Archive
August 2018
Vulnerabilities first published in this month (UTC), newest first.
90 results · Clear filters · Feed
-
Unscored —
Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2…
-
Unscored —
Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows att…
-
High 8.1CVE-2018-10936 Public exploit
Moderate severity vulnerability that affects org.postgresql:pgjdbc-aggregate
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker coul…
-
Unscored —
Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different cu…
-
Unscored —
Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.
-
Unscored —CVE-2018-16134 Public exploit
Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI.
-
Unscored —
An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (wh…
-
Unscored —CVE-2018-15912 Public exploit
An issue was discovered in manjaro-update-system.sh in manjaro-system 20180716-1 on Manjaro Linux. A local attacker can…
-
Critical 9.8
Grafana Authentication Bypass
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
-
Unscored —
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead …
-
Unscored —CVE-2018-8004 Public exploit
There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apach…
-
Unscored —CVE-2018-6643 Public exploit
Infoblox NetMRI 7.1.1 has Reflected Cross-Site Scripting via the /api/docs/index.php query parameter.
-
Unscored —CVE-2018-15596 Public exploit
An issue was discovered in inc/class_feedgeneration.php in MyBB 1.8.17. On the forum RSS Syndication page, one can gene…
-
Unscored —CVE-2018-15884 Public exploit
RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.
-
Unscored —CVE-2018-15608 Public exploit
Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen.
-
Unscored —CVE-2018-15740 Public exploit
Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen.
-
Unscored —
D-Link DIR-615 devices have a buffer overflow via a long Authorization HTTP header.
-
Unscored —CVE-2014-6046 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack t…
-
Unscored —CVE-2014-6045 Public exploit
SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to exe…
-
Unscored —CVE-2014-6047 Public exploit
phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leve…
-
Unscored —CVE-2014-6050 Public exploit
phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request.
-
Unscored —CVE-2014-6048 Public exploit
phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request.
-
Unscored —CVE-2014-6049 Public exploit
phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted in…
-
Unscored —CVE-2018-0715 Public exploit
Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inj…
-
Unscored —CVE-2017-18345 Public exploit
The Joomanager component through 2.0.0 for Joomla! has an arbitrary file download issue, resulting in exposing the cred…
-
Unscored —
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell met…
-
Unscored —CVE-2018-15844 Public exploit
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's pa…
-
High 8.8CVE-2018-15845 Public exploit
Gleez CMS CSRF Allows Adding of Administrator Accounts
There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add.
-
Medium 5.4CVE-2018-14059 Public exploit
Pimcore XSS Vulnerability
Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions.
-
Unscored —CVE-2018-11502 Public exploit
An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display …
-
Unscored —CVE-2018-15576 Public exploit
An issue was discovered in EasyLogin Pro through 1.3.0. Encryptor.php contains an unserialize call that can be exploite…
-
Critical 9.8
Command Injection in egg-scripts
A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument.
-
Unscored —CVE-2018-15536 Public exploit
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in ar…
-
Unscored —
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname…
-
Unscored —
libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a deni…
-
Unscored —CVE-2018-15499 Public exploit
GEAR Software products that include GEARAspiWDM.sys, 2.2.5.0, allow local users to cause a denial of service (Race Cond…
-
Unscored —CVE-2018-1156 Public exploit
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface…
-
High 8.1
Electron webPreferences vulnerability can be used to perform remote code execution
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code executio…
-
High 8.1
Apache Struts vulnerable to remote command execution (RCE) due to improper input validation
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upp…
KEV Nov 3, 2021 -
Unscored —CVE-2018-15533 Public exploit
A reflected cross-site scripting vulnerability exists in Geutebrueck re_porter 16 before 7.8.974.20 by appending a quer…