Archive
September 2018
Vulnerabilities first published in this month (UTC), newest first.
1,170 results · Feed
-
Unscored —
An issue was discovered in Creme CRM 1.6.12. The salesman creation page is affected by 10 stored cross-site scripting v…
-
Unscored —
An issue was discovered in Creme CRM 1.6.12. The organization creation page is affected by 9 stored cross-site scriptin…
-
Unscored —
An issue was discovered in Creme CRM 1.6.12. The value of the cancel button uses the content of the HTTP Referer header…
-
Unscored —
Homeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the username and password betwe…
-
Critical 9.8
ps Enables OS Command Injection
A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID.
-
Unscored —
OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP r…
-
Unscored —
Fuji Xerox DocuCentre-V 3065, ApeosPort-VI C3371, ApeosPort-V C4475, ApeosPort-V C3375, DocuCentre-VI C2271, ApeosPort-…
-
Unscored —
A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple u…
-
Unscored —
An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in parse_relations in os/stor…
-
Medium 4.3
Gleez CMS Vulnerability Allows Forced Browsing to Profile Page of Other Users
An issue was discovered in Gleez CMS v1.2.0. Because of an Insecure Direct Object Reference vulnerability, it is possible for attackers (logged in users) to view profile page of other users, as demonstrated by navigating to user/3 on demo.gleezcms.org.
-
Unscored —
An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in next_string in os/storage/…
-
Unscored —
An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow in lvm_set_type in os/storage/antelope/lv…
-
Unscored —
An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow while parsing AQL in lvm_shift_for_operat…
-
Unscored —
An issue was discovered in Contiki-NG through 4.1. There is a buffer over-read in lookup in os/storage/antelope/lvm.c w…
-
High 8.8
An exploitable command execution vulnerability exists in Information Builders WebFOCUS Business Intelligence Portal 8.1…
-
Critical 9.8
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code thr…
-
High 8.4
IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a se…
-
Medium 5.3
IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive informa…
-
High 7.5
IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. A remote attacker c…
-
Medium 5.4
IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, wh…
-
Medium 5.4
IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra…
-
High 8.3
An exploitable heap corruption vulnerability exists in the iBldDirInfo functionality of Antenna House DMC HTMLFilter us…
-
High 8.3
An exploitable heap corruption vulnerability exists in the Txo functionality of Antenna House DMC HTMLFilter as used by…
-
High 8.8
An exploitable code execution vulnerability exists in the connect functionality of ProtonVPN VPN client 1.5.1. A specia…
-
High 8.8
An exploitable code execution vulnerability exists in the connect functionality of NordVPN 6.14.28.0. A specially craft…
-
Unscored —
The LINE MUSIC for Android version 3.1.0 to versions prior to 3.6.5 does not verify X.509 certificates from SSL servers…
-
Unscored —
Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and e…
-
Unscored —
Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attack…
-
Unscored —
Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for E…
-
Unscored —
Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) versi…
-
Unscored —
Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create o…
-
Unscored —
Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 4.8.0 (panda-server) 1:1.4.9+p41-u4jma1 and earlier allows attacke…
-
Unscored —
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitr…
-
Unscored —
MTAppjQuery 1.8.1 and earlier allows remote PHP code execution via unspecified vectors.
-
Unscored —
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script…
-
Unscored —
Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create a…
-
Unscored —
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script…
-
Unscored —
Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart…
-
Unscored —
Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and e…
-
Unscored —
Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier…