|
246551
|
7.8 |
HIGH
Local
|
owasp
|
dependency-check
|
OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.
|
CWE-22
CWE-123
Path Traversal
Write-what-where Condition
|
CVE-2018-12036
|
2024-11-21 12:44 |
2018-06-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246552
|
9.8 |
CRITICAL
Network
|
eaton
|
intelligent_power_manager
|
Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmware …
|
CWE-22
Path Traversal
|
CVE-2018-12031
|
2024-11-21 12:44 |
2018-06-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246553
|
7.5 |
HIGH
Network
|
gnome
|
epiphany
|
libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via certain window.open and document.write calls.
|
NVD-CWE-noinfo
|
CVE-2018-12016
|
2024-11-21 12:44 |
2018-06-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246554
|
7.5 |
HIGH
Network
|
canonical
debian
perl
archive\
apple
netapp
|
ubuntu_linux
debian_linux
perl
\
mac_os_x
snap_creator_framework
data_ontap_edge
snapdrive
oncommand_workflow_automation
|
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink a…
|
CWE-59
Link Following
|
CVE-2018-12015
|
2024-11-21 12:44 |
2018-06-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246555
|
7.5 |
HIGH
Network
|
ijg
|
libjpeg
|
libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.
|
CWE-834
Excessive Iteration
|
CVE-2018-11813
|
2024-11-21 12:44 |
2018-06-6 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246556
|
9.1 |
CRITICAL
Network
|
zohocorp
|
manageengine_applications_manager
|
Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server …
|
CWE-20
Improper Input Validation
|
CVE-2018-11808
|
2024-11-21 12:44 |
2018-06-6 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246557
|
8.8 |
HIGH
Network
|
apache
|
hadoop
|
Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured.
|
CWE-306
Missing Authentication for Critical Function
|
CVE-2018-11764
|
2024-11-21 12:43 |
2020-10-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246558
|
7.5 |
HIGH
Network
|
apache
|
hadoop
|
In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through H…
|
CWE-287
Improper Authentication
|
CVE-2018-11765
|
2024-11-21 12:43 |
2020-10-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246559
|
5.4 |
MEDIUM
Adjacent
|
puppet
|
puppet_server
|
Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.
|
CWE-295
Improper Certificate Validation
|
CVE-2018-11751
|
2024-11-21 12:43 |
2019-12-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246560
|
7.5 |
HIGH
Network
|
apache
|
hadoop
|
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
|
CWE-119
Incorrect Access of Indexable Resource ('Range Error')
|
CVE-2018-11768
|
2024-11-21 12:43 |
2019-10-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
