68380 matches found
CVE-2018-18587
BigProf AppGini 5.70 stores the passwords in the database using the MD5 hash...
CVE-2018-16723
In Jingyun Antivirus v2.4.2.39, the driver file ZySandbox.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x12364020...
CVE-2018-16595
The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices has a Buffer Overflow...
CVE-2018-21179
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 before 1.0.0.57, D7800 before 1.0.1.30, R7500 before 1.0.0.122, R7500v2 before 1.0.3.24, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.92, WNDR4300 before...
CVE-2018-16247
YzmCMS 5.1 has XSS via the admin/systemmanage/userconfigadd.html title parameter...
CVE-2018-11789
When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any file on the host. Example woule be modifying the parameter path= to go to the directory you would like to view. i.e. ..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd...
CVE-2018-11735
index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter...
CVE-2018-11558
DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newfirstname parameter...
CVE-2018-15815
FastStone Image Viewer 6.5 has an Exception Handler Chain Corrupted issue starting at image00400000+0x00000000003ef68a via a crafted image file...
CVE-2018-17785
In blynk-server in Blynk before 0.39.7, Directory Traversal exists via a ../ in a URI that has /static or /static/js at the beginning, as demonstrated by reading the /etc/passwd file...
CVE-2018-15530
Cross-site scripting XSS in the web interface of the Xerox ColorQube 8580 allows remote persistent injection of custom HTML / JavaScript code...
CVE-2018-15520
Various Lexmark devices have a Buffer Overflow issue 2 of 2...
CVE-2018-19515
In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator. However, by using one of the bgsend, atmentsddd1xGz, or xlsbgimport query parameters, most of these methods become available to unauthenticated users...
CVE-2018-19461
admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php...
CVE-2018-11097
An issue was discovered in cloudwu/cstring through 2016-11-09. There is a memory leak vulnerability that could lead to a program crash...
CVE-2018-13423
admin/themes/default/items/tag-form.php in Omeka before 2.6.1 allows XSS by adding or editing a tag...
CVE-2018-15129
ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article∾=comment=do content parameter...
CVE-2018-13063
Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts...
CVE-2018-13070
The mintToken function of a smart contract implementation for EncryptedToken ECC, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...