Archive
5 September 2018
Vulnerabilities first published on this day (UTC), newest first.
54 results · Feed
-
Unscored —
TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by s…
-
High 8.8
MicroPyramid Django-CRM CSRF
MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs.
-
Medium 5.4
Stored XSS in LavaLite 5.5
LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.
-
Critical 9.8
Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload
The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerabil…
-
Unscored —CVE-2018-16144 EPSS 33%
The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vul…
-
Unscored —
The diagnosticsb2ksy parameter of the /rest endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerab…
-
Unscored —CVE-2018-16252 Public exploit
FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection.
-
Unscored —
HScripts PHP File Browser Script v1.0 allows Directory Traversal via the index.php path parameter.
-
Unscored —
An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi_55DD Version 2.8.50 devices. It is possible…
-
Unscored —
An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_…
-
Unscored —
An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter.
-
Unscored —
The data parameter of the /settings/api/router endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulne…
-
Unscored —
The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before…
-
Unscored —
The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated …
-
Unscored —
e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&action=list user_loginname parameter.
-
Unscored —
The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is…
-
Unscored —
An issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users table are stored as unsa…
-
Unscored —CVE-2018-15918 Public exploit
An issue was discovered in Jorani 0.6.5. SQL Injection (error-based) allows a user of the application without permissio…
-
Unscored —
An issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection, it is possible to aut…
-
Unscored —
An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php…
-
Unscored —
An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory (/include/logs) using predicta…
-
Unscored —
Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or H…
-
Unscored —
An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictabl…
-
Unscored —
An issue was discovered in BTITeam XBTIT. By using String.replace and eval, it is possible to bypass the includes/crk_p…
-
Unscored —
An issue was discovered in BTITeam XBTIT. The "returnto" parameter of the login page is vulnerable to an open redirect …
-
Unscored —
An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=si…
-
Unscored —
VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 1 of 2) via the…
-
Unscored —
VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 2 of 2) via eve…
-
Unscored —
VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF.
-
Unscored —
Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator.
-
Unscored —
Gxlcms 2.0 before bug fix 20180915 has Directory Traversal exploitable by an administrator.
-
Unscored —
Amcrest networked devices use the same hardcoded SSL private key across different customers' installations, which allow…
-
Unscored —
Kaizen Asset Manager (Enterprise Edition) and Training Manager (Enterprise Edition) allow a remote attacker to achieve …
-
High 7.5CVE-2018-14618 EPSS 11%
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Cur…
-
Unscored —
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checki…
-
Unscored —
In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact.
-
Unscored —
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter co…
-
Unscored —
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use insufficient interprete…
-
Unscored —
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in…
-
Unscored —
This module enables you to create fields for storing decimal values as two integers (numerator and denominator) for max…