Archive
14 June 2018
Vulnerabilities first published on this day (UTC), newest first.
71 results · Feed
-
Unscored —
SeaCMS V6.61 has XSS via the site name parameter on an adm1n/admin_config.php page (aka a system management page).
-
Medium 6.1
Cross-site Scripting in JavaMelody
JavaMelody through 1.60.0 has XSS via the counter parameter in a clear_counter action to the /monitoring URI.
-
High 7.5
Matrix Synapse Authorization Error
In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.
-
Unscored —
IceHrm before 23.0.1.OS has a risky usage of a hashed password in a request.
-
Unscored —
On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-cl…
-
Unscored —CVE-2018-11690 EPSS 33%
The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, ca…
-
Unscored —
Web Viewer for Hanwha DVR 2.17 and Smart Viewer in Samsung Web Viewer for Samsung DVR are vulnerable to XSS via the /cg…
-
Critical 9.8
Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a …
-
Unscored —
An XXE issue was discovered in Automated Logic Corporation (ALC) WebCTRL Versions 6.0, 6.1 and 6.5. An unauthenticated …
-
Unscored —
Unsigned versions of the DLLs distributed by the OPC Foundation may be replaced with malicious code.
-
Unscored —
LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old pa…
-
Unscored —CVE-2018-12114 Public exploit
Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.
-
Unscored —
A vulnerability has been identified in RFID 181EIP (All versions), RUGGEDCOM Win (V4.4, V4.5, V5.0, and V5.1), SCALANCE…
-
Medium 5.5CVE-2018-12418 Public exploit
Junrar vulnerable to Infinite Loop
Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an infinite loop when handling corrupt RAR files.
-
Unscored —CVE-2018-10821 Public exploit
Cross-site scripting (XSS) vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated use…
-
Medium 5.4
Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users …
-
Unscored —
Huawei smart phones LYO-L21 with software LYO-L21C479B107, LYO-L21C479B107 have a privilege escalation vulnerability. A…
-
Unscored —
Huawei HG255s-10 V100R001C163B025SP02 has a path traversal vulnerability due to insufficient validation of the received…
-
Unscored —
Due to insufficient parameters verification GPU driver of Mate 9 Pro Huawei smart phones with the versions before LON-A…
-
Unscored —CVE-2018-0978 EPSS 16%
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Interne…
-
Unscored —CVE-2018-0982 Public exploit
An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Window…
-
Unscored —
An information disclosure vulnerability exists when Edge improperly marks files, aka "Microsoft Edge Information Disclo…
-
Unscored —
A denial of service vulnerability exists in the way that the Windows Code Integrity Module performs hashing, aka "Windo…
-
Unscored —
An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vul…
-
Unscored —
An Elevation of Privilege vulnerability exists when Cortana retrieves data from user input services without considerati…
-
Unscored —
An elevation of privilege vulnerability exists when the (Human Interface Device) HID Parser Library driver improperly h…
-
Unscored —
A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code in…
-
High 7.5CVE-2018-8243 EPSS 12%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8267.
-
Unscored —
A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka "Windows Remote Cod…
-
Unscored —
An elevation of privilege vulnerability exists when Windows Hyper-V instruction emulation fails to properly enforce pri…
-
Unscored —CVE-2018-8226 EPSS 14%
A denial of service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys) when HTTP.sys improperly parses spec…
-
Unscored —
An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft…
-
Unscored —CVE-2018-8208 Public exploit
An elevation of privilege vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual regi…
-
Unscored —
An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, ak…
-
Unscored —
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
-
Unscored —CVE-2018-8245 EPSS 17%
A remote code execution vulnerability exists when Microsoft Publisher fails to utilize features that lock down the Loca…
-
Unscored —
A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code in…
-
Unscored —
A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mark of the Web Tagging (…
-
Unscored —CVE-2018-8231 EPSS 17%
A remote code execution vulnerability exists when HTTP Protocol Stack (Http.sys) improperly handles objects in memory, …
-
Unscored —
A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code in…