Archive
17 December 2018
Vulnerabilities first published on this day (UTC), newest first.
78 results · Feed
-
Unscored —
An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premi…
-
Unscored —
A URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quan…
-
Unscored —
An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon…
-
Unscored —
A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure…
-
Unscored —
In GraphicsMagick 1.3.31, the ReadDIBImage function of coders/dib.c has a vulnerability allowing a crash and denial of …
-
Unscored —
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.c…
-
Unscored —
FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account.
-
Unscored —
A sandbox escape issue was discovered in VyOS 1.1.8. It provides a restricted management shell for operator users to ad…
-
Unscored —
A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to exec…
-
Unscored —
A stack-based buffer overflow in the LAN UPnP service running on UDP port 1900 of Swisscom Internet-Box (2, Standard, a…
-
Unscored —
PrinterOn Enterprise 4.1.4 allows Arbitrary File Deletion.
-
Unscored —
In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in liby…
-
Unscored —
In YARA 3.8.1, bytecode in a specially crafted compiled rule can read data from any arbitrary address in memory, in lib…
-
Unscored —CVE-2018-19828 Public exploit
Artica Integria IMS 5.0.83 has XSS via the search_string parameter.
-
Medium 6.1CVE-2018-19933 Public exploit
Bolt Cross-site Scripting (XSS) via text input click preview button
Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.
-
Unscored —
An issue was discovered in several Bosch IP cameras for firmware versions 6.32 and higher. A malicious client could pot…
-
Unscored —
In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyar…
-
Unscored —
Buffer overflow in dhd_bus_flow_ring_flush_response in drivers/net/wireless/bcmdhd4358/dhd_pcie.c in the bcmdhd4358 Wi-…
-
Unscored —
Buffer overflow in dhd_bus_flow_ring_create_response in drivers/net/wireless/bcmdhd4358/dhd_pcie.c in the bcmdhd4358 Wi…
-
Unscored —
Buffer overflow in dhd_bus_flow_ring_delete_response in drivers/net/wireless/bcmdhd4358/dhd_pcie.c in the bcmdhd4358 Wi…
-
Unscored —
Out-of-bounds array access in dhd_rx_frame in drivers/net/wireless/bcmdhd4358/dhd_linux.c in the bcmdhd4358 Wi-Fi drive…
-
Unscored —
A NULL pointer dereference in dhd_prot_txdata_write_flush in drivers/net/wireless/bcmdhd4358/dhd_msgbuf.c in the bcmdhd…
-
Critical 9.8
-
Unscored —
pvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error.
-
Unscored —
PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request.
-
Unscored —
An issue was discovered in Bento4 1.5.1-627. AP4_Sample::ReadData in Core/Ap4Sample.cpp allows attackers to trigger an …
-
Unscored —
In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms, there is a heap-based buffer over-read in the ReadBMPIm…
-
Unscored —
In GraphicsMagick 1.4 snapshot-20181209 Q8, there is a heap-based buffer overflow in the WriteTGAImage function of tga.…
-
Medium 5.4
IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit…
-
Medium 5.4
IBM Security Guardium 10.0 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arb…
-
Low 3.7
IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 does not validate, or incorrectly validates,…
-
Medium 5.9
IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require t…
-
Low 3.7
IBM Security Guardium 10.0 and 10.5 stores sensitive information in URL parameters. This may lead to information disclo…
-
Unscored —
Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.
-
Unscored —
Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivere…
-
Unscored —
Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as th…
-
Unscored —
Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string…
-
Unscored —
Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring modul…
-
Unscored —
Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character a…
-
Unscored —
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/AdminA…