CVE-2018-5082

In K7 AntiVirus 15.1.0306, the driver file K7FWHlpr.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x83002128...

CVE-2018-11011

ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java...

CVE-2018-10093

AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution...

CVE-2018-12917

In libpbc.a in PBC through 2017-03-02, there is a heap-based buffer over-read in pbcMipnew in map.c...

CVE-2018-18291

A cross site scripting XSS vulnerability on ASUS RT-AC58U 3.0.0.4.3806516 devices allows remote attackers to inject arbitrary web script or HTML via AdvancedASUSDDNSContent.asp, AdvancedWSecurityContent.asp, AdvancedWirelessContent.asp, Logout.asp, MainLogin.asp, MobileQISLogin.asp, QISwizard.htm...

CVE-2018-21019

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py...

CVE-2018-20942

cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab SEC-351...

CVE-2018-17555

The web component on ARRIS TG2492LG-NA 061213 devices allows remote attackers to obtain sensitive information via the /snmpGet oids parameter...

CVE-2017-13911

A configuration issue was addressed with additional restrictions. This issue affected versions prior to macOS X El Capitan 10.11.6 Security Update 2018-002, macOS Sierra 10.12.6 Security Update 2018-002, macOS High Sierra 10.13.2...

CVE-2018-16593

The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Shell Metacharacter Injection...

CVE-2018-14838

rejucms 2.1 has stored XSS via the admin/book.php content parameter...

CVE-2018-17048

admin/Lib/Action/FpluginAction.class.php in FDCMS aka Fangfa Content Manage System 4.2 allows SQL Injection...

CVE-2018-14713

Format string vulnerability in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to read arbitrary sections of memory and CPU registers via the "hook" URL parameter...

CVE-2018-19658

The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS. This behavior may be encountered by some Evernote users; however, it is a vulnerability in YXBJ, not a vulnerability in Evernote...

CVE-2018-16626

index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name...

CVE-2018-7794

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium see security notification for specific versions which could cause a Denial of Service when reading data with invalid index using Modbus TCP...

CVE-2018-11507

An issue was discovered in Free Lossless Image Format FLIF 0.3. An attacker can trigger a long loop in imageloadpnm in image/image-pnm.cpp...

CVE-2018-11012

ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java...

CVE-2018-20612

UWA 2.3.11 allows index.php?g=admin=admin=addadmindo CSRF...

CVE-2018-21048

An issue was discovered on Samsung mobile devices with O8.x software. There is a Notification leak on a locked device in Standalone Dex mode. The Samsung ID is SVE-2018-12925 November 2018...