68526 matches found
CVE-2018-10469
b3log Symphony aka Sym 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name parameter to the /upload URI...
CVE-2018-21018
Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions...
CVE-2018-14008
Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled...
CVE-2018-11367
An issue was discovered in CppCMS before 1.2.1. There is a denial of service in the JSON parser module...
CVE-2018-17170
Grouptime Teamwire Desktop Client 1.5.1 prior to 1.9.0 on Windows allows code injection via a template, leading to remote code execution. All backend versions prior to prod-2018-11-13-15-00-42 are affected...
CVE-2018-17025
admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage action for a page with no special role...
CVE-2018-12296
Insufficient access control in /api/external/7.0/system.System.getinfos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POST requests...
CVE-2018-21159
NETGEAR ReadyNAS devices before 6.9.3 are affected by incorrect configuration of security settings...
CVE-2018-1000890
FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can allow the attacker to grab the entire database of the application...
CVE-2018-21090
An issue was discovered on Samsung mobile devices with software through 2017-11-03 S.LSI modem chipsets. The Exynos modem chipset has a baseband buffer overflow. The Samsung ID is SVE-2017-10745 January 2018...
CVE-2018-12101
CMS Clipper 1.3.3 has XSS in the Security tab search, User Groups, Resource Groups, and User/Resource Group Links fields...
CVE-2018-20604
Lei Feng TV CMS aka LFCMS 3.8.6 allows Directory Traversal via crafted use of .. in Template/edit/path URIs, as demonstrated by the admin.php?s=/Template/edit/path/web........1.txt.html URI to read the 1.txt file...
CVE-2018-20557
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the pagename parameter...
CVE-2018-11422
Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. Any commands including devi...
CVE-2018-20094
An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...
CVE-2018-14043
mstdlib aka the M Standard Library for C 1.2.0 has incorrect file access control in situations where Mfspermscanaccess attempts to delete an existing file that lacks public read/write access during a copy operation, related to fs/mfs.c and fs/mfspath.c. An attacker could create the file and then...
CVE-2018-16994
An issue was discovered on PHOENIX CONTACT AXL F BK PN =1.0.4, AXL F BK ETH = 1.12, and AXL F BK ETH XC = 1.11 devices and Bosch Rexroth S20-ETH-BK and Rexroth S20-PN-BK+ the S20-PN-BK+/S20-ETH-BK fieldbus couplers sold by Bosch Rexroth contain technology from Phoenix Contact. Incorrect handling ...
CVE-2018-25064
A vulnerability was found in OSM Lab show-me-the-way. It has been rated as problematic. This issue affects some unknown processing of the file js/site.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. The patch is named...
CVE-2018-16622
Multiple cross-site scripting XSS vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 discription or 2 comments field, related to users/userAddContent...