Archive
15 November 2018
Vulnerabilities first published on this day (UTC), newest first.
42 results · Feed
-
Unscored —
tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later …
-
Unscored —CVE-2018-5407 Public exploit
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attack…
-
Unscored —
The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu before 3.1 allows out-of-bounds write or read access to PowerN…
-
Unscored —CVE-2018-16621 Public exploit
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.
-
Unscored —
Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.
-
Unscored —
Sonatype Nexus Repository Manager before 3.14 allows XSS.
-
Unscored —
The Bluetooth subsystem on Polycom Trio devices with software before 5.5.4 has Incorrect Access Control. An attacker ca…
-
Unscored —
The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS.
-
Unscored —CVE-2018-8529 EPSS 13%
A remote code execution vulnerability exists when Team Foundation Server (TFS) does not enable basic authorization on t…
-
Medium 6.1
The Installation Verification Tool of IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-si…
-
Unscored —
Untrusted search path vulnerability in Baidu Browser Version 43.23.1000.500 and earlier allows an attacker to gain priv…
-
Unscored —
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows …
-
Unscored —
Directory traversal vulnerability in FileZen V3.0.0 to V4.2.1 allows remote attackers to upload an arbitrary file in th…
-
Unscored —
Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior …
-
Unscored —
Cross-site scripting vulnerability in Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP v…
-
Unscored —
Buffer overflow in Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R3.0 and earlier, Denbun IMAP version V3.3I R3.0 a…
-
Unscored —
An unvalidated software update vulnerability in Music Center for PC version 1.0.02 and earlier could allow a man-in-the…
-
Unscored —
YukiWiki 2.1.3 and earlier does not process a particular request properly that may allow consumption of large amounts o…
-
Unscored —
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses ha…
-
Unscored —
FileZen V3.0.0 to V4.2.1 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
-
Unscored —
Buffer overflow in Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 a…
-
Unscored —
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses ha…
-
Unscored —
Cross-site scripting vulnerability in YukiWiki 2.1.3 and earlier allows remote attackers to inject arbitrary web script…
-
Unscored —
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) does no…
-
Unscored —
Cross-site scripting vulnerability in multiple FXC Inc. network devices (Managed Ethernet switch FXC5210/5218/5224 firm…
-
Unscored —
Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary w…
-
Unscored —
BlueStacks App Player (BlueStacks App Player for Windows 3.0.0 to 4.31.55, BlueStacks App Player for macOS 2.0.0 and la…
-
Unscored —
SQL injection vulnerability in the Denbun POP version V3.3P R4.0 and earlier allows remote authenticated attackers to e…
-
Unscored —
Directory traversal vulnerability in Cybozu Garoon 3.5.0 to 4.6.3 allows authenticated attackers to read arbitrary file…
-
Unscored —
Cross-site scripting vulnerability in User-friendly SVN (USVN) Version 1.0.7 and earlier allows remote attackers to inj…
-
Unscored —
OpenDolphin 2.7.0 and earlier allows authenticated users to gain administrative privileges and perform unintended opera…
-
Unscored —
OpenDolphin 2.7.0 and earlier allows authenticated attackers to bypass authentication to create and/or delete other use…
-
Unscored —
OpenDolphin 2.7.0 and earlier allows authenticated attackers to obtain other users credentials such as a user ID and/or…
-
Unscored —
SecureCore Standard Edition Version 2.x allows an attacker to bypass the product 's authentication to log in to a Windo…
-
Unscored —CVE-2018-12543 EPSS 36%
In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting …
-
Unscored —
NetIQ Access Manager XSS vulnerability in versions prior to 4.4 SP3
Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3.
-
Unscored —
An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/in…
-
Unscored —
Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.
-
Medium 6.1
Valine HTML Injection
An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
-
Unscored —
HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application c…