Archive
December 2018
Vulnerabilities first published in this month (UTC), newest first.
1,165 results · Feed
-
Unscored —
Safe Software FME Server through 2018.1 creates and enables three additional accounts in addition to the initial admini…
-
Unscored —
ARRIS SBG6580-2 D30GW-SEAEAGLE-1.5.2.5-GA-00-NOSH devices allow remote attackers to discover credentials via iso.3.6.1.…
-
Unscored —
Zoom 5352 v5.5.8.6Y devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and i…
-
Unscored —
Motorola SBG901 SBG901-2.10.1.1-GA-00-581-NOSH, SBG941 SBG941-2.11.0.0-GA-07-624-NOSH, and SVG1202 SVG1202-2.1.0.0-GA-1…
-
Unscored —
Ambit DDW2600 5.100.1009, DDW2602 5.105.1003, T60C926 4.64.1012, and U10C019 5.66.1026 devices allow remote attackers t…
-
Unscored —
An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to an 8 by…
-
Unscored —
An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to an 8 by…
-
Unscored —CVE-2018-20377 Public exploit
Orange Livebox 00.96.320S devices allow remote attackers to discover Wi-Fi credentials via /get_getnetworkconf.cgi on p…
-
Unscored —
An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to an 8 by…
-
Unscored —
Local attackers can trigger a Kernel Pool Buffer Overflow in Antiy AVL ATool v1.0.0.22. An attacker must first obtain t…
-
Unscored —
PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attacker…
-
Unscored —
TP-Link TD-W8961ND devices allow XSS via the hostname of a DHCP client.
-
Unscored —
The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the …
-
Unscored —
Tenda ADSL modem routers 1.0.1 allow XSS via the hostname of a DHCP client.
-
Unscored —
SZ NetChat before 7.9 has XSS in the MyName input field of the Options module. Attackers are able to inject commands to…
-
Unscored —
Barracuda Message Archiver 2018 has XSS in the error_msg exception-handling value for the ldap_user parameter to the cg…
-
Unscored —
The "mall some commodity details: commodity consultation" component in WSTMart 2.0.8_181212 has stored XSS via the cons…
-
Unscored —
LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference.
-
Unscored —
LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow.
-
Unscored —
LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference.
-
Unscored —
An issue was discovered in 1Password 7.2.3.BETA before 7.2.3.BETA-3 on macOS. A mistake in error logging resulted in in…
-
Unscored —
An invalid memory address dereference was discovered in the hf_assembly function of libfaad/sbr_hfadj.c in Freeware Adv…
-
Unscored —
A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (F…
-
Unscored —
An invalid memory address dereference was discovered in the sbr_process_channel function of libfaad/sbr_dec.c in Freewa…
-
Unscored —
An invalid memory address dereference was discovered in the lt_prediction function of libfaad/lt_predict.c in Freeware …
-
Unscored —
An invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbr_dec.c in Fre…
-
Unscored —
A NULL pointer dereference was discovered in sbr_process_channel of libfaad/sbr_dec.c in Freeware Advanced Audio Decode…
-
Unscored —
The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows atta…
-
Unscored —
The Markdown component in Evernote (Chinese) before 8.3.2 on macOS allows stored XSS, aka MAC-832.
-
Unscored —
libpff_item_tree_create_node in libpff_item_tree.c in libpff before experimental-20180714 allows attackers to cause a d…
-
Unscored —
atbox.htm on D-Link DSL-2770L devices allows remote unauthenticated attackers to discover admin credentials.
-
Unscored —
dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials.
-
Unscored —
spaces.htm on multiple D-Link devices (DSL, DIR, DWR) allows remote unauthenticated attackers to discover admin credent…
-
Critical 9.8
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING…
KEV Oct 24, 2022 -
High 7.8
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, …
KEV Oct 24, 2022 -
High 7.8CVE-2018-19322 Exploited · Ransomware
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, …
KEV Oct 24, 2022 -
High 7.8
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING…
KEV Oct 24, 2022 -
Unscored —
Certain Secure Access SA Series SSL VPN products (originally developed by Juniper Networks but now sold and supported b…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Jenzabar v8.2.1 through 9.2.0 allows remote attackers to inject arbitrary w…
-
Unscored —
LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload, resulting …