CVE-2018-15711: Improper Neutralization of Special Elements used in an OS Command

Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges...

CVE-2018-19204: Improper Input Validation

PRTG Network Monitor before 18.3.44.2054 allows a remote authenticated attacker with read-write privileges to execute arbitrary code and OS commands with system privileges. When creating an HTTP Advanced Sensor, the user's input in the POST parameter 'proxyport' is mishandled. The attacker can...

CVE-2018-0606: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Pixelpost v1.7.3 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2018-0586: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to read arbitrary files via unspecified vectors...

CVE-2018-0590: Undefined Security Weakness

Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors...

CVE-2018-0548: Undefined Security Weakness

Cybozu Garoon 4.0.0 to 4.6.0 allows remote authenticated attackers to bypass access restriction to view the closed title of "Space" via unspecified vectors...

CVE-2017-9513: Improper Access Control

Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have access to, although th...

CVE-2017-1000240: Improper Neutralization of Input During Web Page Generation

The application OpenEMR is affected by multiple reflected & stored Cross-Site Scripting XSS vulnerabilities affecting version 5.0.0 and prior versions. These vulnerabilities could allow remote authenticated attackers to inject arbitrary web script or HTML...

CVE-2017-15888: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allows remote authenticated attackers to inject arbitrary web script or HTML via the NAME parameter...

CVE-2010-3050: Improper Input Validation

Cisco IOS before 12.233SXI allows remote authenticated users to cause a denial of service device reboot...

CVE-2017-7548: Missing Authorization

PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service...

CVE-2017-11681: Improper Privilege Management

Incorrect Access Control vulnerability in Hashtopussy 0.4.0 allows remote authenticated users to execute actions that should only be available for administrative roles, as demonstrated by an action=createVoucher request to agents.php...

CVE-2016-7803: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to execute arbitrary SQL commands via "MultiReport" function...

CVE-2017-2116: Undefined Security Weakness

Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors...

CVE-2017-2094: Improper Privilege Management

Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Workflow and the "MultiReport" function to alter or delete information via unspecified vectors...

CVE-2017-2115: Incorrect Permission Assignment for Critical Resource

Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to obtain "customapp" information via unspecified vectors...

CVE-2016-3114: Undefined Security Weakness

Kallithea before 0.3.2 allows remote authenticated users to edit or delete open pull requests or delete comments by leveraging read access...

CVE-2016-6903: Undefined Security Weakness

lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands...

CVE-2016-4867: Exposure of Sensitive Information to an Unauthorized Actor

Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restriction to view unauthorized project information via the Project function...

CVE-2016-3401: Undefined Security Weakness

Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote authenticated users to affect integrity via unknown vectors, aka bug 99810...