Archive
2 August 2018
Vulnerabilities first published on this day (UTC), newest first.
40 results · Feed
-
Medium 5.4
paypal/invoice-sdk-php reflected XSS
paypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter, resulting in code execution.
-
Medium 5.4
paypal/permissions-sdk-php reflected Cross-site Scripting (XSS)
paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification_code parameter, resulting in code execution.
-
Unscored —
An SSRF vulnerability was discovered in idreamsoft iCMS before V7.0.11 because the remote function in app/spider/spider…
-
Unscored —
In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to auto…
-
Unscored —
In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to …
-
High 8.7
An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. The firmw…
-
Unscored —
exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
Medium 6.4
An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted …
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server imple…
-
High 8.5
An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP …
-
Medium 5.4
An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server imple…
-
Medium 4.3
Certain input files may trigger an integer overflow in ttembed input file processing. This overflow could potentially l…
-
High 7.5
An input validation flaw exists in ttembed. With a crafted input file, an attacker may be able to trigger a denial of s…
-
Unscored —
Monitorix before 3.10.1 allows XSS via CGI variables.
-
Unscored —
PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or p…
-
Unscored —
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
-
Medium 5.4
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra…
-
High 7.5CVE-2018-1336 EPSS 20%
In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to…
-
Medium 5.9CVE-2018-8037 EPSS 11%
Apache Tomcat Race Condition vulnerability
If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NI…
-
Unscored —
Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar w…
-
Medium 6.1
Moderate severity vulnerability that affects apache axis
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
-
High 7.5CVE-2018-10920 Public exploit
Improper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison …
-
Unscored —
Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builde…
-
Unscored —
Vulnerability in the Oracle Fusion Middleware component of Oracle Fusion Middleware (subcomponent: Oracle Notification …
-
Unscored —
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). …
-
Critical 9.1
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated…
KEV Dec 1, 2021 -
Medium 6.1CVE-2018-14840 Public exploit
Subrion CMS Cross-site Scripting
uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).
-
Unscored —
rejucms 2.1 has stored XSS via the admin/book.php content parameter.
-
Unscored —
Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are abl…
-
Medium 5.4
Subrion CMS XSS
Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas.