Archive
January 2018
Vulnerabilities first published in this month (UTC), newest first.
163 results · Clear filters · Feed
-
Unscored —
MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers to obtain sensitive information via a crafted HTTP request,…
-
Unscored —CVE-2018-5725 Public exploit
MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Change, as demonstrated by the port number of …
-
Unscored —CVE-2018-5723 Public exploit
MASTER IPCAMERA01 3.3.4.2103 devices have a hardcoded password of cat1029 for the root account.
-
Unscored —
MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Download and Upload, as demonstrated by restor…
-
Unscored —
phprint.php in SugarCRM 3.5.1 has XSS via a parameter name in the query string (aka a $key variable).
-
Unscored —CVE-2018-5370 Public exploit
BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI.
-
Unscored —CVE-2017-8802 Public exploit
Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.8.0 Beta2 might allow remote …
-
Unscored —
gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1…
-
Unscored —
Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access co…
-
Unscored —CVE-2018-5479 Public exploit
FoxSash ImgHosting 1.5 (according to footer information) is vulnerable to XSS attacks. The affected function is its sea…
-
Unscored —CVE-2018-5688 Public exploit
ILIAS before 5.2.4 has XSS via the cmd parameter to the displayHeader function in setup/classes/class.ilSetupGUI.php in…
-
Unscored —CVE-2017-13208 Public exploit
In receive_packet of libnetutils/packet.c, there is a possible out-of-bounds write due to a missing bounds check on the…
-
Unscored —CVE-2017-13209 Public exploit
In the ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on th…
-
Unscored —CVE-2017-13216 Public exploit
In ashmem_ioctl of ashmem.c, there is an out-of-bounds write due to insufficient locking when accessing asma. This coul…
-
Unscored —
A stack-based buffer overflow in Flexense DiskBoss 8.8.16 and earlier allows unauthenticated remote attackers to execut…
-
Unscored —CVE-2018-5315 Public exploit
The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.
-
Unscored —
cgi-bin/AZ_Retrain.cgi in Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices does not check for authentication…
-
Unscored —
Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices allow remote attackers to obtain sensitive device configura…
-
Unscored —
Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices improperly manage sessions, which allows remote attackers t…
-
Unscored —CVE-2017-16886 Public exploit
The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interac…
-
Unscored —
The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interac…
-
Unscored —
Improper Permissions Handling in the Portal on FiberHome LM53Q1 VH519R05C01S38 devices (intended for obtaining informat…
-
Unscored —CVE-2017-17970 Public exploit
Multiple SQL injection vulnerabilities in Muviko 1.1 allow remote attackers to execute arbitrary SQL commands via the (…
-
Unscored —
Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs…
-
Unscored —CVE-2012-0699 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow r…
-
Unscored —CVE-2018-5189 Public exploit
Race condition in Jungo Windriver 12.5.1 allows local users to cause a denial of service (buffer overflow) or gain syst…
-
Unscored —CVE-2012-6667 Public exploit
Cross-site scripting (XSS) vulnerability in vbshout.php in DragonByte Technologies vBShout module for vBulletin allows …
-
Unscored —CVE-2017-18016 Public exploit
Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive informa…
-
Unscored —CVE-2018-5333 Public exploit
In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning…
-
Critical 9.8
jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readVa…
-
Unscored —CVE-2017-15664 Public exploit
In Flexense Sync Breeze Enterprise v10.1.16, the Control Protocol suffers from a denial of service vulnerability. The a…
-
Unscored —
In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability. The at…
-
Unscored —CVE-2017-15662 Public exploit
In Flexense VX Search Enterprise v10.1.12, the Control Protocol suffers from a denial of service vulnerability. The att…
-
Unscored —CVE-2017-15665 Public exploit
In Flexense DiskBoss Enterprise 8.5.12, the Control Protocol suffers from a denial of service vulnerability. The attack…
-
Unscored —
IBM QRadar 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be …
-
High 8.8
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow…
KEV Nov 3, 2021 -
High 7.8
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow…
KEV Nov 3, 2021 -
Unscored —CVE-2018-5211 Public exploit
PHP Melody version 2.7.1 suffer from SQL Injection Time-based attack on the page ajax.php with the parameter playlist.
-
Unscored —CVE-2018-5263 Public exploit
The StackIdeas EasyDiscuss (aka com_easydiscuss) extension before 4.0.21 for Joomla! allows XSS.
-
Unscored —
Buffer overflow in TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (…