|
246521
|
7.0 |
HIGH
Local
|
phusion debian
|
passenger debian_linux
|
A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently st…
|
CWE-362
Race Condition
|
CVE-2018-12029
|
2024-11-21 12:44 |
2018-06-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246522
|
7.8 |
HIGH
Local
|
phusion
|
passenger
|
An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrar…
|
CWE-732
Incorrect Permission Assignment for Critical Resource
|
CVE-2018-12028
|
2024-11-21 12:44 |
2018-06-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246523
|
8.8 |
HIGH
Network
|
phusion
|
passenger
|
An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a Passenger-spawned application process th…
|
CWE-200 CWE-732
Information Exposure Incorrect Permission Assignment for Critical Resource
|
CVE-2018-12027
|
2024-11-21 12:44 |
2018-06-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246524
|
9.8 |
CRITICAL
Network
|
phusion
|
passenger
|
During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning comm…
|
CWE-59
Link Following
|
CVE-2018-12026
|
2024-11-21 12:44 |
2018-06-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246525
|
8.4 |
HIGH
Local
|
redislabs
|
redis
|
Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is uncle…
|
CWE-119
Incorrect Access of Indexable Resource ('Range Error')
|
CVE-2018-12326
|
2024-11-21 12:44 |
2018-06-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246526
|
7.8 |
HIGH
Local
|
virustotal
|
yara
|
In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds write vulnerability in yr_execute_code in libyara/exec.c.
|
CWE-787
Out-of-bounds Write
|
CVE-2018-12035
|
2024-11-21 12:44 |
2018-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246527
|
7.8 |
HIGH
Local
|
virustotal
|
yara
|
In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds read vulnerability in yr_execute_code in libyara/exec.c.
|
CWE-125
Out-of-bounds Read
|
CVE-2018-12034
|
2024-11-21 12:44 |
2018-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246528
|
5.4 |
MEDIUM
Network
|
chevereto
|
chevereto
|
Chevereto Free before 1.0.13 has XSS.
|
CWE-79
Cross-site Scripting
|
CVE-2018-12030
|
2024-11-21 12:44 |
2018-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246529
|
8.8 |
HIGH
Network
|
maccms
|
maccms
|
Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.
|
CWE-352
Origin Validation Error
|
CVE-2018-12114
|
2024-11-21 12:44 |
2018-06-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246530
|
6.4 |
MEDIUM
Physics
|
dropbox
|
dropbox
|
An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS. The LAContext class for Biometric (TouchID) validation allows authentication bypass by overriding the LAContext return Boolean…
|
CWE-287
Improper Authentication
|
CVE-2018-12271
|
2024-11-21 12:44 |
2018-06-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|