Skip to content
OpenAdvisories

Archive

28 December 2018

Vulnerabilities first published on this day (UTC), newest first.

← November 2018 2018 / December /28 January 2019 →
  1. 18
  2. 21
  3. 354
  4. 480
  5. 530
  6. 675
  7. 757
  8. 88
  9. 93
  10. 1032
  11. 1153
  12. 1281
  13. 1356
  14. 1421
  15. 152
  16. 16 
  17. 1778
  18. 1819
  19. 1931
  20. 20136
  21. 2130
  22. 2214
  23. 2340
  24. 2441
  25. 2526
  26. 2633
  27. 2711
  28. 2882
  29. 29 
  30. 3029
  31. 3134
All Critical High Medium Low Exploited only Public exploit

82 results · Feed

  • Unscored —
    CVE-2018-15001

    The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys con…

  • Unscored —
    CVE-2018-15002

    The Vivo V7 device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys allows any …

  • Unscored —
    CVE-2018-15005

    The ZTE ZMAX Champ Android device with a build fingerprint of ZTE/Z917VL/fortune:6.0.1/MMB29M/20170327.120922:user/rele…

  • Unscored —
    CVE-2018-15007

    The Sky Elite 6.0L+ Android device with a build fingerprint of SKY/x6069_trx_l601_sky/x6069_trx_l601_sky:6.0/MRA58K/148…

  • Unscored —
    CVE-2018-15006

    The ZTE ZMAX Champ Android device with a build fingerprint of ZTE/Z917VL/fortune:6.0.1/MMB29M/20170327.120922:user/rele…

  • Unscored —
    CVE-2018-15004

    The Coolpad Canvas device with a build fingerprint of Coolpad/cp3636a/cp3636a:7.0/NRD90M/093031423:user/release-keys co…

  • Unscored —
    CVE-2018-14995

    The ZTE Blade Vantage Android device with a build fingerprint of ZTE/Z839/sweet:7.1.1/NMF26V/20180120.095344:user/relea…

  • Unscored —
    CVE-2018-14988

    The MXQ TV Box 4.4.2 Android device with a build fingerprint of MBX/m201_N/m201_N:4.4.2/KOT49H/20160106:user/test-keys …

  • Unscored —
    CVE-2018-14992

    The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1…

  • Unscored —
    CVE-2018-14998

    The Leagoo P1 Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user…

  • Unscored —
    CVE-2018-14984

    The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:use…

  • Unscored —
    CVE-2018-14987

    The MXQ TV Box 4.4.2 Android device with a build fingerprint of MBX/m201_N/m201_N:4.4.2/KOT49H/20160106:user/test-keys …

  • Unscored —
    CVE-2018-14979

    The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1…

  • Unscored —
    CVE-2018-14985

    The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:use…

  • Unscored —
    CVE-2018-14986

    The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:use…

  • Unscored —
    CVE-2018-20578

    An issue was discovered in NuttX before 7.27. The function netlib_parsehttpurl() in apps/netutils/netlib/netlib_parseht…

  • Unscored —
    CVE-2018-20579

    Contiki-NG before 4.2 has a stack-based buffer overflow in the push function in os/lib/json/jsonparse.c that allows an …

  • Unscored —
    CVE-2018-18665

    The mintToken function of Nexxus (NXX) aka NexxusToken, an Ethereum token, has an integer overflow that allows the owne…

  • Unscored —
    CVE-2018-18667

    The mintToken function of Pylon (PYLNT) aka PylonToken, an Ethereum token, has an integer overflow that allows the owne…

  • Unscored —
    CVE-2018-18696

    main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. NOTE: The vendor claims that documentation fo…

  • Unscored —
    CVE-2018-18666

    The mintToken function of SwftCoin (SWFTC) aka SwftCoin, an Ethereum token, has an integer overflow that allows the own…

  • Unscored —
    CVE-2018-16632

    Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/bl…

  • Medium 4.8
    CVE-2018-16630

    Kirby XSS Vulnerability

    Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.

    getkirby/kirby Packagist
  • Medium 5.4
    CVE-2018-16637

    Evolution CMS Stored Cross-site Scripting (XSS)

    Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.

    evolutioncms/evolution Packagist
  • Medium 5.4
    CVE-2018-16638

    Evolution CMS Cross-site Scripting (XSS)

    Evolution CMS 1.4.x allows XSS via the manager/ search parameter.

    evolutioncms/evolution Packagist
  • Unscored —
    CVE-2018-20575

    Orange Livebox 00.96.320S devices have an undocumented /system_firmwarel.stm URI for manual firmware update. This is re…

  • Unscored —
    CVE-2018-20577

    Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewall_SPI.exe, cgi-bin/setup_remote_mgmt.exe, c…

  • Unscored —
    CVE-2018-20576

    Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phone_test.exe CSRF, leading to arbitrary o…

  • Medium 4.3
    CVE-2018-7366

    ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, th…

    ZTE ZXV10 B860AV2.1_ChinaMobile
  • Unscored —
    CVE-2018-5203

    DEXTUploadX5 version Between 1.0.0.0 and 2.2.0.0 contains a vulnerability that could allow remote attacker to download …

    Devpia DEXTUploadX5
  • Unscored —
    CVE-2018-5204

    ML Report version Between 2.00.000.0000 and 2.18.628.5980 contains a vulnerability that could allow remote attacker to …

    Infraware ML Report
  • Unscored —
    CVE-2018-20574

    The SingleDocParser::HandleFlowMap function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a deni…

    yaml-cpp yaml-cpp0.3 yaml-cpp yaml-cpp Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2018-20572

    WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=sear…

  • Unscored —
    CVE-2018-20571

    DamiCMS 6.0.1 allows remote attackers to read arbitrary files via a crafted admin.php?s=Tpl/Add/id request, as demonstr…

  • Unscored —
    CVE-2018-20573

    The Scanner::EnsureTokensInQueue function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial…

    yaml-cpp yaml-cpp0.3 yaml-cpp yaml-cpp Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2018-17539

    The BGP daemon (bgpd) in all IP Infusion ZebOS versions to 7.10.6 and all OcNOS versions to 1.3.3.145 allow remote atta…

  • Unscored —
    CVE-2018-15334

    A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an AP…

    F5 BIG-IP APM Network devices
  • Unscored —
    CVE-2018-15333

    On versions 11.2.1. and greater, unrestricted Snapshot File Access allows BIG-IP system's user with any role, including…

    F5 BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Network devices Browsers
  • Unscored —
    CVE-2018-15335

    When APM 13.0.0-13.1.x is deployed as an OAuth Resource Server, APM becomes a client application to an external OAuth a…

    F5 BIG-IP APM Network devices
  • Unscored —
    CVE-2018-20557

    An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the page_name parameter.