Archive
December 2018
Vulnerabilities first published in this month (UTC), newest first.
1,165 results · Feed
-
Unscored —
NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure v…
-
Unscored —
NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.
-
Unscored —
The determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum game, uses a certain …
-
Unscored —
QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML do…
-
Unscored —
An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/re…
-
Unscored —
An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler res…
-
Unscored —
An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption.
-
Unscored —
Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions. A remote attacker could inject arbitrary code into a …
-
Unscored —
Engelsystem before commit hash 2e28336 allows CSRF.
-
Medium 6.1CVE-2018-19799 Public exploit
Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.
-
Unscored —
An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.
-
Unscored —
An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp.
-
Unscored —
ETK_E900.sys, a SmartETK driver for VIA Technologies EPIA-E900 system board, is vulnerable to denial of service attack …
-
Unscored —
A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obta…
-
Unscored —
MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter.
-
Unscored —CVE-2018-20485 Public exploit
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.
-
Unscored —
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to …
-
Unscored —
set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata a…
-
Unscored —CVE-2018-20484 Public exploit
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.
-
Unscored —
Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote…
-
Low 3.4
yast2-rmt leaks database passwords in process list
The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing local attackers to access or corrupt the RMT database.
-
Unscored —
XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause…
-
Unscored —
An issue was discovered in S-CMS 1.0. It allows SQL Injection via the wap_index.php?type=newsinfo S_id parameter.
-
Unscored —
An issue was discovered in S-CMS 3.0. It allows SQL Injection via the bank/callback1.php P_no field.
-
Unscored —
An issue was discovered in S-CMS 1.0. It allows SQL Injection via the js/pic.php P_id parameter.
-
Unscored —
In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU an…
-
Unscored —
An issue was discovered in S-CMS 1.0. It allows reading certain files, such as PHP source code, via the admin/download.…
-
Unscored —
An issue was discovered in S-CMS 3.0. It allows XSS via the admin/demo.php T_id parameter.
-
High 7.2
Craft CMS Vulnerable to Server-Side Template Injection
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Se…
-
Unscored —
There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggere…
-
Unscored —CVE-2018-20462 Scanner template
An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. A cross-site scripting (XSS) vulnerability allows re…
-
Unscored —
An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ..…
-
Unscored —
In radare2 through 3.1.3, the assemble function inside libr/asm/p/asm_arm_cs.c allows attackers to cause a denial-of-se…
-
Unscored —
In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a deni…
-
Unscored —
In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denia…
-
Unscored —
In radare2 prior to 3.1.1, r_bin_dyldcache_extract in libr/bin/format/mach0/dyldcache.c may allow attackers to cause a …
-
Unscored —
In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a deni…
-
Unscored —
In radare2 prior to 3.1.1, core_anal_bytes in libr/core/cmd_anal.c allows attackers to cause a denial-of-service (appli…
-
Unscored —
In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial…