Archive
September 2018
Vulnerabilities first published in this month (UTC), newest first.
1,170 results · Feed
-
Unscored —
In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (appli…
-
Unscored —
wityCMS 0.6.2 has XSS via the "Site Name" field found in the "Contact" "Configuration" page.
-
Unscored —
BlogCMS through 2016-10-25 has XSS via a comment.
-
Unscored —
Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php.
-
Unscored —
EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content f…
-
Unscored —
In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (appli…
-
Unscored —
In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (appli…
-
Unscored —
In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (appli…
-
Unscored —
In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (appli…
-
Unscored —
Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new.
-
Unscored —
libimageworsener.a in ImageWorsener 1.3.2 has a buffer overflow in the bmpr_read_rle_internal function in imagew-bmp.c.
-
Unscored —
An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the site name in the "Categories" menu.
-
Unscored —
In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (appli…
-
Unscored —
ffjpeg.dll in ffjpeg before 2018-08-22 allows remote attackers to cause a denial of service (FPE signal) via a progress…
-
Unscored —
Complete Responsive CMS Blog through 2018-05-20 has XSS via a comment.
-
Unscored —
FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search_term parameter to pages/items.
-
Unscored —CVE-2018-16761 Scanner template
Eventum before 3.4.0 has an open redirect vulnerability.
-
Unscored —
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This c…
-
Unscored —
The removeXSS function in App/Common/common.php (called from App/Modules/Index/Action/SearchAction.class.php) in EasyCM…
-
Unscored —
In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c was found.
-
Unscored —
In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to caus…
-
Unscored —CVE-2018-16736 Public exploit
In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters se…
-
Unscored —
\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name.
-
Unscored —
An issue is discovered in baijiacms V4. Blind SQL Injection exists via the order parameter in an index.php?act=index re…
-
Unscored —
An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parame…
-
Unscored —
CScms 4.1 allows arbitrary file upload by (for example) adding the php extension to the default filetype list (gif, jpg…
-
Unscored —
\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftp_save.
-
High 7.5
Go Ethereum Improper Input Validation
In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api_tracer.go does not verify that the end block is after the start block.
-
Unscored —
An issue was discovered in Absolute Software CTES Windows Agent through 1.0.0.1479. The security permissions on the %Pr…
-
Unscored —
PHP Scripts Mall Currency Converter Script 2.0.5 allows remote attackers to cause a denial of service (web-interface ch…
-
Unscored —CVE-2018-16363 Scanner template
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_…
-
Unscored —
Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename pa…
-
Unscored —CVE-2018-12897 Public exploit
SolarWinds DameWare Mini Remote Control before 12.1 has a Buffer Overflow.
-
Unscored —
The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gamblin…
-
Unscored —
An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Denial of Service can occur through the op…
-
Unscored —
An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Local File Inclusion and F…
-
Unscored —
An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. FTP does not require authentication or aut…
-
Unscored —
CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-0…
-
Unscored —
An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Remote Code Execution is p…
-
Unscored —
An XSS issue was discovered in CremeCRM 1.6.12. It is affected by 10 stored Cross-Site Scripting (XSS) vulnerabilities …