Archive
December 2018
Vulnerabilities first published in this month (UTC), newest first.
73 results · Clear filters · Feed
-
Medium 6.1CVE-2018-6341 Public exploit
Cross-Site Scripting in react-dom
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x,…
-
High 8.8
Archive_Tar contains Potential RCE if filename starts with phar://
PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called with…
-
Unscored —
NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure v…
-
Unscored —
NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.
-
Unscored —
An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/re…
-
Medium 6.1CVE-2018-19799 Public exploit
Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.
-
Unscored —CVE-2018-20485 Public exploit
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.
-
Unscored —CVE-2018-20484 Public exploit
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.
-
Unscored —
An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ..…
-
Unscored —CVE-2018-20448 Public exploit
Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.
-
Critical 9.8CVE-2018-20433 Public exploit
XML External Entity Reference in mchange:c3p0
c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
-
Medium 4.8CVE-2018-20418 Public exploit
Craft CMS Cross-site Scripting (XSS) Vulnerability
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.
-
Unscored —CVE-2018-20377 Public exploit
Orange Livebox 00.96.320S devices allow remote attackers to discover Wi-Fi credentials via /get_getnetworkconf.cgi on p…
-
Critical 9.8
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING…
KEV Oct 24, 2022 -
High 7.8
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, …
KEV Oct 24, 2022 -
High 7.8
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING…
KEV Oct 24, 2022 -
Unscored —CVE-2018-18441 Public exploit
D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices i…
-
Unscored —CVE-2018-18629 Public exploit
An issue was discovered in the Keybase command-line client before 2.8.0-20181023124437 for Linux. An untrusted search p…
-
Unscored —
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker wit…
-
Critical 9.8
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checkin…
-
Unscored —
bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Page…
-
High 7.5CVE-2018-1000850 Public exploit
Directory Traversal vulnerability in Square Retrofit
Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter that can result in By manipulating the URL an attacker could add or delete resources othe…
-
Critical 9.1CVE-2018-1000844 Public exploit
XML External Entity (XXE) vulnerability in Square Retrofit
Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerability in JAXB that can result in An attacker could use this to remotely read files from the file system or to perform SSR…
-
Unscored —CVE-2018-19829 Public exploit
Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary…
-
Unscored —
A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to exec…
-
Unscored —CVE-2018-19828 Public exploit
Artica Integria IMS 5.0.83 has XSS via the search_string parameter.
-
Medium 6.1CVE-2018-19933 Public exploit
Bolt Cross-site Scripting (XSS) via text input click preview button
Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.
-
Unscored —CVE-2018-20159 Public exploit
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allo…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted met…
-
Medium 5.9CVE-2018-16875 Public exploit
Denial of service in chain verification in crypto/x509
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting…
-
Unscored —CVE-2018-18923 Public exploit
AbiSoft Ticketly 1.0 is affected by multiple SQL Injection vulnerabilities through the parameters name, category_id and…
-
High 7.1
IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) …
-
Medium 6.5CVE-2018-7691 Public exploit
MFSBGN03835 rev.1 - Fortify Software Security Center (SSC), Remote Unauthorized Access
A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote Unauthorized Access
-
Medium 6.5CVE-2018-7690 Public exploit
MFSBGN03835 rev.1 - Fortify Software Security Center (SSC), Remote Unauthorized Access
A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote Unauthorized Access
-
Unscored —
In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles r…
-
Unscored —
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Window…
-
High 8.4
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Mar 3, 2025 -
Unscored —
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in …
-
Unscored —
A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly res…
-
High 7.8
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka …
KEV May 24, 2022