67755 matches found
CVE-2018-13060
Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue...
CVE-2018-20000
Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java...
CVE-2018-17374
SQL Injection exists in the Auction Factory 4.5.5 component for Joomla! via the filterorderDir or filterorder parameter...
CVE-2018-19783
Kentix MultiSensor-LAN 5.63.00 devices and previous allow Authentication Bypass via an Alternate Path or Channel...
CVE-2018-5713
In Malwarefox Anti-Malware 2.72.169, the driver file zam64.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002010...
CVE-2018-12621
An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the currentpage parameter...
CVE-2018-12688
tinyexr 0.9.5 has a segmentation fault in the wav2Decode function...
CVE-2018-5478
Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension...
CVE-2018-1000809
privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user== to /validate/check url. This vulnerability appears to have been fixed in 2.23.2...
CVE-2018-7547
lyadmin 1.x has XSS via the configWEBSITETITLE parameter to the /admin.php?s=/admin/config/groupsave.html URI...
CVE-2018-7280
The Ninja Forms plugin before 3.2.14 for WordPress has XSS...
CVE-2018-17211
An issue was discovered in PrinterOn Central Print Services CPS through 4.1.4. An unauthenticated attacker can view details about the printers associated with CPS via a crafted HTTP GET request...
CVE-2018-17228
nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call...
CVE-2018-8944
PHPOK 4.8.338 has an arbitrary file upload vulnerability...
CVE-2018-11736
An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file...
CVE-2018-16987
Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-password field in the HTML source code...
CVE-2018-16980
dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/imagetools/index.jsp fieldName and inode parameters...
CVE-2018-11557
YIBAN Easy class education platform 2.0 has XSS via the articlelist.php k parameter...