Archive
24 August 2018
Vulnerabilities first published on this day (UTC), newest first.
34 results · Feed
-
Medium 5.4CVE-2018-14059 Public exploit
Pimcore XSS Vulnerability
Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions.
-
Unscored —CVE-2018-11502 Public exploit
An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display …
-
Unscored —
Information disclosure in Netwave IP camera at //etc/RT2870STA.dat (via HTTP on port 8000) allows an unauthenticated at…
-
Unscored —
Information disclosure in Netwave IP camera at get_status.cgi (via HTTP on port 8000) allows an unauthenticated attacke…
-
Unscored —CVE-2018-15576 Public exploit
An issue was discovered in EasyLogin Pro through 1.3.0. Encryptor.php contains an unserialize call that can be exploite…
-
Unscored —
The National Payments Corporation of India BHIM application 1.3 for Android relies on three hardcoded strings (AK-NPCIM…
-
Unscored —
The National Payments Corporation of India BHIM application 1.3 for Android relies on a four-digit passcode, which make…
-
Unscored —
The National Payments Corporation of India BHIM application 1.3 for Android uses a custom keypad for which the input el…
-
Unscored —
The National Payments Corporation of India BHIM application 1.3 for Android does not properly restrict use of the OTP f…
-
Critical 9.8
Command Injection in egg-scripts
A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument.
-
Unscored —CVE-2018-15536 Public exploit
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in ar…
-
Unscored —
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname…
-
Unscored —
libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a deni…
-
Unscored —CVE-2018-15499 Public exploit
GEAR Software products that include GEARAspiWDM.sys, 2.2.5.0, allow local users to cause a denial of service (Race Cond…
-
Unscored —
Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenti…
-
Medium 6.1
phpMyAdmin Cross-site Scripting (XSS) in the import dialog
An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature.
-
Unscored —
An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-o…
-
Unscored —
An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as sig…
-
Unscored —
An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in…
-
Unscored —
The D-Link EyeOn Baby Monitor (DCS-825L) 1.08.1 has multiple command injection vulnerabilities in the web service frame…
-
Unscored —
D-Link EyeOn Baby Monitor (DCS-825L) 1.08.1 has a remote code execution vulnerability. A UDP "Discover" service, which …
-
Unscored —
An issue was discovered on the PLANEX CS-QR20 1.30. A hardcoded account / password ("admin:password") is used in the An…
-
Unscored —
An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. The device has a command-injection vuln…
-
Unscored —
An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. A hardcoded credential "supervisor:dang…
-
Unscored —
An issue was discovered on the PLANEX CS-QR20 1.30. A hidden and undocumented management page allows an attacker to exe…
-
Unscored —
An issue was discovered on the NEC Aterm WG2600HP2 1.0.2. The router has a set of web service APIs for access to and se…
-
Critical 9.1
RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable t…
-
Low 2.7
The WorkPoint component, which is embedded in all RSA Archer, versions 6.1.x, 6.2.x, 6.3.x prior to 6.3.0.7 and 6.4.x p…
-
Unscored —
When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext …
-
Critical 10.0
IBM Security Access Manager Appliance 9.0.4.0 and 9.0.5.0 could allow remote code execution when Advanced Access Contro…
-
Medium 5.9
IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by incor…
-
Medium 6.3
IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to SQL injection. A remote attacker could send specially-cr…
-
Critical 9.1
An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-E…
-
Critical 9.1
An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-E…