Archive
November 2018
Vulnerabilities first published in this month (UTC), newest first.
93 results · Clear filters · Feed
-
Unscored —
NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted reque…
-
Unscored —CVE-2018-18860 Public exploit
A local privilege escalation vulnerability has been identified in the SwitchVPN client 2.1012.03 for macOS. Due to over…
-
Unscored —CVE-2018-15835 Public exploit
Android 1.0 through 9.0 has Insecure Permissions. The Android bug ID is 77286983.
-
Unscored —CVE-2018-15768 Public exploit
Insecure MySQL Configuration Vulnerability
Dell OpenManage Network Manager versions prior to 6.5.0 enabled read/write access to the file system for MySQL users due to insecure default configuration setting for the embedded MySQL database.
-
Unscored —
Improper Authorization Vulnerability
The Dell OpenManage Network Manager virtual appliance versions prior to 6.5.3 contain an improper authorization vulnerability caused by a misconfiguration in the /etc/sudoers file.
-
Unscored —CVE-2018-18619 Public exploit
internal/advanced_comment_system/admin.php in Advanced Comment System 1.0 is prone to an SQL injection vulnerability be…
-
Unscored —CVE-2018-19750 Public exploit
DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Dom…
-
Unscored —CVE-2018-19751 Public exploit
DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.
-
Unscored —CVE-2018-19752 Public exploit
DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.
-
Unscored —CVE-2018-19749 Public exploit
DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.
-
Unscored —CVE-2018-18649 Public exploit
An issue was discovered in the wiki API in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8,…
-
Unscored —
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the IxVeriWave file parser could crash. This was addressed in wiretap/…
-
Unscored —
NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can …
-
Unscored —
NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite c…
-
Unscored —
NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be re…
-
Medium 6.5CVE-2018-16854 Public exploit
Moodle Login CSRF vulnerability in login form
A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.
-
Unscored —CVE-2018-19550 Public exploit
Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveys_submit.php "create survey and submit…
-
Unscored —CVE-2018-19537 Public exploit
TP-Link Archer C5 devices through V2_160201_US allow remote command execution via shell metacharacters on the wan_dyn_h…
-
Unscored —
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh …
-
Unscored —CVE-2018-19459 Public exploit
Adult Filter 1.0 has a Buffer Overflow via a crafted Black Domain List file.
-
High 7.5
Unauthenticated File Read in PHP Proxy
In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246.
-
Unscored —
Codiad 2.8.4 allows remote authenticated administrators to execute arbitrary code by uploading an executable file.
-
Critical 9.8
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privil…
KEV Feb 4, 2025 -
High 7.2
Subrion CMS RCE Vulnerability
/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.
-
Unscored —CVE-2018-18859 Public exploit
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS…
-
Unscored —CVE-2018-18772 Public exploit
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as de…
-
Unscored —CVE-2018-18774 Public exploit
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter.
-
Unscored —CVE-2018-18857 Public exploit
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS…
-
Unscored —CVE-2018-18865 Public exploit
The Royal browser extensions TS before 4.3.60728 (Release Date 2018-07-28) and TSX before 3.3.1 (Release Date 2018-09-1…
-
Unscored —CVE-2018-18773 Public exploit
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as dem…
-
Unscored —CVE-2018-18858 Public exploit
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS…
-
Unscored —CVE-2018-18856 Public exploit
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS…
-
Unscored —CVE-2018-12038 Public exploit
An issue was discovered on Samsung 840 EVO devices. Vendor-specific commands may allow access to the disk-encryption ke…
-
Critical 9.8CVE-2018-9207 Public exploit
Unrestricted Upload of File with Dangerous Type in jquery-file-upload
Arbitrary file upload in jQuery Upload File <= 4.0.2
-
Unscored —CVE-2018-18955 Public exploit
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escala…
-
Unscored —CVE-2018-18803 Public exploit
Curriculum Evaluation System 1.0 allows SQL Injection via the login screen, related to frmCourse.vb and includes/user.v…
-
Unscored —CVE-2018-18799 Public exploit
School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos.
-
Unscored —CVE-2018-18804 Public exploit
Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.
-
Unscored —
SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL] SQL Injection.
-
Unscored —CVE-2018-18759 Public exploit
Modbus Slave 7.0.0 in modbus tools has a Buffer Overflow.