Archive
September 2018
Vulnerabilities first published in this month (UTC), newest first.
30 results · Clear filters · Feed
-
Critical 9.8
Dell EMC ESRS Policy Manager versions 6.8 and prior contain a remote code execution vulnerability due to improper confi…
-
Critical 9.8CVE-2018-15531 EPSS 28%
JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
-
Critical 9.8
ThinkPHP SQL injection vulnerability
In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.
-
Critical 10.0
An exploitable code execution vulnerability exists in the Levin deserialization functionality of the Epee library, as u…
-
Critical 9.8CVE-2018-15957 EPSS 28%
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a des…
-
Critical 9.8CVE-2018-15958 EPSS 26%
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a des…
-
Critical 9.8CVE-2018-15959 EPSS 26%
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a des…
-
Critical 9.8
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an un…
KEV Nov 3, 2021 -
Critical 9.8CVE-2018-15965 EPSS 26%
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a des…
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of S…
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung S…
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung S…
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung S…
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung S…
-
Critical 9.8
smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Sams…
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Sams…
-
Critical 9.8
A missing error check exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application f…
-
Critical 9.9
Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application…
-
Critical 9.6
An exploitable information leak vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server impl…
-
Critical 9.8
TCPDF vulnerable to attackers triggering deserialization of arbitrary data
An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
-
Critical 9.8
Elefant CMS PHP Code Execution Vulnerability
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in the New Stylesheet Name field in conjunction with <?php content, because of insufficient input valida…
-
Critical 9.8
Elefant CMS Code Execution Vulnerability
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by s…
-
Critical 9.9
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung S…
-
Critical 9.9
An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of …
-
Critical 9.9
An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of …
-
Critical 9.8
ps Enables OS Command Injection
A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID.
-
Critical 9.8
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code thr…
-
Critical 9.8
Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload
The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerabil…
-
Critical 9.8CVE-2018-16385 Public exploit
ThinkPHP SQL Injection vulnerability
ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.