Archive
September 2018
Vulnerabilities first published in this month (UTC), newest first.
1,170 results · Feed
-
Unscored —CVE-2018-8393 EPSS 22%
A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on a…
-
Unscored —CVE-2018-8332 EPSS 19%
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedde…
-
Unscored —CVE-2018-8421 EPSS 29%
A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input, aka ".NET Framewo…
-
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
Unscored —
A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly valid…
-
High 7.5CVE-2018-8456 EPSS 15%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8354, …
-
Unscored —CVE-2018-8392 EPSS 23%
A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on a…
-
Unscored —
An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka "Windows …
-
Unscored —
A denial of service vulnerability exists in the Microsoft Server Block Message (SMB) when an attacker sends specially c…
-
Unscored —CVE-2018-8475 EPSS 16%
A remote code execution vulnerability exists when Windows does not properly handle specially crafted image files, aka "…
-
Unscored —
An elevation of privilege vulnerability exists when Windows, allowing a sandbox escape, aka "Windows Elevation of Privi…
-
High 7.5
Denial of service in ASP.NET Core
A denial of service vulnerability exists when OData Library improperly handles web requests, aka "OData Denial of Service Vulnerability." This affects Microsoft.Data.OData.
-
Medium 4.2
ChakraCore information disclosure vulnerability
An information disclosure vulnerability exists when the browser scripting engine improperly handle object types, aka "Microsoft Scripting Engine Information Disclosure Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge, Internet Exp…
-
Unscored —CVE-2018-8461 EPSS 13%
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Interne…
-
High 7.5
Denial of service vulnerability exists when System.IO.Pipelines improperly handles requests
A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1.
-
Unscored —CVE-2018-8430 EPSS 23%
A remote code execution vulnerability exists in Microsoft Word if a user opens a specially crafted PDF file, aka "Word …
-
Unscored —
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially …
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windo…
-
Unscored —CVE-2018-8410 Public exploit
An elevation of privilege vulnerability exists when the Windows Kernel API improperly handles registry objects in memor…
-
Unscored —CVE-2018-8464 EPSS 43%
An remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka …
-
Unscored —
dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/image_tools/index.jsp fieldName and inode parameters.
-
Unscored —
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__…
-
Unscored —CVE-2018-16979 Scanner template
Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related …
-
Unscored —
Monstra CMS V3.0.4 has an information leakage risk (e.g., PATH, DOCUMENT_ROOT, and SERVER_ADMIN) in libraries/Gelato/Er…
-
Unscored —
Monstra CMS V3.0.4 has XSS when ones tries to register an account with a crafted password parameter to users/registrati…
-
Unscored —
Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git …
-
Critical 9.8
Elefant CMS PHP Code Execution Vulnerability
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in the New Stylesheet Name field in conjunction with <?php content, because of insufficient input valida…
-
Critical 9.8
Elefant CMS Code Execution Vulnerability
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by s…
-
High 7.3
Improper access controls in IP Office one-X Portal
A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1…
-
Unscored —
Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to download non…
-
Unscored —
Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to access non-p…
-
Unscored —
Webroot SecureAnywhere before 9.0.8.34 on macOS mishandles access to the driver by a process that lacks root privileges.
-
Unscored —
Buffer overflow in installer for Intel Extreme Tuning Utility before 6.4.1.21 may allow an authenticated user to potent…
-
Unscored —
Privilege escalation in file permissions in Intel Driver and Support Assistant before 3.5.0.1 may allow an authenticate…
-
Unscored —
Default install directory permissions in Intel Distribution for Python (IDP) version 2018 may allow an unprivileged use…
-
Unscored —
Improper input validation in firmware for Intel NUC Kits may allow a privileged user to potentially execute arbitrary c…
-
Unscored —
Directory permissions in the Intel OpenVINO Toolkit for Windows before version 2018.1.265 may allow an authenticated us…
-
Unscored —
DLL injection vulnerability in software installer for Intel Data Center Migration Center Software v3.1 and before may a…
-
Unscored —
Escalation of privilege in Installer for Intel Extreme Tuning Utility before 6.4.1.21 may allow an authenticated user t…
-
Unscored —
Buffer overflow in input handling in Intel Extreme Tuning Utility before 6.4.1.21 may allow an authenticated user to po…