Archive
7 September 2018
Vulnerabilities first published on this day (UTC), newest first.
65 results · Feed
-
Unscored —
PHP Scripts Mall Currency Converter Script 2.0.5 allows remote attackers to cause a denial of service (web-interface ch…
-
Unscored —CVE-2018-16363 Scanner template
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_…
-
Unscored —
Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename pa…
-
Unscored —CVE-2018-12897 Public exploit
SolarWinds DameWare Mini Remote Control before 12.1 has a Buffer Overflow.
-
Unscored —
The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gamblin…
-
Unscored —
An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Denial of Service can occur through the op…
-
Unscored —
An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Local File Inclusion and F…
-
Unscored —
An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. FTP does not require authentication or aut…
-
Unscored —
CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-0…
-
Unscored —
An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Remote Code Execution is p…
-
Unscored —
An XSS issue was discovered in CremeCRM 1.6.12. It is affected by 10 stored Cross-Site Scripting (XSS) vulnerabilities …
-
Unscored —
An issue was discovered in Creme CRM 1.6.12. The salesman creation page is affected by 10 stored cross-site scripting v…
-
Unscored —
An issue was discovered in Creme CRM 1.6.12. The organization creation page is affected by 9 stored cross-site scriptin…
-
Unscored —
An issue was discovered in Creme CRM 1.6.12. The value of the cancel button uses the content of the HTTP Referer header…
-
Unscored —
Homeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the username and password betwe…
-
Critical 9.8
ps Enables OS Command Injection
A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID.
-
Unscored —
OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP r…
-
Unscored —
Fuji Xerox DocuCentre-V 3065, ApeosPort-VI C3371, ApeosPort-V C4475, ApeosPort-V C3375, DocuCentre-VI C2271, ApeosPort-…
-
Unscored —
A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple u…
-
Unscored —
An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in parse_relations in os/stor…
-
Medium 4.3
Gleez CMS Vulnerability Allows Forced Browsing to Profile Page of Other Users
An issue was discovered in Gleez CMS v1.2.0. Because of an Insecure Direct Object Reference vulnerability, it is possible for attackers (logged in users) to view profile page of other users, as demonstrated by navigating to user/3 on demo.gleezcms.org.
-
Unscored —
An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in next_string in os/storage/…
-
Unscored —
An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow in lvm_set_type in os/storage/antelope/lv…
-
Unscored —
An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow while parsing AQL in lvm_shift_for_operat…
-
Unscored —
An issue was discovered in Contiki-NG through 4.1. There is a buffer over-read in lookup in os/storage/antelope/lvm.c w…
-
High 8.8
An exploitable command execution vulnerability exists in Information Builders WebFOCUS Business Intelligence Portal 8.1…
-
Critical 9.8
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code thr…
-
High 8.4
IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a se…
-
Medium 5.3
IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive informa…
-
High 7.5
IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. A remote attacker c…
-
Medium 5.4
IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, wh…
-
Medium 5.4
IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra…
-
High 8.3
An exploitable heap corruption vulnerability exists in the iBldDirInfo functionality of Antenna House DMC HTMLFilter us…
-
High 8.3
An exploitable heap corruption vulnerability exists in the Txo functionality of Antenna House DMC HTMLFilter as used by…
-
High 8.8
An exploitable code execution vulnerability exists in the connect functionality of ProtonVPN VPN client 1.5.1. A specia…
-
High 8.8
An exploitable code execution vulnerability exists in the connect functionality of NordVPN 6.14.28.0. A specially craft…
-
Unscored —
The LINE MUSIC for Android version 3.1.0 to versions prior to 3.6.5 does not verify X.509 certificates from SSL servers…
-
Unscored —
Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and e…
-
Unscored —
Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attack…
-
Unscored —
Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for E…