Archive
September 2018
Vulnerabilities first published in this month (UTC), newest first.
1,170 results · Feed
-
Medium 5.4
Cross-site Scripting in yapi-vendor
An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.
-
Unscored —
Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (u…
-
Unscored —
Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (u…
-
Unscored —
Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (u…
-
Unscored —
The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and config…
-
Unscored —
Vanilla before 2.6.1 allows XSS via the email field of a profile.
-
Medium 5.4
XWiki XSS Vulnerability
The Image Import function in XWiki through 10.7 has XSS.
-
Unscored —
In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker cou…
-
Unscored —CVE-2018-16659 Public exploit
An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked …
-
Unscored —
In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker cou…
-
Unscored —
CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive fun…
-
Unscored —CVE-2018-17376 Public exploit
SQL Injection exists in the Reverse Auction Factory 4.3.8 component for Joomla! via the filter_order_Dir, cat, or filte…
-
Unscored —
An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads.
-
Unscored —CVE-2018-17394 Public exploit
SQL Injection exists in the Timetable Schedule 3.6.8 component for Joomla! via the eid parameter.
-
Unscored —CVE-2018-17377 Public exploit
SQL Injection exists in the Questions 1.4.3 component for Joomla! via the term, userid, users, or groups parameter.
-
High 7.5
Jekyll allows attackers to access arbitrary files by specifying a symlink
Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "_config.yml" file.
-
Unscored —CVE-2018-17383 Public exploit
SQL Injection exists in the Collection Factory 4.1.9 component for Joomla! via the filter_order or filter_order_Dir par…
-
Unscored —CVE-2018-17375 Public exploit
SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter.
-
Unscored —CVE-2018-17378 Public exploit
SQL Injection exists in the Penny Auction Factory 2.0.4 component for Joomla! via the filter_order_Dir or filter_order …
-
Unscored —CVE-2018-17391 Public exploit
SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter.
-
Unscored —CVE-2018-17397 Public exploit
SQL Injection exists in the AlphaIndex Dictionaries 1.0 component for Joomla! via the letter parameter.
-
Unscored —CVE-2018-17385 Public exploit
SQL Injection exists in the Social Factory 3.8.3 component for Joomla! via the radius[lat], radius[lng], or radius[radi…
-
Unscored —CVE-2018-17382 Public exploit
SQL Injection exists in the Jobs Factory 2.0.4 component for Joomla! via the filter_letter parameter.
-
Unscored —
Cross-site scripting (XSS) vulnerability in ServiceStack in Progress Sitefinity CMS versions 10.2 through 11.0 allows r…
-
Unscored —CVE-2018-17380 Public exploit
SQL Injection exists in the Article Factory Manager 4.3.9 component for Joomla! via the start_date, m_start_date, or m_…
-
Unscored —CVE-2018-17379 Public exploit
SQL Injection exists in the Raffle Factory 3.5.2 component for Joomla! via the filter_order_Dir or filter_order paramet…
-
Unscored —CVE-2018-17384 Public exploit
SQL Injection exists in the Swap Factory 2.2.1 component for Joomla! via the filter_order_Dir or filter_order parameter.
-
Unscored —
CMS ISWEB 3.5.3 is vulnerable to directory traversal and local file download, as demonstrated by moduli/downloadFile.ph…
-
Unscored —
CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws. An attacker can inject malicious queries into the applic…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbi…
-
Medium 6.3
Communication Manager Local Administrator PrivEsc
A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local system to gain root privileges. Affected versions include 6.3.x and all 7.x version prior to 7.1.3.1.
-
Unscored —
Delta Electronics Delta Industrial Automation PMSoft v2.11 or prior has an out-of-bounds read vulnerability that can be…
-
Medium 5.9
It was discovered that sos-collector does not properly set the default permissions of newly created files, making all f…
-
Medium 5.4
IBM WebSphere Portal 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed …
-
Medium 5.4
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to e…
-
Medium 6.1
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to e…
-
High 7.4
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to conduct phishing attacks, using an open re…
-
Unscored —
HPE has addressed a remote arbitrary file modification vulnerability in HPE enhanced Internet Usage Manager (eIUM) v9.0…
-
Unscored —
A potential security vulnerability has been identified in HPE Device Entitlement Gateway (DEG) v3.2.4, v3.3 and v3.3.1.…
-
Unscored —
A Remote Code Execution vulnerability was identified in HPE Intelligent Management Center (iMC) Wireless Services Manag…