Archive
1 October 2018
Vulnerabilities first published on this day (UTC), newest first.
51 results · Feed
-
Unscored —
The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress …
-
Unscored —
XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.
-
Unscored —
An issue was discovered in BTITeam XBTIT 2.5.4. The "returnto" parameter of account_change.php is vulnerable to an open…
-
Unscored —
The Port Forwarding functionality on DASAN H660GW devices allows remote attackers to execute arbitrary code via shell m…
-
Unscored —
DASAN H660GW devices do not implement any CSRF protection mechanism.
-
Unscored —
ExpressionEngine before 4.3.5 has reflected XSS.
-
Unscored —
DASAN H660GW devices have Stored XSS in the Port Forwarding functionality.
-
High 8.8
An exploitable uninitialized pointer vulnerability exists in the Office Open XML parser of Atlantis Word Processor, ver…
-
High 8.8
An exploitable double-free vulnerability exists in the Office Open XML parser of Atlantis Word Processor, version 3.2.5…
-
High 8.8
An exploitable out-of-bounds write vulnerability exists in the Word Document parser of the Atlantis Word Processor 3.0.…
-
High 8.8
An exploitable stack-based buffer overflow vulnerability exists in the JPEG parser of Atlantis Word Processor, version …
-
High 8.8
An exploitable arbitrary write vulnerability exists in the Word document parser of the Atlantis Word Processor 3.0.2.3 …
-
High 8.8
An exploitable out-of-bounds write exists in the TIFF-parsing functionality of Canvas Draw version 5.0.0. An attacker c…
-
High 8.8
An exploitable uninitialized length vulnerability exists within the Word document-parser of the Atlantis Word Processor…
-
High 7.5
An exploitable uninitialized variable vulnerability exists in the RTF-parsing functionality of Atlantis Word Processor …
-
High 8.8
An exploitable heap-based buffer overflow vulnerability exists in the Windows enhanced metafile parser of Atlantis Word…
-
Unscored —
The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to CSRF due to insufficient validation of the …
-
Unscored —
The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated…
-
Unscored —
The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated…
-
Unscored —
Martem TELEM GW6/GWM versions prior to 2.0.87-4018403-k4 may allow unprivileged users to modify/upload a new system con…
-
Unscored —
Emerson AMS Device Manager v12.0 to v13.5. Non-administrative users are able to change executable and library files on …
-
Unscored —
Emerson AMS Device Manager v12.0 to v13.5. A specially crafted script may be run that allows arbitrary remote code exec…
-
Medium 5.0
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 may fail to set the correct user context in certain impersonation scenarios…
-
Medium 5.3
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 resets access control settings to the out of the box configuration during C…
-
Unscored —
Fuji Electric Alpha5 Smart Loader Versions 3.7 and prior. A buffer overflow information disclosure vulnerability occurs…
-
Unscored —
Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA…
-
Unscored —
Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA…
-
Unscored —
Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA…
-
Unscored —
Fuji Electric Alpha5 Smart Loader Versions 3.7 and prior. The device does not perform a check on the length/size of a p…
-
Unscored —
Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local use…
-
Unscored —
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, …
-
Unscored —
An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Cust…
-
Unscored —
HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account. The attacker can then …
-
Unscored —
SIMDComp before 0.1.1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application…
-
Unscored —
HisiPHP 1.0.8 allows remote attackers to execute arbitrary PHP code by editing a plugin's name to contain that code. Th…
-
Unscored —
In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the…
-
Unscored —
A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname parameter to…
-
Unscored —
SIMDComp before 0.1.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application…
-
Unscored —
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a …
-
Unscored —
An issue was discovered in JTBC(PHP) 3.0.1.6. Arbitrary file read operations are possible via a /console/#/console/file…