68252 matches found
CVE-2018-21021
imggantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the hostid parameter...
CVE-2018-21056
An issue was discovered on Samsung mobile devices with O8.x software. The Smartwatch displays Secure Folder Notification content. The Samsung ID is SVE-2018-12458 September 2018...
CVE-2018-21030
Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...
CVE-2018-21012
The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS...
CVE-2018-21088
An issue was discovered on Samsung mobile devices with N7.x software. An attacker can cause a reboot because InputMethodManagerService has an unprotected system service. The Samsung ID is SVE-2017-9995 January 2018...
CVE-2018-21079
An issue was discovered on Samsung mobile devices with L5.x, M6.0, N7.x, and O8.0 software. There is a kernel pointer leak in the USB gadget driver. The Samsung ID is SVE-2017-10993 March 2018...
CVE-2018-12625
An issue was discovered in Eventum 3.5.0. /htdocs/validate.php has XSS via the values parameter...
CVE-2018-12247
An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrbclass, related to certain .clone usage, because mrbobjclone in kernel.c copies flags other than the MRBFLAGISFROZEN flag e.g., the embedded flag...
CVE-2018-12687
tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h...
CVE-2018-12302
Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via cross-site scripting...
CVE-2018-12005
An unprivileged user can issue a binder call and cause a system halt in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU,...
CVE-2018-12735
SAJ Solar Inverter allows remote attackers to obtain potentially sensitive information via a direct request for the inverterinfo.htm or englishmain.htm URI...
CVE-2018-12678
Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SSRF attacks...
CVE-2018-12492
PHPOK 4.9.032 has an arbitrary file deletion vulnerability in the delfilef function in framework/admin/tplcontrol.php...
CVE-2018-12258
An issue was discovered on Momentum Axel 720P 5.1.8 devices. Custom Firmware Upgrade is possible via an SD Card. With physical access, an attacker can upgrade the firmware in under 60 seconds by inserting an SD card containing the firmware with name 'ezviz.dav' and rebooting...
CVE-2018-12438
The Elliptic Curve Cryptography library aka sunec or libsunec allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the...
CVE-2018-12357
Arista CloudVision Portal through 2018.1.1 has Incorrect Permissions...
CVE-2018-12915
In libpbc.a in PBC through 2017-03-02, there is a buffer over-read in calchash in map.c...