Total
317826 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-1349 | 1 Netiq | 1 Identity Manager | 2024-11-21 | 5.0 MEDIUM | 2.3 LOW |
| The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system or configuration enumeration. | |||||
| CVE-2018-1348 | 1 Netiq | 1 Identity Manager | 2024-11-21 | 5.8 MEDIUM | 5.3 MEDIUM |
| NetIQ Identity Manager driver, in versions prior to 4.7, allows for an SSL handshake renegotiation which could result in a MITM attack. | |||||
| CVE-2018-1347 | 1 Netiq | 1 Imanager | 2024-11-21 | 4.3 MEDIUM | 5.3 MEDIUM |
| The administrative web interface in NetIQ iManager, versions prior to 3.1, are vulnerable to reflected cross site scripting. | |||||
| CVE-2018-1346 | 1 Netiq | 1 Edirectory | 2024-11-21 | 5.0 MEDIUM | 3.1 LOW |
| Addresses denial of service attack to eDirectory versions prior to 9.1. | |||||
| CVE-2018-1345 | 1 Netiq | 1 Imanager | 2024-11-21 | 6.5 MEDIUM | 5.9 MEDIUM |
| NetIQ iManager, versions prior to 3.1, under some circumstances could be susceptible to an elevation of privilege attack. | |||||
| CVE-2018-1344 | 1 Netiq | 1 Imanager | 2024-11-21 | 5.0 MEDIUM | 3.1 LOW |
| Addresses potential communication downgrade attack in NetIQ iManager versions prior to 3.1 | |||||
| CVE-2018-1343 | 1 Netiq | 1 Privileged Account Manager | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| PAM exposure enabling unauthenticated access to remote host | |||||
| CVE-2018-1342 | 1 Netiq | 1 Access Manager | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| A Vulnerability exists on Admin Console where an attacker can upload files to the Admin Console server, and potentially execute them. This impacts NetIQ Access Manager versions 4.3 and 4.4 as well as the Administrative console. | |||||
| CVE-2018-1340 | 1 Apache | 1 Guacamole | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an attacker eavesdropping on the network to intercept the user's session token if unencrypted HTTP requests are made to the same domain. | |||||
| CVE-2018-1339 | 1 Apache | 1 Tika | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
| A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18. | |||||
| CVE-2018-1338 | 1 Apache | 1 Tika | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
| A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18. | |||||
| CVE-2018-1337 | 1 Apache | 1 Directory Ldap Api | 2024-11-21 | 5.0 MEDIUM | 9.8 CRITICAL |
| In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request). | |||||
| CVE-2018-1336 | 4 Apache, Canonical, Debian and 1 more | 9 Tomcat, Ubuntu Linux, Debian Linux and 6 more | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86. | |||||
| CVE-2018-1335 | 1 Apache | 1 Tika | 2024-11-21 | 9.3 HIGH | 8.1 HIGH |
| From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18. | |||||
| CVE-2018-1334 | 1 Apache | 1 Spark | 2024-11-21 | 1.9 LOW | 4.7 MEDIUM |
| In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. | |||||
| CVE-2018-1333 | 4 Apache, Canonical, Netapp and 1 more | 6 Http Server, Ubuntu Linux, Cloud Backup and 3 more | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33). | |||||
| CVE-2018-1332 | 1 Apache | 1 Storm | 2024-11-21 | 4.0 MEDIUM | 6.5 MEDIUM |
| Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to impersonate another user when communicating with some Storm Daemons. | |||||
| CVE-2018-1331 | 1 Apache | 1 Storm | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user. | |||||
| CVE-2018-1330 | 1 Apache | 1 Mesos | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable. | |||||
| CVE-2018-1328 | 1 Apache | 1 Zeppelin | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph". | |||||