Archive
August 2018
Vulnerabilities first published in this month (UTC), newest first.
1,015 results · Feed
-
Unscored —
In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, lead…
-
Unscored —
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess fil…
-
Unscored —
An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress. The register form, login form, and pass…
-
Unscored —
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell met…
-
Unscored —CVE-2018-15844 Public exploit
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's pa…
-
Unscored —
An issue was discovered in portfolioCMS 1.0.5. There is CSRF to create new pages via admin/portfolio.php?newpage=true.
-
Unscored —
WolfCMS 0.8.3.1 has XSS via the /?/admin/page/add slug parameter.
-
Unscored —
An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by local at…
-
Unscored —
An issue was discovered in portfolioCMS 1.0.5. There is CSRF to update the website settings via admin/aboutus.php.
-
Unscored —
GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field.
-
Unscored —
Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local att…
-
Unscored —
An issue was discovered in Flexo CMS v0.1.6. There is a CSRF vulnerability that can add an administrator via /admin/use…
-
Unscored —
An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via in…
-
Unscored —
Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 c…
-
Unscored —
An issue was discovered in puppyCMS 5.1. There is an XSS vulnerability via menu.php in the "Add Page/URL" URL link fiel…
-
High 8.8CVE-2018-15845 Public exploit
Gleez CMS CSRF Allows Adding of Administrator Accounts
There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add.
-
Unscored —
Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer derefere…
-
Unscored —
Technicolor TC7200.20 devices allow remote attackers to cause a denial of service (networking outage) via a flood of ra…
-
Unscored —
An issue was discovered in fledrCMS through 2014-02-03. There is a CSRF vulnerability that can change the administrator…
-
Unscored —
Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c in xkbcommon…
-
Unscored —
Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by local att…
-
Unscored —
Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer derefere…
-
Unscored —
Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by…
-
Unscored —
Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attack…
-
Unscored —
An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon before 0.8.1 c…
-
Unscored —
Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attac…
-
Unscored —
Cross-site scripting (XSS) vulnerability on D-Link DIR-615 routers 20.07 allows an attacker to inject JavaScript into t…
-
Unscored —
An invalid memory address dereference was discovered in decompileSingleArgBuiltInFunctionCall in libming 0.4.8 before 2…
-
Unscored —
Cross-site scripting (XSS) vulnerability on D-Link DIR-615 routers 20.07 allows attackers to inject JavaScript into the…
-
Unscored —
An invalid memory address dereference was discovered in decompileGETVARIABLE in libming 0.4.8 before 2018-03-12. The vu…
-
Unscored —
An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and t…
-
Medium 5.4CVE-2018-14059 Public exploit
Pimcore XSS Vulnerability
Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions.
-
Unscored —CVE-2018-11502 Public exploit
An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display …
-
Unscored —
Information disclosure in Netwave IP camera at //etc/RT2870STA.dat (via HTTP on port 8000) allows an unauthenticated at…
-
Unscored —
Information disclosure in Netwave IP camera at get_status.cgi (via HTTP on port 8000) allows an unauthenticated attacke…
-
Unscored —CVE-2018-15576 Public exploit
An issue was discovered in EasyLogin Pro through 1.3.0. Encryptor.php contains an unserialize call that can be exploite…
-
Unscored —
The National Payments Corporation of India BHIM application 1.3 for Android relies on three hardcoded strings (AK-NPCIM…
-
Unscored —
The National Payments Corporation of India BHIM application 1.3 for Android relies on a four-digit passcode, which make…
-
Unscored —
The National Payments Corporation of India BHIM application 1.3 for Android uses a custom keypad for which the input el…
-
Unscored —
The National Payments Corporation of India BHIM application 1.3 for Android does not properly restrict use of the OTP f…