17 March 2019

26 results · Clear filters · Feed

• Unscored —
  CVE-2018-20323 Public exploit EPSS 54%

  www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitr…

  Mar 17, 2019
• Unscored —
  CVE-2018-19487 Public exploit

  The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_prof…

  Mar 17, 2019
• Critical 10.0
  CVE-2018-19276 Public exploit Scanner template EPSS 99%

  OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated us…

  Mar 17, 2019
• Unscored —
  CVE-2018-14575 Public exploit

  Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (C…

  Mar 17, 2019
• Unscored —
  CVE-2018-20221 Public exploit EPSS 10%

  Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deseriali…

  Mar 17, 2019
• Unscored —
  CVE-2018-20220 Public exploit EPSS 15%

  An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authe…

  Mar 17, 2019
• Unscored —
  CVE-2018-20219 Public exploit EPSS 15%

  An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the d…

  Mar 17, 2019
• Unscored —
  CVE-2018-20218 Public exploit EPSS 11%

  An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input direc…

  Mar 17, 2019
• Unscored —
  CVE-2018-20162 Public exploit

  Digi TransPort LR54 4.4.0.26 and possible earlier devices have Improper Input Validation that allows users with 'super'…

  Mar 17, 2019
• High 8.1
  CVE-2019-5414 Public exploit

  Command Injection in kill-port

  If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port < 1.3.2.

  kill-port npm
  Mar 17, 2019
• Critical 9.8
  CVE-2019-5413 Public exploit

  Code Injection in morgan

  An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

  morgan npm
  Mar 17, 2019
• Unscored —
  CVE-2018-18798 Public exploit

  Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.p…

  Mar 17, 2019
• Unscored —
  CVE-2019-7391 Public exploit EPSS 14%

  ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.

  Mar 17, 2019
• Unscored —
  CVE-2018-18762 Public exploit

  SaltOS 3.1 r8126 contains a database download vulnerability.

  Mar 17, 2019
• Unscored —
  CVE-2019-7385 Public exploit EPSS 12%

  An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, an…

  Mar 17, 2019
• Unscored —
  CVE-2018-18435 Public exploit

  KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting an…

  Mar 17, 2019
• Unscored —
  CVE-2018-17997 Public exploit

  LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).

  Mar 17, 2019
• Unscored —
  CVE-2018-17996 Public exploit

  LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete…

  Mar 17, 2019
• Unscored —
  CVE-2018-19524 Public exploit EPSS 51%

  An issue was discovered on Shenzhen Skyworth DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1, DT721-cb SDOT…

  Mar 17, 2019
• Unscored —
  CVE-2019-6973 Public exploit EPSS 14%

  Sricam IP CCTV cameras are vulnerable to denial of service via multiple incomplete HTTP requests because the web server…

  Mar 17, 2019
• Unscored —
  CVE-2019-6967 Public exploit EPSS 13%

  AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF.

  Mar 17, 2019
• Unscored —
  CVE-2019-6716 Public exploit

  An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 th…

  Mar 17, 2019
• Unscored —
  CVE-2019-6714 Public exploit EPSS 32%

  An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in P…

  Mar 17, 2019
• Unscored —
  CVE-2019-9083 Public exploit EPSS 18%

  SQLiteManager 1.20 and 1.24 allows SQL injection via the /sqlitemanager/main.php dbsel parameter. NOTE: This product is…

  Mar 17, 2019
• Unscored —
  CVE-2018-10093 Public exploit Scanner template EPSS 68%

  AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution.

  Mar 17, 2019
• High 7.5
  CVE-2019-6690 Public exploit

  Improper Input Validation python-gnupg

  python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Impr…

  python-gnupg python-gnupg python-gnupg Debian Ubuntu PyPI
  Mar 17, 2019