Archive
April 2018
Vulnerabilities first published in this month (UTC), newest first.
142 results · Clear filters · Feed
-
Unscored —CVE-2018-10576 Public exploit
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Improper authentic…
-
Unscored —CVE-2018-10575 Public exploit
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Hardcoded credenti…
-
Unscored —
The Norton Core router prior to v237 may be susceptible to a command injection exploit. This is a type of attack in whi…
-
Unscored —CVE-2018-10546 Public exploit
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infi…
-
Unscored —
In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code e…
-
Unscored —
An issue was discovered in Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 and above. The 'Log Viewer' applicatio…
-
Unscored —CVE-2018-10504 Public exploit
The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.
-
Unscored —CVE-2018-7465 Public exploit
An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed b…
-
Unscored —
IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IB…
-
Unscored —CVE-2018-6518 Public exploit
Composr CMS 10.0.13 has XSS via the site_name parameter in a page=admin-setupwizard&type=step3 request to /adminzone/in…
-
High 8.1
Command injection in org.apache.tika:tika-core
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a se…
-
Unscored —
WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.
-
Medium 6.1CVE-2018-10366 Public exploit
User Plugin for October CSS Allows XSS
An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.
-
Unscored —CVE-2018-10310 Public exploit
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Cons…
-
Medium 6.6
Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems
Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible…
-
Unscored —CVE-2017-7651 Public exploit
In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of co…
-
Unscored —CVE-2018-10321 Public exploit
Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings.
-
Unscored —CVE-2018-10309 Public exploit
The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS.
-
Unscored —CVE-2018-10311 Public exploit
A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbit…
-
Unscored —CVE-2018-10313 Public exploit
WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq_10%5D parameter to the /index.php?m=member&f=index&v=profile&se…
-
Unscored —CVE-2018-10312 Public exploit
index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member.
-
Unscored —
Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing t…
-
Unscored —CVE-2018-10299 Public exploit
An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin (BEC), t…
-
Unscored —CVE-2018-9245 Public exploit
The Ericsson-LG iPECS NMS A.1Ac login portal has a SQL injection vulnerability in the User ID and password fields that …
-
Unscored —CVE-2018-10286 Public exploit
The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and t…
-
Unscored —
The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since the app does not use an…
-
Unscored —CVE-2018-10253 Public exploit
Paessler PRTG Network Monitor before 18.1.39.1648 mishandles stack memory during unspecified API calls.
-
Unscored —CVE-2018-7747 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow r…
-
Unscored —
Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code…
-
Unscored —CVE-2018-10079 Public exploit
Geist WatchDog Console 3.2.2 uses a weak ACL for the C:\ProgramData\WatchDog Console directory, which allows local user…
-
Unscored —CVE-2018-10078 Public exploit
Cross-site scripting (XSS) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to …
-
Unscored —CVE-2018-10077 Public exploit
XML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to r…
-
Unscored —
An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11. It is possible …
-
Unscored —CVE-2018-0239 Public exploit
A vulnerability in the egress packet processing functionality of the Cisco StarOS operating system for Cisco Aggregatio…
-
High 8.8CVE-2018-10188 Public exploit
phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php.
-
Unscored —CVE-2018-9137 Public exploit
Open-AudIT before 2.2 has CSV Injection.
-
Critical 9.8
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). …
KEV Sep 8, 2022 -
Unscored —
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine).…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supporte…
-
Unscored —CVE-2018-2844 Public exploit
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions t…