Archive
May 2018
Vulnerabilities first published in this month (UTC), newest first.
104 results · Clear filters · Feed
-
Medium 5.5
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addre…
-
Unscored —CVE-2018-11339 Public exploit
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.
-
Unscored —
A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attac…
-
Unscored —CVE-2018-11242 Public exploit
An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypt…
-
Unscored —
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability. Successful exp…
-
Unscored —
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful ex…
-
Unscored —
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Heap Overflow vulnerability. Successful exploita…
-
Unscored —
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful ex…
-
High 7.5
DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.…
-
Unscored —CVE-2018-9951 Public exploit
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.…
-
Unscored —CVE-2018-9950 Public exploit
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…
-
Unscored —
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…
-
Unscored —
p910nd on Inteno IOPSYS 2.0 through 4.2.0 allows remote attackers to read, or append data to, arbitrary files via reque…
-
Medium 4.7CVE-2018-1263 Public exploit
spring-integration-zip Arbitrary File Write
Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cp…
-
Unscored —
An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/Reb…
-
Unscored —CVE-2018-11034 Public exploit
In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of se…
-
Unscored —CVE-2018-6023 Public exploit
Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi ac…
-
Unscored —CVE-2018-10832 Public exploit
ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack. Projects are saved as .xmpp files and automations …
-
High 7.5CVE-2018-1259 Public exploit
Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying li…
-
Critical 9.8
Spring Security OAuth vulnerable to remote code execution (RCE)
Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to t…
-
Unscored —CVE-2018-10580 Public exploit
The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that disp…
-
Unscored —
DLPnpAuditor.exe in DeviceLock Plug and Play Auditor (freeware) 5.72 has a Unicode Buffer Overflow (SEH).
-
Unscored —CVE-2018-8060 Public exploit
HWiNFO AMD64 Kernel driver version 8.98 and lower allows an unprivileged user to send an IOCTL to the device driver. If…
-
Unscored —CVE-2018-10314 Public exploit
Cross-site scripting (XSS) vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web …
-
Unscored —CVE-2018-10949 Public exploit
mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration b…
-
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018…
-
Unscored —
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsof…
-
Unscored —CVE-2018-0959 Public exploit
A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input fro…
-
High 7.5
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized…
KEV Aug 5, 2024 -
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018…
-
High 7.5
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Window…
KEV Feb 15, 2022 -
High 7.5
ChakraCore information disclosure vulnerability
An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user's computer or data, aka "Chakra Scripting Engine Memory Corruption Vuln…
-
High 7.0
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Mar 15, 2022 -
Unscored —CVE-2018-8134 Public exploit
An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Window…
-
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
Unscored —CVE-2018-10828 Public exploit
An issue was discovered in Alps Pointing-device Driver 10.1.101.207. ApMsgFwd.exe allows the current user to map and wr…
-
Unscored —CVE-2018-10830 Public exploit
In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of ser…
-
Unscored —
Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrar…
-
Unscored —
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) w…