Archive
August 2018
Vulnerabilities first published in this month (UTC), newest first.
1,015 results · Feed
-
Unscored —
An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state…
-
Unscored —
NVIDIA GeForce Experience all versions prior to 3.14.1 contains a potential vulnerability during GameStream installatio…
-
Unscored —
NVIDIA GeForce Experience all versions prior to 3.14.1 contains a potential vulnerability when GameStream is enabled wh…
-
Unscored —
NVIDIA GeForce Experience all versions prior to 3.14.1 contains a potential vulnerability when GameStream is enabled, a…
-
Medium 4.4
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Imprope…
-
Medium 6.5
RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.…
-
Medium 5.9
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x) contains a Covert Ti…
-
High 7.5
RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability. A remote attacker could use m…
-
Unscored —
phpkaiyuancms PhpOpenSourceCMS (POSCMS) V3.2.0 allows an unauthenticated user to execute arbitrary SQL commands via the…
-
Unscored —
An issue was discovered in yurex_read in drivers/usb/misc/yurex.c in the Linux kernel before 4.17.7. Local attackers co…
-
High 7.5
simplehttpserver allows directory traversal and file listing
Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.
-
High 7.8
libzypp does not reevaluate malicious rpms once downloaded
The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only di…
-
Unscored —
OPSWAT MetaDefender before v4.11.2 allows CSV injection.
-
Unscored —
Michael Roth Software Personal FTP Server (PFTP) through 8.4f allows remote attackers to cause a denial of service (dae…
-
Unscored —
An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.…
-
Unscored —
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.
-
Unscored —
An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST t…
-
Unscored —
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is…
-
Unscored —
MorningStar WhatWeb 0.4.9 has XSS via JSON report files.
-
Unscored —
An issue was discovered in damiCMS V6.0.1. It relies on the PHP time() function for cookies, which makes it possible to…
-
High 8.8
Micro Focus Container Deployment Foundation (CDF), Remote Code Execution
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, …
-
High 7.1
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM…
-
Unscored —
A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG (1…
-
Unscored —
An Out-of-Bounds Read Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a…
-
Unscored —
A Missing Impersonation Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow…
-
Unscored —
A Deserialization of Untrusted Data Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products…
-
Unscored —
An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, …
-
Unscored —
Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2…
-
Unscored —
myStrom WiFi Switch V1 devices before 2.66 did not sanitize a parameter received from the cloud that was used in an OS …
-
Unscored —
An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, …
-
Unscored —
An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, …
-
Unscored —
An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, …
-
Unscored —
The EPSON iPrint application 6.6.3 for Android contains hard-coded API and Secret keys for the Dropbox, Box, Evernote a…
-
Unscored —
The ContentProvider in the EPSON iPrint application 6.6.3 for Android does not properly restrict data access. This allo…
-
Unscored —
On the EPSON WF-2750 printer with firmware JP02I2, the Web interface AirPrint Setup page is vulnerable to HTML Injectio…
-
Unscored —
On EPSON WF-2750 printers with firmware JP02I2, there is no filtering of print jobs. Remote attackers can send print jo…
-
Unscored —
EPSON WF-2750 printers with firmware JP02I2 do not properly validate files before running updates, which allows remote …
-
Unscored —
Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow Directory Traversal.
-
Unscored —
Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow XXE.
-
Unscored —
Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow CSRF.