CVE-2018-14862

Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request...

CVE-2018-20599

UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadminfileedit action...

CVE-2018-19326

Zyxel VMG1312-B10D devices before 5.13AAXA.8C0 allow ../ Directory Traversal, as demonstrated by reading /etc/passwd...

CVE-2018-14492

Tenda AC7 through V15.03.06.44CN, AC9 through V15.03.05.196318CN, and AC10 through V15.03.06.23CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI...

CVE-2018-10469

b3log Symphony aka Sym 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name parameter to the /upload URI...

CVE-2018-21018

Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions...

CVE-2018-14008

Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled...

CVE-2018-11367

An issue was discovered in CppCMS before 1.2.1. There is a denial of service in the JSON parser module...

CVE-2018-17170

Grouptime Teamwire Desktop Client 1.5.1 prior to 1.9.0 on Windows allows code injection via a template, leading to remote code execution. All backend versions prior to prod-2018-11-13-15-00-42 are affected...

CVE-2018-17025

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage action for a page with no special role...

CVE-2018-12296

Insufficient access control in /api/external/7.0/system.System.getinfos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POST requests...

CVE-2018-21159

NETGEAR ReadyNAS devices before 6.9.3 are affected by incorrect configuration of security settings...

CVE-2018-1000890

FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can allow the attacker to grab the entire database of the application...

CVE-2018-21090

An issue was discovered on Samsung mobile devices with software through 2017-11-03 S.LSI modem chipsets. The Exynos modem chipset has a baseband buffer overflow. The Samsung ID is SVE-2017-10745 January 2018...

CVE-2018-12101

CMS Clipper 1.3.3 has XSS in the Security tab search, User Groups, Resource Groups, and User/Resource Group Links fields...

CVE-2018-20604

Lei Feng TV CMS aka LFCMS 3.8.6 allows Directory Traversal via crafted use of .. in Template/edit/path URIs, as demonstrated by the admin.php?s=/Template/edit/path/web........1.txt.html URI to read the 1.txt file...

CVE-2018-20557

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the pagename parameter...

CVE-2018-11422

Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. Any commands including devi...

CVE-2018-20094

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

CVE-2018-14043

mstdlib aka the M Standard Library for C 1.2.0 has incorrect file access control in situations where Mfspermscanaccess attempts to delete an existing file that lacks public read/write access during a copy operation, related to fs/mfs.c and fs/mfspath.c. An attacker could create the file and then...