Archive
25 December 2018
Vulnerabilities first published on this day (UTC), newest first.
26 results · Feed
-
High 7.2
Craft CMS Vulnerable to Server-Side Template Injection
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Se…
-
Unscored —
There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggere…
-
Unscored —CVE-2018-20462 Scanner template
An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. A cross-site scripting (XSS) vulnerability allows re…
-
Unscored —
An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ..…
-
Unscored —
In radare2 through 3.1.3, the assemble function inside libr/asm/p/asm_arm_cs.c allows attackers to cause a denial-of-se…
-
Unscored —
In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a deni…
-
Unscored —
In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denia…
-
Unscored —
In radare2 prior to 3.1.1, r_bin_dyldcache_extract in libr/bin/format/mach0/dyldcache.c may allow attackers to cause a …
-
Unscored —
In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a deni…
-
Unscored —
In radare2 prior to 3.1.1, core_anal_bytes in libr/core/cmd_anal.c allows attackers to cause a denial-of-service (appli…
-
Unscored —
In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial…
-
Unscored —
The read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause a denial of service (a…
-
Unscored —
The process_file function in reader.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attack…
-
Unscored —
The getlong function in numutils.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers…
-
Unscored —
An issue was discovered in 74cms v4.2.111. upload/index.php?c=resume&a=resume_list has XSS via the key parameter.
-
Unscored —
The read_MSAT_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to cause a denial of ser…
-
Unscored —CVE-2018-20448 Public exploit
Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.
-
Unscored —
Technicolor CWA0101 CWA0101E-A23E-c7000r5712-170315-SKC devices allow remote attackers to discover Wi-Fi credentials vi…
-
Unscored —
Technicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-170214a devices allow remote attackers to discover Wi-Fi credent…
-
Unscored —
Technicolor TC7200.d1I TC7200.d1IE-N23E-c7000r5712-170406-HAT devices allow remote attackers to discover Wi-Fi credenti…
-
Unscored —
D-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 EU_DCM-704_1.10 devices allow remote attackers to discover W…
-
Unscored —
Technicolor TC7110.AR STD3.38.03 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863.20…
-
High 7.5
An issue was discovered in the fileDownload function in the CommonController class in FEBS-Shiro before 2018-11-05. An …
-
Unscored —
Technicolor CGA0111 CGA0111E-ES-13-E23E-c8000r5712-170217-0829-TRU devices allow remote attackers to discover Wi-Fi cre…
-
Unscored —
Technicolor TC7200.TH2v2 SC05.00.22 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863…
-
Unscored —
Technicolor TC7110.B STC8.62.02 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863.205…