Archive
December 2018
Vulnerabilities first published in this month (UTC), newest first.
73 results · Clear filters · Feed
-
Unscored —
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Interne…
-
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
Critical 9.8
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PH…
KEV Nov 3, 2021 -
Critical 9.8
Deserialization of Untrusted Data in Jenkins
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by acce…
KEV Feb 10, 2022 -
Unscored —
DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.
-
Unscored —
DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.
-
Unscored —
DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.
-
High 7.8CVE-2018-6756 Public exploit
True Key (TK) Windows Client - Authentication Abuse vulnerability
Authentication Abuse vulnerability in Microsoft Windows client in McAfee True Key (TK) 5.1.230.7 and earlier allows local users to execute unauthorized commands via specially crafted malware.
-
High 7.5CVE-2018-6757 Public exploit
True Key (TK) Windows Client - Privilege Escalation vulnerability
Privilege Escalation vulnerability in Microsoft Windows client in McAfee True Key (TK) 5.1.230.7 and earlier allows local users to execute arbitrary code via specially crafted malware.
-
High 7.2CVE-2018-6755 Public exploit
True Key (TK) Windows Client - Weak Directory Permission Vulnerability
Weak Directory Permission Vulnerability in Microsoft Windows client in McAfee True Key (TK) 5.1.230.7 and earlier allows local users to execute arbitrary code via specially crafted malware.
-
Unscored —
DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.
-
Unscored —CVE-2018-19913 Public exploit
DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.
-
Unscored —
DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.
-
Unscored —CVE-2018-19911 Public exploit
FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the ap…
-
Unscored —
An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped fil…
-
Critical 9.8
Privilege Escalation in Kubernetes
In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backe…
-
Unscored —
login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.
-
Unscored —
NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause …
-
Medium 6.5CVE-2018-19859 Public exploit
OpenRefine Directory Traversal
OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive.
-
Unscored —CVE-2018-6092 Public exploit
An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker …
-
Unscored —CVE-2018-6981 Public exploit
VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG, VMware ESXi 6.0 without …
-
Unscored —
System command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows una…
-
Unscored —CVE-2018-1002009 Public exploit
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability r…
-
Unscored —CVE-2018-1002002 Public exploit
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability r…
-
Unscored —CVE-2018-1002008 Public exploit
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability r…
-
Unscored —CVE-2018-1002004 Public exploit
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability r…
-
Unscored —CVE-2018-1002007 Public exploit
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability r…
-
Unscored —CVE-2018-1002001 Public exploit
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability r…
-
Unscored —CVE-2018-1002000 Public exploit
There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require a…
-
Unscored —CVE-2018-1002003 Public exploit
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability r…
-
Unscored —CVE-2018-1002006 Public exploit
These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contac…
-
Unscored —CVE-2018-1002005 Public exploit
These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in bft_list.html.php:…
-
Unscored —
A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully exe…