Archive
15 October 2018
Vulnerabilities first published on this day (UTC), newest first.
33 results · Feed
-
Unscored —
Stored XSS has been discovered in version 1.0.12 of the LUYA CMS software via /admin/api-cms-nav/create-page.
-
Unscored —
Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper ac…
-
Unscored —CVE-2018-17980 Public exploit
NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file l…
-
Unscored —CVE-2018-17532 EPSS 71%
Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vuln…
-
Unscored —
Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlo…
-
Unscored —
Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities.
-
Unscored —
Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse …
-
Unscored —
Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, et…
-
Medium 6.1
Moderate severity vulnerability that affects moin
Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
-
Unscored —
Denial of Service in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056), 10.18.x.…
-
Unscored —
Clam AntiVirus unmew11() Denial of Service Vulnerability
A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker to cause a denial of service (DoS) condition. The vulnerability is due to an error related to the MEW unpacker within the "unmew11()" function (libclamav/mew.c), which can be exploite…
-
Unscored —
Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operator…
-
Unscored —CVE-2018-17961 Public exploit
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving er…
-
Unscored —
An issue was discovered in Ivanti Workspace Control before 10.3.0.0 and RES One Workspace, when file and folder securit…
-
Unscored —
An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A local authenticated user …
-
Unscored —
An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A local authenticated user …
-
Unscored —
An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A local authenticated user …
-
Unscored —
An issue was discovered in nc-cms through 2017-03-10. index.php?action=edit_html allows XSS via the name parameter, as …
-
High 7.1
IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack…
-
High 7.7
IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 could allow a remote attacker to traverse directories on the …
-
Unscored —CVE-2018-18324 Public exploit
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir paramete…
-
Unscored —
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin…
-
Unscored —
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/in…
-
Unscored —
An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary…
-
Unscored —
An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary…
-
Unscored —
The /dev/block/mmcblk0rpmb driver kernel module on Qiku 360 Phone N6 Pro 1801-A01 devices allows attackers to cause a d…
-
Unscored —
DESHANG DSCMS 1.1 has CSRF via the public/index.php/admin/admin/add.html URI.
-
Unscored —
com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFi…
-
Unscored —
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI.
-
Unscored —
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. …
-
Unscored —
An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.…
-
Unscored —
MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action.
-
Medium 6.1
Camaleon CMS vulnerable to Stored Cross-site Scripting
In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false. NOTE: the vendor reports that they are "unable to reproduce the re…