Archive
26 September 2018
Vulnerabilities first published on this day (UTC), newest first.
63 results · Feed
-
Unscored —CVE-2018-16712 Public exploit
IObit Advanced SystemCare, which includes Monitor_win10_x64.sys or Monitor_win7_x64.sys, 1.2.0.5 (and possibly earlier …
-
Unscored —CVE-2018-16713 Public exploit
IObit Advanced SystemCare, which includes Monitor_win10_x64.sys or Monitor_win7_x64.sys, 1.2.0.5 (and possibly earlier …
-
Unscored —
Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through…
-
Unscored —CVE-2018-16711 Public exploit
IObit Advanced SystemCare, which includes Monitor_win10_x64.sys or Monitor_win7_x64.sys, 1.2.0.5 (and possibly earlier …
-
Unscored —CVE-2018-16055 EPSS 11%
An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense…
-
Unscored —CVE-2018-17313 Public exploit
On the RICOH MP C307 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding …
-
Unscored —
On the RICOH MP C6503 Plus printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of a…
-
Unscored —
utils/ut_ws_svr.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.
-
Unscored —
On the RICOH MP C406Z printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding…
-
Unscored —
An XML External Entity (XXE) vulnerability exists in iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20.
-
Unscored —CVE-2018-17310 Public exploit
On the RICOH MP C1803 JPN printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of ad…
-
Unscored —
utils/ut_rpc.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.
-
Unscored —
network/nw_buf.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.
-
Unscored —
On the RICOH MP C6003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding…
-
Unscored —
On the RICOH Aficio MP 305+ printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of …
-
Unscored —
On the RICOH Aficio MP 301 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of a…
-
Unscored —
On the RICOH MP C2003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding…
-
Critical 9.8CVE-2018-15531 EPSS 28%
JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
-
Unscored —CVE-2018-14327 Public exploit
The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before…
-
Unscored —
Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message.
-
Unscored —CVE-2018-16364 EPSS 18%
A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execu…
-
Unscored —
Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal.
-
High 7.5
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the …
-
High 7.5
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the …
-
Critical 9.8
ThinkPHP SQL injection vulnerability
In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.
-
Unscored —CVE-2018-17081 Public exploit
e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&action=inline&ajax_used=1&id= for changing the title of an arb…
-
Unscored —
SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter.
-
Unscored —
An information-disclosure issue was discovered in Postman through 6.3.0. It validates a server's X.509 certificate and …
-
Unscored —
Horus CMS allows SQL Injection, as demonstrated by a request to the /busca or /home URI.
-
Unscored —
In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not ver…
-
Unscored —
Inedo ProGet before 5.0 Beta5 has CSRF, allowing an attacker to change advanced settings.
-
Unscored —
The web component on ARRIS TG2492LG-NA 061213 devices allows remote attackers to obtain sensitive information via the /…
-
Unscored —
MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action.
-
Unscored —
Fuji Electric V-Server 4.0.3.0 and prior, An out-of-bounds read vulnerability has been identified, which may allow remo…
-
Unscored —
Fuji Electric V-Server 4.0.3.0 and prior, An integer underflow vulnerability has been identified, which may allow remot…
-
Unscored —
Fuji Electric V-Server 4.0.3.0 and prior, Multiple untrusted pointer dereference vulnerabilities have been identified, …
-
Unscored —
Fuji Electric V-Server 4.0.3.0 and prior, A stack-based buffer overflow vulnerability has been identified, which may al…
-
Unscored —
Fuji Electric V-Server 4.0.3.0 and prior, A use after free vulnerability has been identified, which may allow remote co…
-
Unscored —
Fuji Electric V-Server 4.0.3.0 and prior, Several out-of-bounds write vulnerabilities have been identified, which may a…
-
Unscored —
Fuji Electric V-Server 4.0.3.0 and prior, A heap-based buffer overflow vulnerability has been identified, which may all…