Archive
November 2018
Vulnerabilities first published in this month (UTC), newest first.
986 results · Feed
-
Unscored —
The Bluetooth subsystem on Polycom Trio devices with software before 5.5.4 has Incorrect Access Control. An attacker ca…
-
Unscored —
The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS.
-
Unscored —CVE-2018-8529 EPSS 13%
A remote code execution vulnerability exists when Team Foundation Server (TFS) does not enable basic authorization on t…
-
Medium 6.1
The Installation Verification Tool of IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-si…
-
Unscored —
Untrusted search path vulnerability in Baidu Browser Version 43.23.1000.500 and earlier allows an attacker to gain priv…
-
Unscored —
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows …
-
Unscored —
Directory traversal vulnerability in FileZen V3.0.0 to V4.2.1 allows remote attackers to upload an arbitrary file in th…
-
Unscored —
Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior …
-
Unscored —
Cross-site scripting vulnerability in Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP v…
-
Unscored —
Buffer overflow in Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R3.0 and earlier, Denbun IMAP version V3.3I R3.0 a…
-
Unscored —
An unvalidated software update vulnerability in Music Center for PC version 1.0.02 and earlier could allow a man-in-the…
-
Unscored —
YukiWiki 2.1.3 and earlier does not process a particular request properly that may allow consumption of large amounts o…
-
Unscored —
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses ha…
-
Unscored —
FileZen V3.0.0 to V4.2.1 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
-
Unscored —
Buffer overflow in Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 a…
-
Unscored —
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses ha…
-
Unscored —
Cross-site scripting vulnerability in YukiWiki 2.1.3 and earlier allows remote attackers to inject arbitrary web script…
-
Unscored —
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) does no…
-
Unscored —
Cross-site scripting vulnerability in multiple FXC Inc. network devices (Managed Ethernet switch FXC5210/5218/5224 firm…
-
Unscored —
Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary w…
-
Unscored —
BlueStacks App Player (BlueStacks App Player for Windows 3.0.0 to 4.31.55, BlueStacks App Player for macOS 2.0.0 and la…
-
Unscored —
SQL injection vulnerability in the Denbun POP version V3.3P R4.0 and earlier allows remote authenticated attackers to e…
-
Unscored —
Directory traversal vulnerability in Cybozu Garoon 3.5.0 to 4.6.3 allows authenticated attackers to read arbitrary file…
-
Unscored —
Cross-site scripting vulnerability in User-friendly SVN (USVN) Version 1.0.7 and earlier allows remote attackers to inj…
-
Unscored —
OpenDolphin 2.7.0 and earlier allows authenticated users to gain administrative privileges and perform unintended opera…
-
Unscored —
OpenDolphin 2.7.0 and earlier allows authenticated attackers to bypass authentication to create and/or delete other use…
-
Unscored —
OpenDolphin 2.7.0 and earlier allows authenticated attackers to obtain other users credentials such as a user ID and/or…
-
Unscored —
SecureCore Standard Edition Version 2.x allows an attacker to bypass the product 's authentication to log in to a Windo…
-
Unscored —CVE-2018-12543 EPSS 36%
In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting …
-
Unscored —
NetIQ Access Manager XSS vulnerability in versions prior to 4.4 SP3
Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3.
-
Unscored —
An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/in…
-
Unscored —
Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.
-
Medium 6.1
Valine HTML Injection
An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
-
Unscored —
HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application c…
-
Unscored —
The server in mubu note 2018-11-11 has XSS by configuring an account with a crafted name value (along with an arbitrary…
-
Unscored —
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the include…
-
Medium 6.1
Ckeditor XSS Vulnerability
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
-
Critical 9.8
Centreon allows SNMP trap SQL Injection
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.
-
Medium 6.1
Centreon XSS Vulnerability
Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.
-
Unscored —
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote…