Archive
January 2018
Vulnerabilities first published in this month (UTC), newest first.
163 results · Clear filters · Feed
-
Unscored —CVE-2018-6479 Public exploit
An issue was discovered on Netwave IP Camera devices. An unauthenticated attacker can crash a device by sending a POST …
-
Unscored —CVE-2017-16928 Public exploit
The arq_updater binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently …
-
Unscored —CVE-2017-16945 Public exploit
The standardrestorer binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and conseque…
-
Unscored —
In Iolo System Shield AntiVirus and AntiSpyware 5.0.0.136, the amp.sys driver file contains an Arbitrary Write vulnerab…
-
Unscored —CVE-2014-1631 Public exploit
Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php.
-
Unscored —
htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the…
-
Unscored —
Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. The web server uses JSONP and hosts se…
-
Unscored —
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before t…
-
Unscored —
An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. An unauthenticated attacker can crash a devi…
-
Unscored —
BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) o…
-
Unscored —
BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService…
-
Unscored —CVE-2018-6376 Public exploit
In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerabili…
-
Unscored —CVE-2018-6395 Public exploit
SQL Injection exists in the Visual Calendar 3.1.3 component for Joomla! via the id parameter in a view=load action.
-
Unscored —CVE-2018-6398 Public exploit
SQL Injection exists in the CP Event Calendar 3.0.1 component for Joomla! via the id parameter in a task=load action.
-
Unscored —
Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter.
-
Unscored —
A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Soft…
-
Unscored —
Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but…
-
Unscored —CVE-2018-6388 Public exploit
iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices allow remote authenticated users to execute arbitrary OS command…
-
Critical 9.8
Deserialization of Untrusted Data in Jenkins
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the…
KEV Oct 2, 2025 -
Unscored —
Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file paramete…
-
Unscored —CVE-2018-6363 Public exploit
SQL Injection exists in Task Rabbit Clone 1.0 via the single_blog.php id parameter.
-
Unscored —CVE-2018-6365 Public exploit
SQL Injection exists in TSiteBuilder 1.0 via the id parameter to /site.php, /pagelist.php, or /page_new.php.
-
Unscored —CVE-2018-6364 Public exploit
SQL Injection exists in Multilanguage Real Estate MLM Script through 3.0 via the /product-list.php srch parameter.
-
Unscored —CVE-2018-6007 Public exploit
CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket.
-
Unscored —CVE-2018-6367 Public exploit
SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chat_im/chat_window.php request_id param…
-
Unscored —CVE-2018-5720 Public exploit
An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices. A …
-
Unscored —CVE-2017-18078 Public exploit
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the…
-
Unscored —
In Utilities.php in Perfex CRM 1.9.7, Unrestricted file upload can lead to remote code execution.
-
Unscored —CVE-2017-14521 Public exploit
In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload.
-
Unscored —CVE-2017-14523 Public exploit
WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. N…
-
Unscored —CVE-2018-6323 Public exploit
The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU …
-
Unscored —
SQL Injection exists in Professional Local Directory Script 1.0 via the sellers_subcategories.php IndustryID parameter,…
-
Unscored —
An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056. Due to an unrestricted upload feature and a p…
-
Unscored —CVE-2018-5954 Public exploit
phpFreeChat 1.7 and earlier allows remote attackers to cause a denial of service by sending a large number of connect c…
-
High 8.8
Remote Code Execution in electron
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitra…
-
Medium 5.5CVE-2018-1047 Public exploit
Improper Input Validation in org.wildfly:wildfly-undertow
A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files.
-
Unscored —CVE-2017-1000474 Public exploit
Soyket Chowdhury Vehicle Sales Management System version 2017-07-30 is vulnerable to multiple SQL Injecting in login/ve…
-
Unscored —CVE-2018-6190 Public exploit
Netis WF2419 V3.2.41381 devices allow XSS via the Description field on the MAC Filtering page.
-
Unscored —CVE-2018-6193 Public exploit
A Cross-Site Scripting (XSS) vulnerability was found in Routers2 2.24, affecting the 'rtr' GET parameter in a page=grap…
-
Unscored —CVE-2018-6191 Public exploit
The js_strtod function in jsdtoa.c in Artifex MuJS through 1.0.2 has an integer overflow because of incorrect exponent …