Archive
12 September 2018
Vulnerabilities first published on this day (UTC), newest first.
69 results · Feed
-
Unscored —
dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/image_tools/index.jsp fieldName and inode parameters.
-
Unscored —
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__…
-
Unscored —CVE-2018-16979 Scanner template
Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related …
-
Unscored —
Monstra CMS V3.0.4 has an information leakage risk (e.g., PATH, DOCUMENT_ROOT, and SERVER_ADMIN) in libraries/Gelato/Er…
-
Unscored —
Monstra CMS V3.0.4 has XSS when ones tries to register an account with a crafted password parameter to users/registrati…
-
Unscored —
Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git …
-
Critical 9.8
Elefant CMS PHP Code Execution Vulnerability
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in the New Stylesheet Name field in conjunction with <?php content, because of insufficient input valida…
-
Critical 9.8
Elefant CMS Code Execution Vulnerability
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by s…
-
High 7.3
Improper access controls in IP Office one-X Portal
A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1…
-
Unscored —
Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to download non…
-
Unscored —
Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to access non-p…
-
Unscored —
Webroot SecureAnywhere before 9.0.8.34 on macOS mishandles access to the driver by a process that lacks root privileges.
-
Unscored —
Buffer overflow in installer for Intel Extreme Tuning Utility before 6.4.1.21 may allow an authenticated user to potent…
-
Unscored —
Privilege escalation in file permissions in Intel Driver and Support Assistant before 3.5.0.1 may allow an authenticate…
-
Unscored —
Default install directory permissions in Intel Distribution for Python (IDP) version 2018 may allow an unprivileged use…
-
Unscored —
Improper input validation in firmware for Intel NUC Kits may allow a privileged user to potentially execute arbitrary c…
-
Unscored —
Directory permissions in the Intel OpenVINO Toolkit for Windows before version 2018.1.265 may allow an authenticated us…
-
Unscored —
DLL injection vulnerability in software installer for Intel Data Center Migration Center Software v3.1 and before may a…
-
Unscored —
Escalation of privilege in Installer for Intel Extreme Tuning Utility before 6.4.1.21 may allow an authenticated user t…
-
Unscored —
Buffer overflow in input handling in Intel Extreme Tuning Utility before 6.4.1.21 may allow an authenticated user to po…
-
Unscored —
A DLL injection vulnerability in the Intel IoT Developers Kit 4.0 installer may allow an authenticated user to potentia…
-
Unscored —
Privilege escalation in Intel Baseboard Management Controller (BMC) firmware before version 1.43.91f76955 may allow an …
-
Unscored —
Privilege escalation in file permissions in Intel Computing Improvement Program before version 2.2.0.03942 may allow an…
-
Unscored —
A vulnerability in a subsystem in Intel CSME before version 11.21.55, Intel Server Platform Services before version 4.0…
-
Unscored —
Multiple buffer overflows in Intel AMT in Intel CSME firmware versions before version 12.0.5 may allow a privileged use…
-
Unscored —
Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0…
-
Unscored —
Code injection vulnerability in INTEL-SA-00086 Detection Tool before version 1.2.7.0 may allow a privileged user to pot…
-
Unscored —
A vulnerability in Intel PTT module in Intel CSME firmware before version 12.0.5 and Intel TXE firmware before version …
-
Unscored —
A STOP error (BSoD) in the ibtfltcoex.sys driver for Intel Centrino Wireless N and Intel Centrino Advanced N adapters m…
-
Unscored —
A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Manag…
-
Unscored —
Multiple memory leaks in Intel AMT in Intel CSME firmware versions before 12.0.5 may allow an unauthenticated user with…
-
Unscored —
Escalation of privilege in Reference UI in Intel Data Center Manager SDK 5.0 and before may allow an unauthorized remot…
-
Unscored —
razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.
-
Unscored —
D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page.
-
Unscored —
feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new.
-
Unscored —
e107_admin/banlist.php in e107 2.1.8 allows SQL injection via the old_ip parameter.
-
Unscored —
Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage …
-
Unscored —
razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.
-
Unscored —
e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php…
-
Unscored —
Pulse Secure Client 9.0R1 and 5.3RX before 5.3R5, when configured to authenticate VPN users during Windows Logon, can a…