Archive
September 2018
Vulnerabilities first published in this month (UTC), newest first.
1,170 results · Feed
-
Unscored —
OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter.
-
Unscored —
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. …
-
High 8.8
Mingsoft MCMS CSRF vulnerability
An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.
-
Unscored —
An issue has been found in pdfalto through 0.2. It is a heap-based buffer overflow in the function TextPage::dump in Xm…
-
Unscored —
BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authen…
-
Unscored —
An issue was discovered in libsvg2 through 2012-10-19. A stack-based buffer overflow in the svgGetNextPathField functio…
-
Unscored —
UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive…
-
Unscored —
An issue was discovered in libsvg2 through 2012-10-19. A stack-based buffer overflow in svgStringToLength in svg_types.…
-
Unscored —
An issue was discovered in libsvg2 through 2012-10-19. The svgGetNextPathField function in svg_string.c returns its inp…
-
Unscored —
Cross-site scripting (XSS) vulnerability in index.php/index/category/index in YUNUCMS 1.1.4 allows remote attackers to …
-
Unscored —
An issue was discovered in SeaCMS 6.64. XSS exists in admin_datarelate.php via the time or maxHit parameter in a dorand…
-
Unscored —
CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability.
-
Unscored —
Vectra Networks Cognito Brain and Sensor before 4.2 contains a cross-site scripting (XSS) vulnerability in the Web Mana…
-
Unscored —
Management Console in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local privilege escalation vulnera…
-
Unscored —
Platform sample code firmware in 4th Generation Intel Core Processor, 5th Generation Intel Core Processor, 6th Generati…
-
Unscored —
An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php minfo parameter in a sadmi…
-
Unscored —
FruityWifi (aka PatatasFritas/PatataWifi) 2.1 allows remote attackers to execute arbitrary commands via shell metachara…
-
High 8.3
Orchestration Designer Runtime Config CSRF
A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1.
-
High 8.3
Orchestration Designer Runtime Config XSS
A cross-site scripting (XSS) vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2…
-
Unscored —
SeaCMS 6.64 allows SQL Injection via the upload/admin/admin_video.php order parameter.
-
Unscored —
In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceC…
-
Unscored —
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admin_template.php?path=../templets/../../ requests.
-
Unscored —CVE-2018-16833 EPSS 65%
Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBR…
-
Unscored —
A stack-based buffer overflow was discovered in the xtimor NMEA library (aka nmealib) 0.5.3. nmea_parse() in parser.c a…
-
Unscored —
On the RICOH SP 4510SF printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of addin…
-
Unscored —
HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a…
-
Unscored —
The mintToken function of a smart contract implementation for PolyAi (AI), an Ethereum token, has an integer overflow t…
-
Unscored —
In LimeSurvey 3.14.7, HTML Injection and Stored XSS have been discovered in the appendix via the surveyls_title paramet…
-
Unscored —
On the RICOH MP 2001 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding …
-
Unscored —
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/get…
-
Unscored —
There exists a partial Denial of Service vulnerability in Wanscam HW0021 IP Cameras. An attacker could craft a maliciou…
-
Unscored —
In the mintToken function of a smart contract implementation for Substratum (SUB), an Ethereum ERC20 token, the adminis…
-
High 7.5
Missing Origin Validation in webpack-dev-server
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive…
-
High 7.5
Missing Origin Validation in parcel-bundler
An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR me…
-
High 7.5
Missing Origin Validation in browserify-hmr
An issue was discovered in Browserify-HMR. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSo…
-
Unscored —
gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to t…
-
Unscored —
gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writ…
-
Unscored —
An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by …
-
Unscored —CVE-2018-16793 EPSS 11%
Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username param…
-
Unscored —
The DEISER "Profields - Project Custom Fields" app before 6.0.2 for Jira has Incorrect Access Control.