CVE-2018-16207: Undefined Security Weakness

PowerAct Pro Master Agent for Windows Version 5.13 and earlier allows authenticated attackers to bypass access restriction to alter or edit unauthorized files via unspecified vectors...

CVE-2019-3921: Stack-based Buffer Overflow

The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST request sent by a remote, authenticated attacker to /GponForm/usbForm?script/. An attacker can leverage this vulnerability to potentially execute arbitrary cod...

CVE-2019-6565: Improper Neutralization of Input During Web Page Generation

Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attacks, which may be used to send a malicious script...

CVE-2019-1698

A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director IoT-FND Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External...

CVE-2019-0257: Missing Authorization

Customizing functionality of SAP NetWeaver AS ABAP Platform fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2019-6250: Integer Overflow or Wraparound

A pointer overflow, with code execution, was discovered in ZeroMQ libzmq aka 0MQ 4.2.x and 4.3.x before 4.3.1. A v2decoder.cpp zmq::v2decodert::sizeready integer overflow allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer, which can be leverag...

CVE-2018-16162: Undefined Security Weakness

OpenDolphin 2.7.0 and earlier allows authenticated attackers to obtain other users credentials such as a user ID and/or its password via unspecified vectors...

CVE-2018-15711: Improper Neutralization of Special Elements used in an OS Command

Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges...

CVE-2018-19204: Improper Input Validation

PRTG Network Monitor before 18.3.44.2054 allows a remote authenticated attacker with read-write privileges to execute arbitrary code and OS commands with system privileges. When creating an HTTP Advanced Sensor, the user's input in the POST parameter 'proxyport' is mishandled. The attacker can...

UBUNTU-CVE-2018-18065

setkey in agent/helpers/tablecontainer.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service...

CVE-2018-17553: Improper Limitation of a Pathname to a Restricted Directory

An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigateupload.php in Naviwebs Navigate CMS 2.8 allows authenticated attackers to achieve remote code execution via a POST request with engine=picnik and id=../../../navigateinfo.php...

CVE-2018-15365: Improper Neutralization of Input During Web Page Generation

A Reflected Cross-Site Scripting XSS vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability...

CVE-2018-17013

An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services e.g., inetd, HTTP, DNS, and UPnP via long JSON data for protocol wan wanrate...

Design/Logic Flaw

An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services e.g., inetd, HTTP, DNS, and UPnP via long JSON data for protocol wan wanrate...

CVE-2018-17005

An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services e.g., inetd, HTTP, DNS, and UPnP via long JSON data for firewall dmz enable...

CVE-2018-17006

An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services e.g., inetd, HTTP, DNS, and UPnP via long JSON data for firewall lanmanage mac2...

CVE-2018-17007

CVE-2018-17007 affects TP-Link TL-WR886N devices (versions 6.0 2.3.4 and 7.0 1.1.0). Authenticated attackers can crash router services (inetd, HTTP, DNS, UPnP) by sending unusually long JSON data to the wireless wlan_wds_2g SSID. CVSS data from NVD indicates Network attack, Low complexity, Privil...

CVE-2018-17018

CVE-2018-17018 affects TP-Link TL-WR886N devices (versions 6.0 2.3.4 and 7.0 1.1.0). Authenticated attackers can crash router services (inetd, HTTP, DNS, UPnP) by sending long JSON data for the time_switch name. The impact described is partial availability loss of those services. The available so...

CVE-2018-17004

An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services e.g., inetd, HTTP, DNS, and UPnP via long JSON data for wlanaccess name...

CVE-2018-17004

CVE-2018-17004 affects TP-Link TL-WR886N devices, specifically version 6.0 2.3.4 and 7.0 1.1.0. The issue allows authenticated attackers to crash router services (inetd, HTTP, DNS, UPnP) by sending long JSON data for the wlan_access name. This can impact availability of router services (as indica...