CVEs published May 31, 2018
101 CVEs were published on May 31, 2018: 1 critical, 0 high. 1 is now in CISA KEV.
- Published
- 101
- Critical
- 1
- High
- 0
- Medium
- 2
- Low
- 0
- Unrated
- 98
- Now in CISA KEV
- 1
- Fix available
- 48
Most affected products
- HackerOne sequelize node module · sequelize
- 3
- HackerOne ws node module · ws
- 2
- Apport
- 1
- Fortinet FortiAuthenticator
- 1
- HackerOne airbrake node module · airbrake
- 1
- HackerOne ansi2html node module · ansi2html
- 1
- HackerOne apk-parser node module · apk-parser
- 1
- HackerOne appium-chromedriver node module · appium-chromedr…
- 1
- HackerOne backbone node module · backbone
- 1
- HackerOne bittorrent-dht node module · bittorrent-dht
- 1
Critical 1
Medium, low and unrated 100
- CVE-2018-6552Apport treats the container PID as the global PID when /proc/<global_pid>/ is missingApport
- CVE-2018-9186A cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page aFortinet FortiAuthenticator
- CVE-2018-10379An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10.5.8, 10.6.x before 10.6.5, and 10.7.x before
- CVE-2018-1496IBM Content Navigator 2.0.3, 3.0.0, 3.0.1, 3.0.2, and 3.0.3 is vulnerable to cross-site scripting.IBM Content Navigator
- CVE-2018-1532IBM API Connect 5.0.0.0 through 5.0.8.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID IBM API Connect
- CVE-2014-10064The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply neHackerOne qs node module · qs
- CVE-2014-10065Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing forHackerOne remarkable node module · remarkable
- CVE-2014-10066Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal.HackerOne fancy-server node module · fancy-server
- CVE-2015-9236Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at wHackerOne hapi node module · hapi
- CVE-2015-9238secure-compare 3.0.0 and below do not actually compare two strings properly.HackerOne secure-compare node module · secure-compare
- CVE-2015-9239ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.HackerOne ansi2html node module · ansi2html
- CVE-2016-10518A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a pingHackerOne ws node module · ws
- CVE-2016-10519A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and HackerOne bittorrent-dht node module · bittorrent-dht
- CVE-2016-10520jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.HackerOne jadedown node module · jadedown
- CVE-2016-10521jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress vHackerOne jshamcrest node module · jshamcrest
- CVE-2016-10523MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible witHackerOne mqtt-packet node module · mqtt-packet
- CVE-2016-10524i18n-node-angular is a module used to interact between i18n and angular without using additional resources.HackerOne i18n-node-angular node module · i18n-node-angular
- CVE-2016-10526A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth pHackerOne grunt-gh-pages node module · grunt-gh-pages
- CVE-2016-10527The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditionsHackerOne riot-compiler node module · riot-compiler
- CVE-2016-10528restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web.HackerOne restafary node module · restafary
- CVE-2016-10529Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests.HackerOne droppy node module · droppy
- CVE-2016-10530The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP.HackerOne airbrake node module · airbrake
- CVE-2016-10531marked is an application that is meant to parse and compile markdown.HackerOne marked node module · marked
- CVE-2016-10532console-io is a module that allows users to implement a web console in their application.HackerOne console-io node module · console-io
- CVE-2016-10533express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models.HackerOne express-restify-mongoose node module · express-re…
- CVE-2016-10534electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages.HackerOne electron-packager node module · electron-packager
- CVE-2016-10535csrf-lite is a cross-site request forgery protection library for framework-less node sites.HackerOne csrf-lite node module · csrf-lite
- CVE-2016-10536engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communicatioHackerOne engine.io-client node module · engine.io-client
- CVE-2016-10537backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RHackerOne backbone node module · backbone
- CVE-2016-10538The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file.HackerOne cli node module · cli
- CVE-2016-10539negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa.HackerOne negotiator node module · negotiator
- CVE-2016-10540Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects.HackerOne minimatch node module · minimatch
- CVE-2016-10541The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell.HackerOne shell-quote node module · shell-quote
- CVE-2016-10542ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455".HackerOne ws node module · ws
- CVE-2016-10543call is an HTTP router that is primarily used by the hapi framework.HackerOne call node module · call
- CVE-2016-10544uws is a WebSocket server library.HackerOne uws node module · uws
- CVE-2016-10546An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and deHackerOne pouchdb node module · pouchdb
- CVE-2016-10547Nunjucks is a full featured templating engine for JavaScript.HackerOne nunjucks node module · nunjucks
- CVE-2016-10548Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css.HackerOne reduce-css-calc node module · reduce-css-calc
- CVE-2016-10549Sails is an MVC style framework for building realtime web applications.HackerOne sails node module · sails
- CVE-2016-10550sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server iHackerOne sequelize node module · sequelize
- CVE-2016-10552igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol.HackerOne igniteui node module · igniteui
- CVE-2016-10553sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server iHackerOne sequelize node module · sequelize
- CVE-2016-10554sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server iHackerOne sequelize node module · sequelize
- CVE-2016-10555Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent tHackerOne jwt-simple node module · jwt-simple
- CVE-2016-10557appium-chromedriver is a Node.js wrapper around Chromedriver.HackerOne appium-chromedriver node module · appium-chromedr…
- CVE-2016-10560galenframework-cli is the node wrapper for the Galen Framework.HackerOne galenframework-cli node module · galenframework-c…
- CVE-2016-10561Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`.HackerOne bitty node module · bitty
- CVE-2016-10562iedriver is an NPM wrapper for Selenium IEDriver.HackerOne iedriver node module · iedriver
- CVE-2016-10563During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP.HackerOne go-ipfs-dep node module · go-ipfs-dep
- CVE-2016-10564apk-parser is a tool to extract Android Manifest info from an APK file.HackerOne apk-parser node module · apk-parser
- CVE-2016-10565operadriver is a Opera Driver for Selenium.HackerOne operadriver node module · operadriver
- CVE-2016-10569embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags.HackerOne embedza node module · embedza
- CVE-2016-10571bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary resources over HTTP, whiHackerOne bkjs-wand node module · bkjs-wand
- CVE-2016-10572mongodb-instance before 0.0.3 installs mongodb locally.HackerOne mongodb-instance node module · mongodb-instance
- CVE-2018-11631Rondaful M1 Wristband Smart Band 1 devices allow remote attackers to send an arbitrary number of call or SMS notifications via crafted Bluet
- CVE-2018-11632An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress.
- CVE-2018-11633An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress.
- CVE-2018-11627Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.sinatra
- CVE-2018-11132In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue tha
- CVE-2018-11133The 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to
- CVE-2018-11134In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue ma
- CVE-2018-11135The script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP obje
- CVE-2018-11136The 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is
- CVE-2018-11137The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused
- CVE-2018-11139The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated
- CVE-2018-11140The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not saniti
- CVE-2018-11141The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual
- CVE-2018-11142The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are a
- CVE-2018-11626SELA (aka SimplE Lossless Audio) v0.1.2-alpha has a stack-based buffer overflow in the core/apev2.c init_apev2_keys function.
- CVE-2018-11590Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via an integer overflo
- CVE-2018-11591Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via a NULL pointer der
- CVE-2018-11592Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via an Out-of-bounds R
- CVE-2018-11593Espruino before 1.99 allows attackers to cause a denial of service (application crash) and potential Information Disclosure with a user craf
- CVE-2018-11594Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow
- CVE-2018-11595Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Escalation of Privileges with a user
- CVE-2018-11596Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow
- CVE-2018-11597Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow
- CVE-2018-11598Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Information Disclosure with user craf
- CVE-2018-11624In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows attackers to cause a use after free via a crafted file.
- CVE-2018-11625In ImageMagick 7.0.7-37 Q16, SetGrayscaleImage in the quantize.c file allows attackers to cause a heap-based buffer over-read via a crafted
- CVE-2018-11220Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution via the system restore function.
- CVE-2018-11036Ruckus SmartZone (formerly Virtual SmartCell Gateway or vSCG) 3.5.0, 3.5.1, 3.6.0, and 3.6.1 (Essentials and High Scale) on vSZ, SZ-100, SZ-
- CVE-2018-9311The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW vehicles produced in 2012 through 2018, allows a r
- CVE-2018-9312The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produ
- CVE-2018-9313The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produ
- CVE-2018-9314The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produ
- CVE-2018-9318The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW vehicles produced in 2012 through 2018, allows a r
- CVE-2018-9320The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produ
- CVE-2018-9322The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produ
- CVE-2018-11583SeaCMS 6.61 has stored XSS in admin_collect.php via the siteurl parameter.
- CVE-2018-11579class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Se
- CVE-2018-11580An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress.
- CVE-2018-11571ClipperCMS 1.3.3 allows Session Fixation.
- CVE-2018-11572ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI.
- CVE-2018-11575ngiflib.c in MiniUPnP ngiflib 0.4 has a stack-based buffer overflow in DecodeGifImg.
- CVE-2018-11576ngiflib.c in MiniUPnP ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor.
- CVE-2018-11577Liblouis 3.5.0 has a Segmentation fault in lou_logPrint in logging.c.
- CVE-2018-11578GifIndexToTrueColor in ngiflib.c in MiniUPnP ngiflib 0.4 has a Segmentation fault.
- CVE-2018-5388In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer underflow, which may lead to resource exhastrongSwan