Archive
September 2018
Vulnerabilities first published in this month (UTC), newest first.
87 results · Clear filters · Feed
-
Unscored —CVE-2018-17776 Public exploit
PCProtect Anti-Virus v4.8.35 has "Everyone: (F)" permission for %PROGRAMFILES(X86)%\PCProtect, which allows local users…
-
Unscored —CVE-2018-9075 Public exploit
Iomega and LenovoEMC NAS Web UI Vulnerabilities
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when joining a PersonalCloud setup, an attacker can craft a command injection payload using backtick "``" characters in the client:password parameter. As a result, arbitrary co…
-
Unscored —CVE-2018-15365 Public exploit
A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow…
-
Unscored —CVE-2018-16659 Public exploit
An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked …
-
Unscored —CVE-2018-17376 Public exploit
SQL Injection exists in the Reverse Auction Factory 4.3.8 component for Joomla! via the filter_order_Dir, cat, or filte…
-
Unscored —CVE-2018-17394 Public exploit
SQL Injection exists in the Timetable Schedule 3.6.8 component for Joomla! via the eid parameter.
-
Unscored —CVE-2018-17377 Public exploit
SQL Injection exists in the Questions 1.4.3 component for Joomla! via the term, userid, users, or groups parameter.
-
Unscored —CVE-2018-17383 Public exploit
SQL Injection exists in the Collection Factory 4.1.9 component for Joomla! via the filter_order or filter_order_Dir par…
-
Unscored —CVE-2018-17375 Public exploit
SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter.
-
Unscored —CVE-2018-17378 Public exploit
SQL Injection exists in the Penny Auction Factory 2.0.4 component for Joomla! via the filter_order_Dir or filter_order …
-
Unscored —CVE-2018-17391 Public exploit
SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter.
-
Unscored —CVE-2018-17397 Public exploit
SQL Injection exists in the AlphaIndex Dictionaries 1.0 component for Joomla! via the letter parameter.
-
Unscored —CVE-2018-17385 Public exploit
SQL Injection exists in the Social Factory 3.8.3 component for Joomla! via the radius[lat], radius[lng], or radius[radi…
-
Unscored —CVE-2018-17382 Public exploit
SQL Injection exists in the Jobs Factory 2.0.4 component for Joomla! via the filter_letter parameter.
-
Unscored —CVE-2018-17380 Public exploit
SQL Injection exists in the Article Factory Manager 4.3.9 component for Joomla! via the start_date, m_start_date, or m_…
-
Unscored —CVE-2018-17379 Public exploit
SQL Injection exists in the Raffle Factory 3.5.2 component for Joomla! via the filter_order_Dir or filter_order paramet…
-
Unscored —CVE-2018-17384 Public exploit
SQL Injection exists in the Swap Factory 2.2.1 component for Joomla! via the filter_order_Dir or filter_order parameter.
-
Unscored —CVE-2018-16712 Public exploit
IObit Advanced SystemCare, which includes Monitor_win10_x64.sys or Monitor_win7_x64.sys, 1.2.0.5 (and possibly earlier …
-
Unscored —CVE-2018-16713 Public exploit
IObit Advanced SystemCare, which includes Monitor_win10_x64.sys or Monitor_win7_x64.sys, 1.2.0.5 (and possibly earlier …
-
Unscored —CVE-2018-16711 Public exploit
IObit Advanced SystemCare, which includes Monitor_win10_x64.sys or Monitor_win7_x64.sys, 1.2.0.5 (and possibly earlier …
-
Unscored —CVE-2018-17313 Public exploit
On the RICOH MP C307 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding …
-
Unscored —CVE-2018-17310 Public exploit
On the RICOH MP C1803 JPN printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of ad…
-
Unscored —CVE-2018-14327 Public exploit
The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before…
-
Unscored —CVE-2018-17081 Public exploit
e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&action=inline&ajax_used=1&id= for changing the title of an arb…
-
Unscored —CVE-2018-7355 Public exploit
All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scri…
-
High 7.8
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with …
KEV Jan 26, 2026 -
Critical 9.8
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an un…
KEV Nov 3, 2021 -
Unscored —
The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.
-
Unscored —
The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.
-
Unscored —
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/get…
-
High 7.5CVE-2018-17297 Public exploit
Unzip function in ZipUtil.java in Hutool allows remote attackers to overwrite arbitrary files via directory traversal
The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.
-
Unscored —CVE-2018-15832 Public exploit
upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. User in…
-
Unscored —CVE-2018-14592 Public exploit
The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments FREE extension before 1.0.6 f…
-
Unscored —
The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.
-
Unscored —CVE-2018-17229 Public exploit
Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overf…
-
Unscored —
An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php an…
-
High 7.5CVE-2018-11761 Public exploit
High severity vulnerability that affects org.apache.tika:tika-core
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
-
Unscored —CVE-2018-17182 Public exploit
An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles…
-
Unscored —CVE-2018-17144 Public exploit
Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16…
-
Unscored —CVE-2017-6913 Public exploit
Cross-site scripting (XSS) vulnerability in the Open-Xchange webmail before 7.6.3-rev28 allows remote attackers to inje…