Archive
July 2018
Vulnerabilities first published in this month (UTC), newest first.
92 results · Clear filters · Feed
-
Unscored —
Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could all…
-
Unscored —
The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated remote code…
-
Unscored —
The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclo…
-
Unscored —
The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../.…
-
Unscored —
D-Link DIR routers contain a stack-based buffer overflow in the HNAP Login action
Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action, Username, LoginPassword, and Captcha. The following products…
-
Unscored —
The Sungard eTRAKiT3 software version 3.2.1.17 may be vulnerable to SQL injection which may allow a remote unauthenticated attacker to run a subset of SQL commands against the back-end database
The valueAsString parameter inside the JSON payload contained by the ucLogin_txtLoginId_ClientStat POST parameter of the Sungard eTRAKiT3 software version 3.2.1.17 is not properly validated. An unauthenticated remote attacker may be able to modify the POST re…
-
Unscored —CVE-2018-10018 Public exploit
The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G DATA Total Security 25.4.0.3 has a buffer overflow via a l…
-
Medium 6.1CVE-2018-14042 Public exploit
Bootstrap Cross-site Scripting vulnerability
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
-
Medium 6.1CVE-2018-14041 Public exploit
Bootstrap Cross-site Scripting vulnerability
In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.
-
Medium 6.1CVE-2018-14040 Public exploit
Bootstrap vulnerable to Cross-Site Scripting (XSS)
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
-
Unscored —CVE-2018-14029 Public exploit
CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as de…
-
Unscored —CVE-2018-13441 Public exploit
qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows att…
-
Unscored —CVE-2018-13458 Public exploit
qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers t…
-
Unscored —CVE-2018-13457 Public exploit
qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers t…
-
Unscored —CVE-2018-12979 Public exploit
An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. Weak permission…
-
Unscored —CVE-2018-12981 Public exploit
An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerabili…
-
Unscored —
An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerabili…
-
High 7.3
MFSBGN03811 rev.1 - Fortify Software Security Center (SSC), Multiple vulnerabilities
An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML reques…
-
Critical 9.8
Codiad remote code execution vulnerability
Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689.
-
High —CVE-2018-12540 Public exploit
High severity vulnerability that affects io.vertx:vertx-web
In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet.
-
Unscored —
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute ar…
-
Unscored —CVE-2018-13989 Public exploit
Grundig Smart Inter@ctive TV 3.0 devices allow CSRF attacks via a POST request to TCP port 8085 containing a predictabl…
-
Unscored —
Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote…
-
Unscored —
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".…
-
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is…
-
Unscored —
A remote code execution vulnerability exists in Visual Studio software when the software does not check the source mark…
-
Unscored —
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft …
-
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is…
-
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, C…
KEV Mar 3, 2022 -
Unscored —CVE-2018-13849 Public exploit
edit_requests.php in yTakkar Instagram-clone through 2018-04-23 has XSS via an onmouseover payload because of an inadeq…
-
Critical 9.8CVE-2018-13797 Public exploit
Command Injection in macaddress
The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.
-
High 7.5CVE-2016-10726 Public exploit
High severity vulnerability that affects org.dspace:dspace-xmlui
The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd UR…
-
Unscored —
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlie…
-
Unscored —
PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowf…
-
Unscored —CVE-2018-13410 Public exploit
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (inv…
-
Unscored —CVE-2018-3608 Public exploit
A vulnerability in Trend Micro Maximum Security's (Consumer) 2018 (versions 12.0.1191 and below) User-Mode Hooking (UMH…
-
Unscored —CVE-2018-5873 Public exploit
An issue was discovered in the __ns_get_path function in fs/nsfs.c in the Linux kernel before 4.11. Due to a race condi…
-
Unscored —CVE-2018-11124 Public exploit
Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allow…
-
Unscored —CVE-2018-13110 Public exploit
All ADB broadband gateways / routers based on the Epicentro platform are affected by a privilege escalation vulnerabili…
-
Unscored —CVE-2018-13108 Public exploit
All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerabili…