CVE-2018-20917

cPanel before 70.0.23 allows any user to disable Solr SEC-371...

CVE-2018-4027

An exploitable denial-of-service vulnerability exists in the XMLUploadFile Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause a semaphore deadlock, which prevents the device from receiving any physical or...

CVE-2018-21158

NETGEAR R7800 devices before 1.0.2.46 are affected by incorrect configuration of security settings...

CVE-2018-21025

In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files...

CVE-2018-20983

The wp-retina-2x plugin before 5.2.3 for WordPress has XSS...

CVE-2018-18887

S-CMS PHP 1.0 has SQL injection in member/membernews.php via the type parameter aka the $Ntype field...

CVE-2018-25018

UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen::ReadNext...

CVE-2018-20703

CubeCart 6.2.2 has Reflected XSS via a /ADMIN-FILE/ query string...

CVE-2018-20397

mplus CBC383Z CBC383ZmplusMDr026 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests...

CVE-2018-5075

Online Ticket Booking has XSS via the admin/snacksedit.php snacksname parameter...

CVE-2018-17789

Prospecta Master Data Online MDO allows CSRF...

CVE-2018-7997

Eramba e1.0.6.033 has Reflected XSS on the Error page of the CSV file inclusion tab of the /importTool/preview URI, with a CSV file polluted with malicious JavaScript...

CVE-2018-14916

LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion...

CVE-2018-16709

Fuji Xerox DocuCentre-V 3065, ApeosPort-VI C3371, ApeosPort-V C4475, ApeosPort-V C3375, DocuCentre-VI C2271, ApeosPort-V C5576, DocuCentre-IV C2263, DocuCentre-V C2263, and ApeosPort-V 5070 devices allow remote attackers to read or write to files via crafted PJL commands...

CVE-2018-7201

CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...

CVE-2018-21022

makeXMLListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the hostid parameter...

CVE-2018-20893

cPanel before 74.0.0 allows file-rename operations during account renames SEC-442...

CVE-2018-20858

Recommender before 2018-07-18 allows XSS...

CVE-2018-17981

Lifesize Express ls ex24.7.10 2000 14 devices allow XSS via the interface/interface.php brand parameter...

CVE-2018-20395

NETWAVE MNG6200 C4835805jrc12FU121413.cpr devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests...