Archive
August 2018
Vulnerabilities first published in this month (UTC), newest first.
1,015 results · Feed
-
Critical 9.8
Command Injection in egg-scripts
A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument.
-
Unscored —CVE-2018-15536 Public exploit
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in ar…
-
Unscored —
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname…
-
Unscored —
libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a deni…
-
Unscored —CVE-2018-15499 Public exploit
GEAR Software products that include GEARAspiWDM.sys, 2.2.5.0, allow local users to cause a denial of service (Race Cond…
-
Unscored —
Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenti…
-
Medium 6.1
phpMyAdmin Cross-site Scripting (XSS) in the import dialog
An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature.
-
Unscored —
An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-o…
-
Unscored —
An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as sig…
-
Unscored —
An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in…
-
Unscored —
The D-Link EyeOn Baby Monitor (DCS-825L) 1.08.1 has multiple command injection vulnerabilities in the web service frame…
-
Unscored —
D-Link EyeOn Baby Monitor (DCS-825L) 1.08.1 has a remote code execution vulnerability. A UDP "Discover" service, which …
-
Unscored —
An issue was discovered on the PLANEX CS-QR20 1.30. A hardcoded account / password ("admin:password") is used in the An…
-
Unscored —
An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. The device has a command-injection vuln…
-
Unscored —
An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. A hardcoded credential "supervisor:dang…
-
Unscored —
An issue was discovered on the PLANEX CS-QR20 1.30. A hidden and undocumented management page allows an attacker to exe…
-
Unscored —
An issue was discovered on the NEC Aterm WG2600HP2 1.0.2. The router has a set of web service APIs for access to and se…
-
Critical 9.1
RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable t…
-
Low 2.7
The WorkPoint component, which is embedded in all RSA Archer, versions 6.1.x, 6.2.x, 6.3.x prior to 6.3.0.7 and 6.4.x p…
-
Unscored —
When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext …
-
Critical 10.0
IBM Security Access Manager Appliance 9.0.4.0 and 9.0.5.0 could allow remote code execution when Advanced Access Contro…
-
Medium 5.9
IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by incor…
-
Medium 6.3
IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to SQL injection. A remote attacker could send specially-cr…
-
Critical 9.1
An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-E…
-
Critical 9.1
An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-E…
-
Critical 9.9
An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub STH-ETH-250 …
-
High 8.2
An exploitable stack-based buffer overflow vulnerability exists in the database 'find-by-cameraId' functionality of vid…
-
High 8.6
An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 …
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the samsungWifiScan handler of video-core's HTTP server of Samsu…
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung S…
-
Unscored —
The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, l…
-
Medium 6.5
Privilege Escalation in fscrypt
The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linu…
-
Unscored —
POSIM EVO 15.13 for Windows includes hardcoded database credentials for the "root" database user. "root" access to POSI…
-
Unscored —
AccuPOS 2017.8 is installed with the insecure "Authenticated Users: Modify" permission for files within the installatio…
-
Unscored —
POSIM EVO 15.13 for Windows includes an "Emergency Override" administrative account that may be accessed through POSIM'…
-
Unscored —
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote …
-
Unscored —CVE-2018-1156 Public exploit
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface…
-
Unscored —
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote a…
-
Unscored —
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. An authenticated remote …
-
Unscored —
Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 may allow non-administrative users to change executable …