Low-severity CVEs (page 94)
Page 94 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1667 | Low | 3.3 | 2019-02-21 | A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite inte… |
CVE-2019-0127 | Low | 3.9 | 2019-02-18 | Logic error in the installer for Intel(R) OpenVINO(TM) 2018 R3 and before for Linux may allow a privileged user to potentially enable information disclosure vi… |
CVE-2017-1200 | Low | 3.7 | 2019-02-05 | IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker… |
CVE-2017-1198 | Low | 3.7 | 2019-02-05 | IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) stores sensitive information in URL parameters. This may lead to information disclosure if unauth… |
CVE-2018-19004 | Low | 3.3 | 2019-02-01 | LCDS Laquis SCADA prior to version 4.1.0.4150 allows out of bounds read when opening a specially crafted project file, which may allow data exfiltration. |
CVE-2019-3807 | Low | 3.7 | 2019-01-29 | An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers w… |
CVE-2019-3815 | Low | 3.3 | 2019-01-28 | A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c doe… |
CVE-2017-3140 | Low | 3.7 | 2019-01-16 | If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while hand… |
CVE-2019-2553 | Low | 3.8 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2547 | Low | 3.5 | 2019-01-16 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Easily exploit… |
CVE-2019-2513 | Low | 2.5 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Shell). Supported versions that are affected are 8.0.13 and prior. Difficult to expl… |
CVE-2019-2506 | Low | 3.8 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2505 | Low | 3.8 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2504 | Low | 3.8 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2501 | Low | 3.8 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2493 | Low | 3.1 | 2019-01-16 | Vulnerability in the PeopleSoft Enterprise CS Campus Community component of Oracle PeopleSoft Products (subcomponent: Frameworks). Supported versions that are… |
CVE-2019-2449 | Low | 3.1 | 2019-01-16 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). The supported version that is affected is Java SE: 8u192. Difficult to exp… |
CVE-2019-2426 | Low | 3.7 | 2019-01-16 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1… |
CVE-2019-2422 | Low | 3.1 | 2019-01-16 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1… |
CVE-2018-16866 | Low | 3.3 | 2019-01-11 | An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw… |
CVE-2018-17957 | Low | 3.4 | 2018-12-26 | The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing lo… |
CVE-2018-20405 | Low | 2.7 | 2018-12-23 | BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error. NOTE: This has been disputed with the following reaso… |
CVE-2018-16883 | Low | 2.5 | 2018-12-19 | sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter. If sensitiv… |
CVE-2017-1272 | Low | 3.7 | 2018-12-17 | IBM Security Guardium 10.0 and 10.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access… |
CVE-2017-1265 | Low | 3.7 | 2018-12-17 | IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 does not validate, or incorrectly validates, a certificate. This weakness might allo… |
CVE-2018-6707 | Low | 3.7 | 2018-12-14 | Denial of Service through Resource Depletion vulnerability in the agent in non-Windows McAfee Agent (MA) 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows local use… |
CVE-2018-15774 | Low | 3.8 | 2018-12-13 | Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalat… |
CVE-2018-1804 | Low | 3.7 | 2018-12-13 | IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tokens or session cook… |
CVE-2018-1485 | Low | 3.1 | 2018-12-12 | IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which could lead to session… |
CVE-2018-1484 | Low | 3.7 | 2018-12-12 | IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be a… |
CVE-2018-1481 | Low | 3.7 | 2018-12-12 | IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. This may lead to information disclosure if unaut… |
CVE-2018-11464 | Low | 3.7 | 2018-12-12 | A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D… |
CVE-2018-2497 | Low | 2.7 | 2018-12-11 | The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE <tabl… |
CVE-2017-1622 | Low | 3.7 | 2018-12-05 | IBM QRadar SIEM 7.2.8 and 7.3 does not validate, or incorrectly validates, a certificate. This weakness might allow an attacker to spoof a trusted entity by us… |
CVE-2018-5559 | Low | 3.4 | 2018-11-28 | In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configuration… |
CVE-2018-19421 | Low | 3.8 | 2018-11-21 | In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file, because of admin/upload-uploadify.php… |
CVE-2018-19420 | Low | 3.8 | 2018-11-21 | In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such as a file with no ext… |
CVE-2018-19148 | Low | 3.7 | 2018-11-10 | Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unabl… |
CVE-2018-1842 | Low | 3.6 | 2018-11-09 | IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verification on its id_token. IBM X-Force ID: 150… |
CVE-2018-17907 | Low | 3.3 | 2018-11-05 | When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with the value of an offset, an attacker can force the applicatio… |
CVE-2018-16849 | Low | 3.1 | 2018-11-02 | A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files… |
CVE-2018-16463 | Low | 3.1 | 2018-10-30 | A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protecte… |
CVE-2018-1380 | Low | 2.7 | 2018-10-29 | IBM InfoSphere Master Data Management Collaboration Server 11.4, 11.5, and 11.6 could allow an authenticated user with CA level access to change change their c… |
CVE-2018-6559 | Low | 3.3 | 2018-10-26 | The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10, allows local users to obtain names of files in which they would not normally be able to access… |
CVE-2018-15765 | Low | 3.4 | 2018-10-18 | Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains an Information Exposure vulnerability. The log file contents store sensitive data inclu… |
CVE-2018-18386 | Low | 3.3 | 2018-10-17 | drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseu… |
CVE-2018-7924 | Low | 2.4 | 2018-10-17 | Anne-AL00 Huawei phones with versions earlier than 8.0.0.151(C00) have an information leak vulnerability. Due to improper permission settings for specific comm… |
CVE-2018-3270 | Low | 1.8 | 2018-10-17 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Difficult t… |
CVE-2018-3266 | Low | 3.9 | 2018-10-17 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Verified Boot). The supported version that is affected is 11.3. Diff… |
CVE-2018-3184 | Low | 2.4 | 2018-10-17 | Vulnerability in the Hyperion BI+ component of Oracle Hyperion (subcomponent: IQR - Foundation Services). The supported version that is affected is 11.1.2.4. E… |
CVE-2018-3157 | Low | 3.7 | 2018-10-17 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Sound). The supported version that is affected is Java SE: 11. Difficult to exploit vul… |
CVE-2018-3150 | Low | 3.7 | 2018-10-17 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Utility). The supported version that is affected is Java SE: 11. Difficult to exploit v… |
CVE-2018-3139 | Low | 3.1 | 2018-10-17 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u201… |
CVE-2018-3136 | Low | 3.4 | 2018-10-17 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u201, 7… |
CVE-2018-2922 | Low | 2.5 | 2018-10-17 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Difficult t… |
CVE-2018-16738 | Low | 3.7 | 2018-10-10 | tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1. |
CVE-2018-8482 | Low | 3.1 | 2018-10-10 | An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player Information Disclosur… |
CVE-2018-8481 | Low | 3.1 | 2018-10-10 | An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player Information Disclosur… |
CVE-2018-12477 | Low | 3.5 | 2018-10-09 | A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-servic… |
CVE-2018-18020 | Low | 3.3 | 2018-10-06 | In QPDF 8.2.1, in libqpdf/QPDFWriter.cc, QPDFWriter::unparseObject and QPDFWriter::unparseChild have recursive calls for a long time, which allows remote attac… |
CVE-2018-17891 | Low | 3.7 | 2018-10-04 | Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is… |
CVE-2018-1670 | Low | 3.1 | 2018-10-04 | IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive product configuration informa… |
CVE-2018-6262 | Low | 2.5 | 2018-10-02 | NVIDIA GeForce Experience prior to 3.15 contains a vulnerability when GameStream is enabled where limited sensitive user information may be available to users… |
CVE-2018-1593 | Low | 3.7 | 2018-10-02 | IBM Multi-Cloud Data Encryption (MDE) 2.1 could allow an unauthorized user to manipulate data due to missing file checksums. IBM X-Force ID: 143568. |
CVE-2018-1509 | Low | 3.7 | 2018-10-02 | IBM Security Guardium EcoSystem 10.5 does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker to spoof a trusted entity… |
CVE-2018-12473 | Low | 3.1 | 2018-10-02 | A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause access files not in the current build. O… |
CVE-2018-16968 | Low | 3.1 | 2018-09-26 | Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal. |
CVE-2018-6053 | Low | 3.3 | 2018-09-25 | Inappropriate implementation in New Tab Page in Google Chrome prior to 64.0.3282.119 allowed a local attacker to view website thumbnail images after clearing b… |
CVE-2018-17177 | Low | 2.4 | 2018-09-18 | An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. Static encryption is used for the copying of so-called "black box" logs (e… |
CVE-2018-8449 | Low | 3.3 | 2018-09-13 | A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affe… |
CVE-2018-8366 | Low | 3.1 | 2018-09-13 | An information disclosure vulnerability exists when the Microsoft Edge Fetch API incorrectly handles a filtered response type, aka "Microsoft Edge Information… |
CVE-2016-7061 | Low | 3.5 | 2018-09-10 | An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discovered that when configuring RBAC and marki… |
CVE-2018-0660 | Low | 3.3 | 2018-09-07 | Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create arbitrary files via specially crafted ATC… |
CVE-2018-16252 | Low | 3.3 | 2018-09-05 | FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection. |
CVE-2018-7938 | Low | 3.3 | 2018-09-04 | P10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak vulnerability due to the lack of permission validation. An attac… |
CVE-2018-6259 | Low | 2.5 | 2018-08-31 | NVIDIA GeForce Experience all versions prior to 3.14.1 contains a potential vulnerability when GameStream is enabled, an attacker has system access, and certai… |
CVE-2018-16237 | Low | 2.7 | 2018-08-30 | An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.php, as demonstrated by an admin.php?s=T… |
CVE-2016-0373 | Low | 3.1 | 2018-08-30 | IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing use… |
CVE-2016-0205 | Low | 3.3 | 2018-08-30 | A vulnerability has been identified in IBM Cloud Orchestrator 2.3, 2.3.0.1, 2.4, and 2.4.0.1 that could allow an attacker after authentication to enumerate val… |
CVE-2014-6049 | Low | 2.7 | 2018-08-28 | phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter. |
CVE-2018-1644 | Low | 3.1 | 2018-08-27 | IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 9.0.0.0 - 9.0.0.4, 8.0.0.0 - 8.0.0.19, 8.0.1.0 - 8.0.1.13, 8.0.3.0 - 8.0.3.6, 8.0.4.0 -… |
CVE-2018-11065 | Low | 2.7 | 2018-08-24 | The WorkPoint component, which is embedded in all RSA Archer, versions 6.1.x, 6.2.x, 6.3.x prior to 6.3.0.7 and 6.4.x prior to 6.4.0.1, contains a SQL injectio… |
CVE-2018-14799 | Low | 3.7 | 2018-08-22 | In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, the PageWriter device does not sanitize data entered by user… |
CVE-2018-8370 | Low | 3.1 | 2018-08-15 | A information disclosure vulnerability exists when WebAudio Library improperly handles audio requests, aka "Microsoft Edge Information Disclosure Vulnerability… |
CVE-2016-2922 | Low | 3.7 | 2018-08-13 | IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages, EmailRelay) fails to check the SSL certificate against the requested hos… |
CVE-2018-6556 | Low | 3.3 | 2018-08-10 | lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to che… |
CVE-2017-2654 | Low | 3.7 | 2018-08-06 | jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created l… |
CVE-2018-1551 | Low | 3.1 | 2018-08-06 | IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more authority than they should have if an MQ administrator crea… |
CVE-2016-8609 | Low | 3.7 | 2018-08-01 | It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from… |
CVE-2016-9580 | Low | 3.3 | 2018-08-01 | An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow. |
CVE-2016-8651 | Low | 3.1 | 2018-08-01 | An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull a… |
CVE-2016-9581 | Low | 3.3 | 2018-08-01 | An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2. |
CVE-2016-8623 | Low | 3.3 | 2018-08-01 | A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosur… |
CVE-2016-8616 | Low | 3.7 | 2018-08-01 | A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the exist… |
CVE-2016-8617 | Low | 3.3 | 2018-07-31 | The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `… |
CVE-2016-8622 | Low | 3.7 | 2018-07-31 | The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a… |
CVE-2018-7957 | Low | 3.3 | 2018-07-31 | Huawei smartphones with software Victoria-AL00 8.0.0.336a(C00) have an information leakage vulnerability. Because an interface does not verify authorization co… |
CVE-2018-7947 | Low | 3.9 | 2018-07-31 | Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication bypass vulnerability. An attacker could trick the user to c… |
CVE-2017-2658 | Low | 2.6 | 2018-07-27 | It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3… |
CVE-2017-2651 | Low | 3.7 | 2018-07-27 | jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of us… |