Archive
21 September 2018
Vulnerabilities first published on this day (UTC), newest first.
63 results · Feed
-
Unscored —
CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability.
-
Unscored —
Vectra Networks Cognito Brain and Sensor before 4.2 contains a cross-site scripting (XSS) vulnerability in the Web Mana…
-
Unscored —
Management Console in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local privilege escalation vulnera…
-
Unscored —
Platform sample code firmware in 4th Generation Intel Core Processor, 5th Generation Intel Core Processor, 6th Generati…
-
Unscored —
An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php minfo parameter in a sadmi…
-
Unscored —
FruityWifi (aka PatatasFritas/PatataWifi) 2.1 allows remote attackers to execute arbitrary commands via shell metachara…
-
High 8.3
Orchestration Designer Runtime Config CSRF
A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1.
-
High 8.3
Orchestration Designer Runtime Config XSS
A cross-site scripting (XSS) vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2…
-
Unscored —
SeaCMS 6.64 allows SQL Injection via the upload/admin/admin_video.php order parameter.
-
Unscored —
In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceC…
-
Unscored —
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admin_template.php?path=../templets/../../ requests.
-
Unscored —CVE-2018-16833 EPSS 65%
Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBR…
-
Unscored —
A stack-based buffer overflow was discovered in the xtimor NMEA library (aka nmealib) 0.5.3. nmea_parse() in parser.c a…
-
Unscored —
On the RICOH SP 4510SF printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of addin…
-
Unscored —
HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a…
-
Unscored —
The mintToken function of a smart contract implementation for PolyAi (AI), an Ethereum token, has an integer overflow t…
-
Unscored —
In LimeSurvey 3.14.7, HTML Injection and Stored XSS have been discovered in the appendix via the surveyls_title paramet…
-
Unscored —
On the RICOH MP 2001 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding …
-
Unscored —
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/get…
-
Unscored —
There exists a partial Denial of Service vulnerability in Wanscam HW0021 IP Cameras. An attacker could craft a maliciou…
-
Unscored —
In the mintToken function of a smart contract implementation for Substratum (SUB), an Ethereum ERC20 token, the adminis…
-
High 7.5
Missing Origin Validation in webpack-dev-server
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive…
-
High 7.5
Missing Origin Validation in parcel-bundler
An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR me…
-
High 7.5
Missing Origin Validation in browserify-hmr
An issue was discovered in Browserify-HMR. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSo…
-
Unscored —
gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to t…
-
Unscored —
gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writ…
-
Unscored —
An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by …
-
Unscored —CVE-2018-16793 EPSS 11%
Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username param…
-
Unscored —
The DEISER "Profields - Project Custom Fields" app before 6.0.2 for Jira has Incorrect Access Control.
-
Medium 4.0
Wallabag cross-site scripting (XSS) vulnerability
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configurat…
-
Unscored —
An XSS issue was discovered in Subsonic Media Server 6.1.1. The podcast subscription form is affected by a stored XSS v…
-
Unscored —
An issue was discovered in Subsonic 6.1.1. The radio settings are affected by three stored cross-site scripting vulnera…
-
Unscored —
An issue was discovered in Subsonic 6.1.1. The transcoding settings are affected by five stored cross-site scripting vu…
-
Unscored —
An issue was discovered in Subsonic 6.1.1. The music tags feature is affected by three stored cross-site scripting vuln…
-
Unscored —
An issue was discovered in Subsonic 6.1.1. The general settings are affected by two stored cross-site scripting vulnera…
-
Unscored —
DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedback_ajax.php.
-
Unscored —
DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type='file' name='../" substrin…
-
Unscored —
An issue was discovered on SoftCase T-Router build 20112017 devices. A remote attacker can read and write to arbitrary …
-
Unscored —
An issue was discovered on SoftCase T-Router build 20112017 devices. There are no restrictions on the 'exec command' fe…
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of S…