Archive
June 2018
Vulnerabilities first published in this month (UTC), newest first.
125 results · Clear filters · Feed
-
Unscored —
An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leadi…
-
Unscored —CVE-2018-12111 Public exploit
Cross-site scripting (XSS) vulnerability in the Canon PrintMe EFI webinterface allows remote attackers to inject arbitr…
-
Unscored —
A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerabi…
-
Unscored —CVE-2018-12094 Public exploit
Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject ar…
-
Unscored —CVE-2018-12090 Public exploit
There is unauthenticated reflected cross-site scripting (XSS) in LAMS before 3.1 that allows a remote attacker to intro…
-
Unscored —CVE-2018-4240 Public exploit
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS …
-
Unscored —CVE-2018-4242 Public exploit
An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Hypervisor…
-
Unscored —CVE-2018-4206 Public exploit
An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. macOS before 10.13.4 Security Update …
-
Unscored —CVE-2018-4241 Public exploit
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS …
-
Unscored —CVE-2018-4193 Public exploit
An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Windows Se…
-
Unscored —
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS …
-
Unscored —
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iClou…
-
Unscored —CVE-2018-4230 Public exploit
An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "NVIDIA Gra…
-
Unscored —
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS …
-
High 8.8
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iClou…
-
Unscored —
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iClou…
-
Unscored —CVE-2018-4218 Public exploit
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iClou…
-
Unscored —
An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. Safari before 11.1 is affected. iClou…
-
Unscored —
Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json…
-
Unscored —
Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CV…
-
Unscored —
Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.…
-
Unscored —
Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka abso…
-
Unscored —CVE-2018-12055 Public exploit
Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contact_us.p…
-
Unscored —CVE-2018-12052 Public exploit
SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in get_sec.php.
-
Unscored —CVE-2018-10619 Public exploit
An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3…
-
High 7.8CVE-2018-12036 Public exploit
Path Traversal in OWASP Dependency-Check
OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.
-
Unscored —
Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgra…
-
High 7.5
A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, rem…
KEV Nov 3, 2021 -
Critical 10.0CVE-2017-16088 Public exploit
Sandbox Breakout in safe-eval
The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.
-
High —CVE-2017-16086 Public exploit
ReDoS via long UserAgent header in ua-parser
ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial of Service) attack when given a specially crafted UserAgent header.
-
Critical 9.8
Remote Code Execution in pg
A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql whic…
-
Unscored —
XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to r…
-
Unscored —CVE-2016-9488 Public exploit
ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker cou…
-
Unscored —CVE-2018-11736 Public exploit
An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute …
-
Unscored —CVE-2018-11715 Public exploit
The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.
-
Unscored —
An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 0…
-
Unscored —CVE-2018-11522 Public exploit
Yosoro 1.0.4 has stored XSS.
-
Medium 4.8CVE-2018-11564 Public exploit
Pagekit Stored Cross-site Scripting
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will …
-
Unscored —
servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST para…
-
Unscored —CVE-2018-11581 Public exploit
Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web …