CVEs published May 29, 2018
80 CVEs were published on May 29, 2018: 0 critical, 0 high.
- Published
- 80
- Critical
- 0
- High
- 0
- Medium
- 6
- Low
- 1
- Unrated
- 73
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- IBM Security Guardium Big Data Intelligence
- 5
- Dell EMC RecoverPoint
- 3
- HackerOne hapi node module · hapi
- 2
- [UNKNOWN] sudo
- 1
- HackerOne adamvr-geoip-lite node module · adamvr-geoip-lite
- 1
- HackerOne aerospike node module · aerospike
- 1
- HackerOne atob node module · atob
- 1
- HackerOne baryton-saxophone node module · baryton-saxophone
- 1
- HackerOne broccoli-closure node module · broccoli-closure
- 1
- HackerOne crud-file-server node module · crud-file-server
- 1
Medium, low and unrated 80
- CVE-2018-11544The Olive Tree Ftp Server application 1.32 for Android has Insecure Data Storage because a username and password are stored in the /data/dat
- CVE-2018-11545md4c 0.2.5 has a heap-based buffer overflow in md_merge_lines because md_is_link_label mishandles the case of a link label composed solely o
- CVE-2018-11546md4c 0.2.5 has a heap-based buffer over-read because md_is_named_entity_contents has an off-by-one error.
- CVE-2018-11547md_is_link_reference_definition_helper in md4c 0.2.5 has a heap-based buffer over-read because md_is_link_label mishandles loop termination.
- CVE-2018-11548An issue was discovered in EOS.IO DAWN 4.2.
- CVE-2018-11549An issue was discovered in WUZHI CMS 4.1.0 There is a Stored XSS Vulnerability in "Account Settings -> Member Centre -> Chinese information
- CVE-2014-10067paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the productioHackerOne paypal-ipn node module · paypal-ipn
- CVE-2014-10068The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden`HackerOne inert node module · inert
- CVE-2015-9235In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetHackerOne jsonwebtoken node module · jsonwebtoken
- CVE-2015-9240Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matchedHackerOne keystone node module · keystone
- CVE-2015-9241Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised.HackerOne hapi node module · hapi
- CVE-2015-9242Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception.HackerOne ecstatic node module · ecstatic
- CVE-2015-9243When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher leveHackerOne hapi node module · hapi
- CVE-2015-9244Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.HackerOne mysql node module · mysql
- CVE-2016-10525When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass autHackerOne hapi-auth-jwt2 node module · hapi-auth-jwt2
- CVE-2016-10551waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's `like`, `contaiHackerOne waterline-sequel node module · waterline-sequel
- CVE-2016-10556sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server iHackerOne sequelize node module · sequelize
- CVE-2016-10558aerospike is an Aerospike add-on module for Node.js.HackerOne aerospike node module · aerospike
- CVE-2016-10559selenium-download downloads the latest versions of the selenium standalone server and the chromedriver.HackerOne selenium-download node module · selenium-download
- CVE-2016-10566install-nw is a module which quickly and robustly installs and caches NW.js.HackerOne install-nw node module · install-nw
- CVE-2016-10567product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information aboutHackerOne product-monitor node module · product-monitor
- CVE-2016-10568geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup.HackerOne geoip-lite-country node module · geoip-lite-count…
- CVE-2016-10570pngcrush-installer is an installer for Pngcrush.HackerOne pngcrush-installer node module · pngcrush-install…
- CVE-2016-10573baryton-saxophone is a module to install and launch Selenium Server for Mac, Linux and Windows.HackerOne baryton-saxophone node module · baryton-saxophone
- CVE-2016-10577ibm_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix.HackerOne ibm_db node module · ibm_db
- CVE-2016-10578unicode loads unicode data downloaded from unicode.org into nodejs.HackerOne unicode node module · unicode
- CVE-2016-10584dalek-browser-chrome-canary provides Google Chrome bindings for DalekJS.HackerOne dalek-browser-chrome-canary node module · dalek-b…
- CVE-2016-10586macaca-chromedriver is a Node.js wrapper for the selenium chromedriver.HackerOne macaca-chromedriver node module · macaca-chromedr…
- CVE-2016-10589selenium-binaries downloads Selenium related binaries for your OS.HackerOne selenium-binaries node module · selenium-binaries
- CVE-2016-10590cue-sdk-node is a Corsair Cue SDK wrapper for node.js.HackerOne cue-sdk-node node module · cue-sdk-node
- CVE-2016-10591Prince is a Node API for executing XML/HTML to PDF renderer PrinceXML via prince(1) CLI.HackerOne prince node module · prince
- CVE-2016-10593ibapi is an Interactive Brokers API addon for NodeJS.HackerOne ibapi node module · ibapi
- CVE-2016-10601webdrvr is a npm wrapper for Selenium Webdriver including Chromedriver / IEDriver / IOSDriver / Ghostdriver.HackerOne webdrvr node module · webdrvr
- CVE-2016-10611strider-sauce is Sauce Labs / Selenium support for Strider.HackerOne strider-sauce node module · strider-sauce
- CVE-2016-10627scala-bin is a binary wrapper for Scala.HackerOne scala-bin node module · scala-bin
- CVE-2016-10635broccoli-closure is a Closure compiler plugin for Broccoli.HackerOne broccoli-closure node module · broccoli-closure
- CVE-2016-10650ntfserver is a Network Testing Framework Server.HackerOne ntfserver node module · ntfserver
- CVE-2016-10658native-opencv is the OpenCV library installed via npm native-opencv downloads binary resources over HTTP, which leaves it vulnerable to MITMHackerOne native-opencv node module · native-opencv
- CVE-2016-10659poco - The POCO libraries, downloads source file resources used for compilation over HTTP, which leaves it vulnerable to MITM attacks.HackerOne poco node module · poco
- CVE-2016-10666tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to MHackerOne tomita-parser node module · tomita-parser
- CVE-2016-10674limbus-buildgen is a "build anywhere" build system.HackerOne limbus-buildgen node module · limbus-buildgen
- CVE-2016-10679selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver.HackerOne selenium-standalone-painful node module · seleniu…
- CVE-2016-10680adamvr-geoip-lite is a light weight native JavaScript implementation of GeoIP API from MaxMind adamvr-geoip-lite downloads geoip resources oHackerOne adamvr-geoip-lite node module · adamvr-geoip-lite
- CVE-2016-10681roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTPHackerOne roslib-socketio node module · roslib-socketio
- CVE-2016-10682massif is a Phantomjs fork massif downloads resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne massif node module · massif
- CVE-2016-10698mystem-fix is a node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem-fix downloads binary resources over HTTP, which leavHackerOne mystem-fix node module · mystem-fix
- CVE-2017-16003windows-build-tools is a module for installing C++ Build Tools for Windows using npm.HackerOne windows-build-tools node module · windows-build-t…
- CVE-2017-16010i18next is a language translation framework.HackerOne i18next node module · i18next
- CVE-2017-16047mysqljs was a malicious module published with the intent to hijack environment variables.HackerOne mysqljs node module · mysqljs
- CVE-2017-16061tkinter was a malicious module published with the intent to hijack environment variables.HackerOne tkinter node module · tkinter
- CVE-2017-16062node-tkinter was a malicious module published with the intent to hijack environment variables.HackerOne node-tkinter node module · node-tkinter
- CVE-2017-16153gaoxuyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.HackerOne gaoxuyan node module · gaoxuyan
- CVE-2018-10466Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection.
- CVE-2018-10751A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String Extension portion of t
- CVE-2018-11027A reflected XSS vulnerability on Ruckus ICX7450-48 devices allows remote attackers to inject arbitrary web script or HTML.
- CVE-2018-11392An arbitrary file upload vulnerability in /classes/profile.class.php in Jigowatt "PHP Login & User Management" before 4.1.1, as distributed
- CVE-2018-3733crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a malHackerOne crud-file-server node module · crud-file-server
- CVE-2018-3734stattic node module suffers from a Path Traversal vulnerability due to lack of validation of path, which allows a malicious user to read conHackerOne stattic node module · stattic
- CVE-2018-3744The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL.HackerOne html-pages node module · html-pages
- CVE-2018-3745atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.HackerOne atob node module · atob
- CVE-2018-6964VMware Horizon Client for Linux (4.x before 4.8.0 and prior) contains a local privilege escalation vulnerability due to insecure usage of SUVMware Horizon Client for Linux
- CVE-2018-1235Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability.Dell EMC RecoverPoint
- CVE-2018-1241Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditions, may leak LDAP paDell EMC RecoverPoint
- CVE-2018-1242Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contains a command injection vulnerabilityDell EMC RecoverPoint
- CVE-2018-1495IBM FlashSystem V840 and V900 products could allow an authenticated attacker with specialized access to overwrite arbitrary files which coulIBM FlashSystem
- CVE-2016-7076sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C libra[UNKNOWN] sudo
- CVE-2017-1768IBM Security Guardium Big Data Intelligence (SonarG) 3.1 generates an error message that includes sensitive information about its environmenIBM Security Guardium Big Data Intelligence
- CVE-2018-1369IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores sensitive information in URL parameters.IBM Security Guardium Big Data Intelligence
- CVE-2018-1370IBM Security Guardium Big Data Intelligence (SonarG) 3.1 specifies permissions for a security-critical resource in a way that allows that reIBM Security Guardium Big Data Intelligence
- CVE-2018-1375IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not renew a session variable after a successful authentication which could leaIBM Security Guardium Big Data Intelligence
- CVE-2018-1376IBM Security Guardium Big Data Intelligence (SonarG) 3.1 is vulnerable to cross-site scripting.IBM Security Guardium Big Data Intelligence
- CVE-2018-5241Symantec Advanced Secure Gateway (ASG) 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerabilSymantec Advanced Secure Gateway · Symantec ProxySG
- CVE-2018-11488A stack exhaustion vulnerability in the search function of dtSearch 7.90.8538.1 and prior allows remote attackers to cause a denial of servi
- CVE-2018-11523upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files.
- CVE-2018-11527An issue was discovered in CScms v4.1.
- CVE-2018-11528WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.
- CVE-2018-11531Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.
- CVE-2018-11532An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB.
- CVE-2018-11535An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0.
- CVE-2018-11536md4c before 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits.