacker has system access, and certain system features… |
| CVE-2018-16237 | DA Damicms Damicms | 2.7 | Aug 30 | An issue was discovered in damiCMS V6.0.1 |
| CVE-2016-0234 | OG Openpages Grc Platform Ibm | 3.3 | Aug 30 | IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous user has logged out of the system but neglected to close… |
| CVE-2016-0205 | CO Cloud Orchestrator Ibm | 3.3 | Aug 30 | A vulnerability has been identified in IBM Cloud Orchestrator 2.3, 2.3.0.1, 2.4, and 2.4.0.1 that could allow an attacker after authentication to enumerate valid users of the… |
| CVE-2014-6049 | PH Phpmyfaq Phpmyfaq | 2.7 | Aug 28 | phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter |
| CVE-2018-14799 | PT Pagewriter Tc10 Firmware Philips | 3.7 | Aug 22 | In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, the PageWriter device does not sanitize data entered by user |
| CVE-2018-8370 | ME Microsoft Edge Microsoft | 3.1 | Aug 15 | A information disclosure vulnerability exists when WebAudio Library improperly handles audio requests, aka "Microsoft Edge Information Disclosure Vulnerability." This affects… |
| CVE-2018-6556 | LX LXC | 3.3 | Aug 10 | The lxc-user-nic component of LXC allows unprivileged users to open arbitrary files |
| CVE-2016-8651 | OE OpenShift Enterprise Red Hat | 3.5 | Aug 1 | An input validation flaw was found in the way OpenShift 3 handles requests for images |
| CVE-2018-7957 | VF Victoria-al00 Firmware Huawei | 3.3 | Jul 31 | Huawei smartphones with software Victoria-AL00 8.0.0.336a(C00) have an information leakage vulnerability |
| CVE-2018-7947 | EF Emily-al00a Firmware Huawei | 3.9 | Jul 31 | Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication bypass vulnerability |
| CVE-2017-2651 | MA Mailer Jenkins | 3.7 | Jul 27 | jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the… |
| CVE-2018-5538 | BD Big-ip Domain Name System F5 | 3.7 | Jul 25 | On F5 BIG-IP DNS 13.1.0-13.1.0.7, 12.1.3-12.1.3.5, DNS Express / DNS Zones accept NOTIFY messages on the management interface from source IP addresses not listed in the 'Allow… |
| CVE-2018-3084 | MY MySQL Oracle | 2.8 | Jul 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Shell: Core / Client) |
| CVE-2018-3082 | MY MySQL Oracle | 2.7 | Jul 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) |
| CVE-2018-3076 | PE Peoplesoft Enterprise CS Financial Aid Oracle | 2.7 | Jul 18 | Vulnerability in the PeopleSoft Enterprise CS Financial Aid component of Oracle PeopleSoft Products (subcomponent: ISIR Processing) |
| CVE-2018-3069 | AP Agile Product Lifecycle Management For Process Oracle | 2.7 | Jul 18 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process component of Oracle Supply Chain Products Suite (subcomponent: Installation) |
| CVE-2018-3066 | MY MySQL Oracle | 3.3 | Jul 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options) |
| CVE-2018-2952 | UL Ubuntu Linux Canonical | 3.7 | Jul 18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency) |
| CVE-2018-2923 | SZ Sun Zfs Storage Appliance Kit Oracle | 2.3 | Jul 18 | Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: Core Services) |
| CVE-2018-2916 | SZ Sun Zfs Storage Appliance Kit Oracle | 2.7 | Jul 18 | Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: API frameworks) |
| CVE-2018-2906 | HM Hardware Management Pack Oracle | 3.7 | Jul 18 | Vulnerability in the Hardware Management Pack component of Oracle Sun Systems Products Suite (subcomponent: Ipmitool) |
| CVE-2018-2901 | SO Solaris Oracle | 3.7 | Jul 18 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel) |
| CVE-2018-2767 | MY MySQL Oracle | 3.1 | Jul 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption) |
| CVE-2018-2598 | MW Mysql Workbench Oracle | 3.7 | Jul 18 | Vulnerability in the MySQL Workbench component of Oracle MySQL (subcomponent: Workbench: Security: Encryption) |
| CVE-2018-0361 | CL Clamav Clamav | 3.3 | Jul 16 | ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file |
| CVE-2016-6542 | IT Itrackeasy Ieasytec | 3.7 | Jul 13 | The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device |
| CVE-2016-6539 | TF Trackr Firmware Thetrackr | 3.5 | Jul 6 | The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse |
| CVE-2017-17317 | DF Dp300 Firmware Huawei | 3.7 | Jul 2 | Common Open Policy Service Protocol (COPS) module in Huawei USG6300 V100R001C10; V100R001C20; V100R001C30; V500R001C00; V500R001C20; V500R001C30; V500R001C50; Secospace USG6500… |
| CVE-2018-13053 | KE Kernel Linux | 3.3 | Jul 2 | The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not… |
| CVE-2018-12446 | DR Dropbox Dropbox | 3.6 | Jun 20 | An issue was discovered in the com.dropbox.android application 98.2.2 for Android |
| CVE-2018-12445 | DR Dropbox Dropbox | 3.1 | Jun 20 | An issue was discovered in the com.dropbox.android application 98.2.2 for Android |
| CVE-2018-3759 | PA Private Address Check Private Address Check Project | 3.7 | Jun 13 | private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked |
| CVE-2017-5387 | FI Firefox Mozilla | 3.3 | Jun 11 | The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "source" attribute on a "<track>" tag refers to a file that… |
| CVE-2016-9062 | FI Firefox Mozilla | 3.3 | Jun 11 | Private browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db" and "browser.db-wal" files within the Firefox profile after the mode is exited |
| CVE-2018-4238 | IO iOS Apple | 2.4 | Jun 8 | An issue was discovered in certain Apple products |
| CVE-2016-1000346 | BC Bc-java Bouncycastle | 3.7 | Jun 4 | In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated |
| CVE-2016-10538 | CL Cli Cli Project | 3.5 | May 31 | The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file |
| CVE-2018-11567 | ED Echo Dot Firmware Amazon | 3.3 | May 30 | Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill |