Archive
August 2018
Vulnerabilities first published in this month (UTC), newest first.
1,015 results · Feed
-
Unscored —
OCS Inventory 2.4.1 contains multiple SQL injections in the search engine. Authentication is needed in order to exploit…
-
Unscored —
PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, St…
-
Unscored —
OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be …
-
Unscored —CVE-2018-14497 Public exploit
Tenda D152 ADSL routers allow XSS via a crafted SSID.
-
Unscored —
A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particu…
-
Unscored —
An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x throu…
-
High 8.8
IBM Maximo Asset Management 7.6 through 7.6.3 installs with a default administrator account that a remote intruder coul…
-
Unscored —
IntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit the vulnerability …
-
Unscored —
CA API Developer Portal 4.x, prior to v4.2.5.3 and v4.2.7.1, has an unspecified reflected cross-site scripting vulnerab…
-
Unscored —
NetApp 7-Mode Transition Tool allows users with valid credentials to access functions and information which may have be…
-
Unscored —
An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsin…
-
Unscored —
An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. An Inte…
-
Unscored —
An issue was discovered in Rincewind 0.1. There is a cross-site scripting (XSS) vulnerability involving a p=account req…
-
Unscored —
An issue was discovered in Rincewind 0.1. A reinstall vulnerability exists because the parameter p of index.php and ano…
-
Unscored —
An issue was discovered in WeaselCMS v0.3.5. XSS exists via Site Language, Site Title, Site Description, and Site Keywo…
-
Unscored —
An issue was discovered in image_save_png in image/image-png.cpp in Free Lossless Image Format (FLIF) 0.3. Attackers ca…
-
Medium 5.4
paypal/invoice-sdk-php reflected XSS
paypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter, resulting in code execution.
-
Medium 5.4
paypal/permissions-sdk-php reflected Cross-site Scripting (XSS)
paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification_code parameter, resulting in code execution.
-
Unscored —
An SSRF vulnerability was discovered in idreamsoft iCMS before V7.0.11 because the remote function in app/spider/spider…
-
Unscored —
In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to auto…
-
Unscored —
In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to …
-
High 8.7
An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. The firmw…
-
Unscored —
exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
Medium 6.4
An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted …
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware vers…
-
High 8.5
An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server imple…
-
High 8.5
An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP …
-
Medium 5.4
An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server imple…
-
Medium 4.3
Certain input files may trigger an integer overflow in ttembed input file processing. This overflow could potentially l…
-
High 7.5
An input validation flaw exists in ttembed. With a crafted input file, an attacker may be able to trigger a denial of s…
-
Unscored —
Monitorix before 3.10.1 allows XSS via CGI variables.