Archive
30 August 2018
Vulnerabilities first published on this day (UTC), newest first.
56 results · Feed
-
Unscored —
Michael Roth Software Personal FTP Server (PFTP) through 8.4f allows remote attackers to cause a denial of service (dae…
-
Unscored —
An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.…
-
Unscored —
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.
-
Unscored —
An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST t…
-
Unscored —
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is…
-
Unscored —
MorningStar WhatWeb 0.4.9 has XSS via JSON report files.
-
Unscored —
An issue was discovered in damiCMS V6.0.1. It relies on the PHP time() function for cookies, which makes it possible to…
-
High 8.8
Micro Focus Container Deployment Foundation (CDF), Remote Code Execution
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, …
-
High 7.1
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM…
-
Unscored —
A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG (1…
-
Unscored —
An Out-of-Bounds Read Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a…
-
Unscored —
A Missing Impersonation Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow…
-
Unscored —
A Deserialization of Untrusted Data Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products…
-
Unscored —
An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, …
-
Unscored —
Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2…
-
Unscored —
myStrom WiFi Switch V1 devices before 2.66 did not sanitize a parameter received from the cloud that was used in an OS …
-
Unscored —
An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, …
-
Unscored —
An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, …
-
Unscored —
An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, …
-
Unscored —
The EPSON iPrint application 6.6.3 for Android contains hard-coded API and Secret keys for the Dropbox, Box, Evernote a…
-
Unscored —
The ContentProvider in the EPSON iPrint application 6.6.3 for Android does not properly restrict data access. This allo…
-
Unscored —
On the EPSON WF-2750 printer with firmware JP02I2, the Web interface AirPrint Setup page is vulnerable to HTML Injectio…
-
Unscored —
On EPSON WF-2750 printers with firmware JP02I2, there is no filtering of print jobs. Remote attackers can send print jo…
-
Unscored —
EPSON WF-2750 printers with firmware JP02I2 do not properly validate files before running updates, which allows remote …
-
Unscored —
Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow Directory Traversal.
-
Unscored —
Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow XXE.
-
Unscored —
Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow CSRF.
-
Low 3.1
IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD RES…
-
Medium 4.0
IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous u…
-
Low 3.3
A vulnerability has been identified in IBM Cloud Orchestrator 2.3, 2.3.0.1, 2.4, and 2.4.0.1 that could allow an attack…
-
Unscored —CVE-2018-16159 EPSS 49%
The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/a…
-
Unscored —
An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below…
-
Unscored —
A hardcoded passphrase, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensi…
-
Unscored —
An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below…
-
Unscored —
A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to con…
-
Unscored —
Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP…
-
Unscored —
A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensi…
-
Unscored —
Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and …
-
Unscored —
Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, al…
-
Unscored —
Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows att…