Archive
December 2018
Vulnerabilities first published in this month (UTC), newest first.
1,165 results · Feed
-
Unscored —
The read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause a denial of service (a…
-
Unscored —
The process_file function in reader.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attack…
-
Unscored —
The getlong function in numutils.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers…
-
Unscored —
An issue was discovered in 74cms v4.2.111. upload/index.php?c=resume&a=resume_list has XSS via the key parameter.
-
Unscored —
The read_MSAT_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to cause a denial of ser…
-
Unscored —CVE-2018-20448 Public exploit
Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.
-
Unscored —
Technicolor CWA0101 CWA0101E-A23E-c7000r5712-170315-SKC devices allow remote attackers to discover Wi-Fi credentials vi…
-
Unscored —
Technicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-170214a devices allow remote attackers to discover Wi-Fi credent…
-
Unscored —
Technicolor TC7200.d1I TC7200.d1IE-N23E-c7000r5712-170406-HAT devices allow remote attackers to discover Wi-Fi credenti…
-
Unscored —
D-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 EU_DCM-704_1.10 devices allow remote attackers to discover W…
-
Unscored —
Technicolor TC7110.AR STD3.38.03 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863.20…
-
High 7.5
An issue was discovered in the fileDownload function in the CommonController class in FEBS-Shiro before 2018-11-05. An …
-
Unscored —
Technicolor CGA0111 CGA0111E-ES-13-E23E-c8000r5712-170217-0829-TRU devices allow remote attackers to discover Wi-Fi cre…
-
Unscored —
Technicolor TC7200.TH2v2 SC05.00.22 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863…
-
Unscored —
Technicolor TC7110.B STC8.62.02 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863.205…
-
Unscored —
The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET request…
-
Unscored —
In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing i…
-
Unscored —CVE-2018-20247 EPSS 54%
In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing a…
-
Unscored —
In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing i…
-
Unscored —
An issue was discovered on Xiaomi Mi A1 tissot_sprout:8.1.0/OPM1.171019.026/V9.6.4.0.ODHMIFE devices. They store cleart…
-
Unscored —
An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. They use SNMP t…
-
Unscored —
An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. On the 'Air Pri…
-
Unscored —
The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA …
-
Unscored —
The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA …
-
Unscored —
An Improper Input Validation vulnerability exists in Pro-Face GP-Pro EX v4.08 and previous versions which could cause t…
-
Unscored —
A Buffer Error vulnerability exists in PowerSuite 2, all released versions (VW3A8104 & Patches), which could cause an o…
-
Unscored —
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in IIoT Monitor …
-
Unscored —CVE-2018-7836 EPSS 32%
An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 …
-
Unscored —
A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attack…
-
Unscored —
A Code Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable access with maxim…
-
Unscored —
An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT M…
-
Unscored —
A Credential Management vulnerability exists in FoxView HMI SCADA (All Foxboro DCS, Foxboro Evo, and IA Series versions…
-
Unscored —
A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could give access to the web in…
-
Medium 6.5
Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote a…
-
Medium 6.5
Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows re…
-
Medium 5.9
Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-1526…
-
High 8.3
Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-…
-
Medium 6.5
Apache Tika Denial of Service due to Infinite Loop in Tika's SQLite3Parser
A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.
-
High 8.1
Cisco Adaptive Security Appliance Software Privilege Escalation Vulnerability
A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, but unprivileged (levels 0 and 1), remote attacker to perform privileged actions by using the web management interface. The vulner…
-
Critical 9.8CVE-2018-20433 Public exploit
XML External Entity Reference in mchange:c3p0
c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.