Skip to content
OpenAdvisories

Archive

27 November 2018

Vulnerabilities first published on this day (UTC), newest first.

← October 2018 2018 / November /27 December 2018 →
  1. 129
  2. 228
  3. 33
  4. 46
  5. 522
  6. 647
  7. 750
  8. 838
  9. 932
  10. 108
  11. 119
  12. 1243
  13. 1338
  14. 14157
  15. 1542
  16. 1639
  17. 1720
  18. 185
  19. 1910
  20. 2036
  21. 2115
  22. 2212
  23. 2313
  24. 241
  25. 253
  26. 2661
  27. 2796
  28. 2842
  29. 2944
  30. 3037
All Critical High Medium Low Exploited only Public exploit

96 results · Feed

  • High 7.7
    CVE-2018-0721

    Security Advisory for Vulnerabilities in QTS

    Buffer Overflow vulnerability in NAS devices. QTS allows attackers to run arbitrary code. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior…

    QNAP Systems QTS
  • Unscored —
    CVE-2018-7960

    There is a SRTP icon display vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-i…

    Huawei eSpace 7950 Network devices
  • Unscored —
    CVE-2018-7958

    There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated, remote at…

    Huawei eSpace 7950 Network devices
  • Unscored —
    CVE-2018-7961

    There is a smart SMS verification code vulnerability in some Huawei smart phones. An attacker should trick a user to ac…

    Huawei Emily-AL00A Network devices
  • Unscored —
    CVE-2018-7946

    There is an information leak vulnerability in some Huawei smartphones. An attacker may do some specific configuration i…

    Huawei Huawei Honor 7A, Huawei Honor 9 Lite Network devices
  • Unscored —
    CVE-2018-7959

    There is a short key vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-mi…

    Huawei eSpace 7950 Network devices
  • Unscored —
    CVE-2018-7977

    There is an information leakage vulnerability on several Huawei products. Due to insufficient communication protection …

    Huawei FusionSphere OpenStack Network devices
  • Unscored —
    CVE-2018-7988

    There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. The system does not sufficiently…

    Huawei Huawei nova 2 Plus, Huawei Mate9 Pro Network devices
  • Medium 5.5
    CVE-2018-0719

    Security Advisory for Vulnerabilities in QTS

    Cross-site Scripting (XSS) vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 201…

    QNAP Systems QTS
  • Unscored —
    CVE-2018-18982 Public exploit EPSS 63%

    NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can …

  • Unscored —
    CVE-2018-16130 EPSS 24%

    System command injection in request_mitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary sy…

  • Medium 4.8
    CVE-2018-17256

    Umbraco CMS vulnerable to stored XSS

    Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public ac…

    CyberSecurity Philippines - CERT UmbracoCMS umbraco NuGet
  • Unscored —
    CVE-2018-17936 Public exploit EPSS 15%

    NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite c…

  • Unscored —
    CVE-2018-17934 Public exploit EPSS 20%

    NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be re…

  • Unscored —
    CVE-2018-13360

    Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "f…

  • Unscored —
    CVE-2018-13307

    System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via t…

  • Unscored —
    CVE-2018-13022

    Cross-site scripting vulnerability in the API 404 page on Xiaomi Mi Router 3 version 2.22.15 allows attackers to execut…

  • Unscored —
    CVE-2018-13352

    Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session toke…

  • Unscored —
    CVE-2018-13331

    Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when vie…

  • Unscored —
    CVE-2018-13357

    Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when vie…

  • Unscored —
    CVE-2018-13330

    System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands …

  • Unscored —
    CVE-2018-13361 EPSS 17%

    User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "…

  • Unscored —
    CVE-2018-13333

    Cross-site scripting in File Manager in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript in the pe…

  • Unscored —
    CVE-2018-13316

    System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands v…

  • Unscored —
    CVE-2018-13418

    System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the …

  • Unscored —
    CVE-2018-13355

    Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups witho…

  • Unscored —
    CVE-2018-13336

    System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands …

  • Unscored —
    CVE-2018-13338 EPSS 10%

    System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands …

  • Unscored —
    CVE-2018-13334

    Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "op…

  • Unscored —
    CVE-2018-13332

    Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to a…

  • Unscored —
    CVE-2018-13329

    Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "…

  • Unscored —
    CVE-2018-13353

    System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the…

  • Unscored —
    CVE-2018-13314

    System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands v…

  • Unscored —
    CVE-2018-13349

    Cross-site scripting in the web application taskbar in TerraMaster TOS version 3.1.03 allows attackers to execute JavaS…

  • Unscored —
    CVE-2018-13359 EPSS 20%

    Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the …

  • Unscored —
    CVE-2018-13356

    Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions.

  • Unscored —
    CVE-2018-13351

    Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the …

  • Unscored —
    CVE-2018-13306

    System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via …

  • Unscored —
    CVE-2018-13354 EPSS 23%

    System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands …

  • Unscored —
    CVE-2018-13358 EPSS 25%

    System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands …