Archive
28 August 2018
Vulnerabilities first published on this day (UTC), newest first.
54 results · Feed
-
Unscored —
PHP Scripts Mall Website Seller Script 2.0.5 allows remote attackers to cause a denial of service via crafted JavaScrip…
-
Unscored —
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name.
-
High 7.5
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core H…
-
Unscored —
Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote att…
-
Unscored —
A stack buffer overflow in the QUIC networking stack in Google Chrome prior to 62.0.3202.89 allowed a remote attacker t…
-
Unscored —
A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used…
-
Unscored —
A use after free in V8 in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to potentially exploit heap cor…
-
Unscored —
A stack buffer overflow in V8 in Google Chrome prior to 62.0.3202.75 allowed a remote attacker to perform an out of bou…
-
Unscored —CVE-2018-6643 Public exploit
Infoblox NetMRI 7.1.1 has Reflected Cross-Site Scripting via the /api/docs/index.php query parameter.
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of S…
-
Critical 9.1
An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-E…
-
Unscored —
e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including admin…
-
Unscored —
A SQL Injection issue was discovered in Sentrifugo 3.2 via the deptid parameter.
-
Unscored —CVE-2018-15596 Public exploit
An issue was discovered in inc/class_feedgeneration.php in MyBB 1.8.17. On the forum RSS Syndication page, one can gene…
-
Unscored —CVE-2018-15884 Public exploit
RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.
-
Unscored —CVE-2018-15608 Public exploit
Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen.
-
Unscored —CVE-2018-15740 Public exploit
Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen.
-
High 7.8
conference-scheduler-cli Arbitrary Code Execution
In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.
-
Unscored —
Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exp…
-
Unscored —
Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap c…
-
Unscored —
Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to ga…
-
Unscored —
Heap buffer overflow in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit…
-
Unscored —
Inappropriate implementation in Skia canvas composite operations in Google Chrome prior to 63.0.3239.84 allowed a remot…
-
Unscored —
Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap c…
-
Unscored —
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform …
-
Unscored —
Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploi…
-
Unscored —
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to…
-
Unscored —
Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit he…
-
Unscored —
Incorrect serialization in IPC in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the value of a …
-
Unscored —
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as…
-
Unscored —
Incorrect handling of back navigations in error pages in Navigation in Google Chrome prior to 63.0.3239.84 allowed a re…
-
Unscored —
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform …
-
Unscored —
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform …
-
Unscored —
Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker…
-
Unscored —
Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to i…
-
High 8.8
Nokogiri gem, via libxml, is affected by DoS vulnerabilities
Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
-
Unscored —
Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to le…
-
Unscored —
Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentia…
-
Medium 5.3
An exploitable integer underflow vulnerability exists in the ZigBee firmware update routine of the hubCore binary of th…
-
Unscored —
The Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection.