Archive
24 December 2018
Vulnerabilities first published on this day (UTC), newest first.
41 results · Feed
-
Unscored —
The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET request…
-
Unscored —
In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing i…
-
Unscored —CVE-2018-20247 EPSS 54%
In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing a…
-
Unscored —
In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing i…
-
Unscored —
An issue was discovered on Xiaomi Mi A1 tissot_sprout:8.1.0/OPM1.171019.026/V9.6.4.0.ODHMIFE devices. They store cleart…
-
Unscored —
An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. They use SNMP t…
-
Unscored —
An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. On the 'Air Pri…
-
Unscored —
The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA …
-
Unscored —
The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA …
-
Unscored —
An Improper Input Validation vulnerability exists in Pro-Face GP-Pro EX v4.08 and previous versions which could cause t…
-
Unscored —
A Buffer Error vulnerability exists in PowerSuite 2, all released versions (VW3A8104 & Patches), which could cause an o…
-
Unscored —
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in IIoT Monitor …
-
Unscored —CVE-2018-7836 EPSS 32%
An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 …
-
Unscored —
A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attack…
-
Unscored —
A Code Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable access with maxim…
-
Unscored —
An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT M…
-
Unscored —
A Credential Management vulnerability exists in FoxView HMI SCADA (All Foxboro DCS, Foxboro Evo, and IA Series versions…
-
Unscored —
A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could give access to the web in…
-
Medium 6.5
Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote a…
-
Medium 6.5
Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows re…
-
Medium 5.9
Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-1526…
-
High 8.3
Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-…
-
Medium 6.5
Apache Tika Denial of Service due to Infinite Loop in Tika's SQLite3Parser
A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.
-
High 8.1
Cisco Adaptive Security Appliance Software Privilege Escalation Vulnerability
A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, but unprivileged (levels 0 and 1), remote attacker to perform privileged actions by using the web management interface. The vulner…
-
Critical 9.8CVE-2018-20433 Public exploit
XML External Entity Reference in mchange:c3p0
c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
-
Unscored —
XMPlay 3.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflo…
-
Unscored —
libming 0.4.8 has a NULL pointer dereference in the pushdup function of the decompile.c file.
-
Unscored —
libming 0.4.8 has a NULL pointer dereference in the newVar3 function of the decompile.c file, a different vulnerability…
-
Unscored —
GNU Libextractor through 1.8 has an out-of-bounds read vulnerability in the function history_extract() in plugins/ole2_…
-
Unscored —
libming 0.4.8 has a NULL pointer dereference in the strlenext function of the decompile.c file, a different vulnerabili…
-
Unscored —
GNU Libextractor through 1.8 has a NULL Pointer Dereference vulnerability in the function process_metadata() in plugins…
-
Unscored —
libming 0.4.8 has a NULL pointer dereference in the getName function of the decompile.c file, a different vulnerability…
-
Unscored —
libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file, a different vulnerability …
-
Unscored —
Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non…
-
Unscored —
Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to delete the common_member_wechatmp data st…
-
Medium 4.8CVE-2018-20418 Public exploit
Craft CMS Cross-site Scripting (XSS) Vulnerability
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.
-
Unscored —
Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass a "disabled registration" setting …
-
Unscored —
In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .…
-
Unscored —
Go Ethereum (aka geth) 1.8.19 allows attackers to cause a denial of service (memory consumption) by rewriting the lengt…
-
Unscored —
DouCo DouPHP 1.5 has upload/admin/manager.php?rec=insert CSRF to add an administrator account.